Infrastructure & Service Providers

Last updated: October 23, 2026

1. Operator and permitted information

Tyche Services, d.b.a. Med-Cert Pro, 609 Metairie Rd PMB 4015, Metairie, LA 70005, operates this professional credential service. Med-Cert Pro is not HIPAA compliant and does not accept PHI, patient records or unrelated sensitive documents. Privacy: [email protected].

This disclosure distinguishes current integrations from services that apply only when enabled or when you purchase through a store. It does not assert that each provider acts as our processor for every purpose; payment and app-store providers also have independent obligations under their own terms.

2. GoDaddy hosting and mail

The website and private PHP application use GoDaddy/cPanel hosting. Hosting processes information necessary for the website, database, application configuration, any local document copies and technical operations. Credential documents also use the private Cloudflare R2 storage described below. Transactional mail uses the operator-configured authenticated SMTP service and mail accounts within the provider arrangements identified here. Mail can include verification, security, billing, support and reminder information. Do not send credential documents or PHI through ordinary email.

Database-only encrypted recovery copies are emailed to the operator's controlled Gmail inbox, a Google service. They contain personal database information inside the encrypted attachment, plus minimal deletion identifiers for safe restoration. The recovery private key is held separately. The actual GoDaddy hosting backup product and cycle must be verified independently. We do not claim an independently verified hosting-backup expiry, geographic redundancy, data residency or recovery guarantee. See the retention and deletion policy.

3. Cloudflare storage and signup protection

Cloudflare R2 is configured as the remote credential-document storage driver. Credential documents are encrypted by the application before upload; the private document encryption key is held separately in the application configuration/vault. Cloudflare processes encrypted objects, object identifiers and ordinary storage/request metadata. Account deletion removes the account-scoped R2 objects and any local copies under the configured private storage path, including orphaned objects found in that account namespace. A request remains incomplete if inventory, removal or absence verification fails. This does not establish a particular data residency or provider backup retention. GoDaddy hosting backups alone must not be assumed to include R2 objects.

Cloudflare Turnstile is enabled for website signup protection. It can process network, browser and challenge signals to assess abuse. Credential-document contents are not required for that challenge. Use of Turnstile does not by itself establish that Cloudflare proxies every website request.

4. Stripe billing

Stripe processes website subscription payment credentials and related billing/customer/transaction information. The application retains limited subscription and transaction references needed to determine access, handle billing and maintain financial records. Complete payment-card details are handled by the payment provider, not needed in credential documents and must not be uploaded to the wallet.

5. Apple services

Apple processes applicable App Store purchases, signed purchase verification and Apple Push Notification service delivery. Store purchase and device notification metadata are distinct from credential contents. Purchases made through Apple follow its billing and privacy terms. Configured Apple push capability does not guarantee delivery. The native apps are not publicly released at this disclosure's date.

6. Google web resources and optional native services

The website loads Google Fonts from fonts.googleapis.com and fonts.gstatic.com. Those browser requests can disclose ordinary connection/request metadata such as IP address and user-agent. This font use does not require credential-document contents.

Android includes an optional Firebase Cloud Messaging integration. When configured and enabled by a signed-in user with notification permission, Firebase handles installation/registration tokens and push delivery metadata. Server configuration is being completed; configuration checks do not establish successful delivery. Remote notification content should be generic, without credential numbers, documents or PHI. Local reminders are separate. Firebase Analytics collection is disabled in the current Android manifest.

Google Play Billing remains disabled pending production validation. Google would process applicable store payments and distribution under its own terms when enabled. Store Data Safety and Apple App Privacy declarations must reflect the released configuration.

7. Document processing and additional services

The inspected OCR/parser uses local tools and libraries, including Tesseract and PDF parsing. No external generative-AI document processor was identified in that parser. The operator has identified no outside service providers beyond GoDaddy/cPanel, Cloudflare, Stripe, Apple and Google/Firebase for the current service. Service changes must be reflected in this disclosure and the Privacy Policy where required.

We do not use credential documents or numbers for behavioral advertising or authorize unrelated AI training merely because a provider supplies infrastructure. Public provider-directory sponsorship is separate from the private credential wallet.

8. Requests and changes

Use [email protected] for questions about provider purposes, applicable privacy rights or a proposed material processing change. Material policy changes receive notice and any consent required by law. Legal notices: [email protected]. This disclosure and the Privacy Policy apply together.