Full FDA Non-Device CDS disclaimer

ARKA Clinical Decision Support is designed to meet all four criteria for Non-Device CDS under FD&C Act §520(o)(1)(E) and FDA's January 2026 final guidance on Clinical Decision Support Software. Recommendations support, not replace, the clinician's judgment. Every recommendation is anchored in a published guideline or peer-reviewed source, with the basis available for independent review. CLIN emphasizes imaging appropriateness at order entry.

This recommendation is intended to support, not replace, clinical judgment. It is generated by ARKA, software designed to meet the four criteria for Non-Device Clinical Decision Support under FD&C Act §520(o)(1)(E) and FDA's final guidance on Clinical Decision Support Software (January 2026). The clinician is responsible for the final decision.

Regulatory rationaleFeature catalogTrust center

ARKA-SEC-009

PHI-relevant subprocessors

Subprocessors in the production serving path today — confirmed against application infrastructure (Vercel hosting, Supabase data tier, optional Render ML inference). BAAs with each PHI-touching provider are required before production PHI flows.

PHI-relevant subprocessors — name, function, data touched, BAA status, and region
SubprocessorFunctionData touchedBAA statusRegion
Vercel, Inc.Edge / application hosting (Next.js, CDS Hooks & API routes)Structured FHIR prefetch and CDS context processed transiently in the request path — no PHI persisted at the edgeRequired before production PHIUnited States (primary: iad1)
Supabase, Inc.PostgreSQL data tier (tenant-isolated databases, row-level security)De-identified audit rows, hashed identifiers, AIIE scores, security event logs — encrypted at restRequired before production PHIUnited States
Render Services, Inc.Optional ML inference service (when ML_SERVICE_URL is configured)Structured order features for AIIE scoring in the CDS request path — rule-based fallback when unset or unreachableRequired before production PHIUnited States

Change notification: Customers are notified at least 30 days before ARKA adds a PHI-touching subprocessor — aligned with BAA subcontractor flow-down and customary objection rights.