Trust · disclosures

What the line discloses, and what a BAA covers.

HIPAA-aware controls. A spoken recording notice the customer cannot switch off. A Business Associate Agreement described in words, not as a public download.

• HIPAA-aware controls

  The public surface uses HIPAA-aware framing. This page does not claim a completed certification, a Risk Analysis on file, or named Privacy and Security Officers. Sending protected health information without a countersigned BAA and HIPAA Mode is a material breach of the Acceptable Use Policy.

• Recording notice

  VoiceLab speaks a recorded notice in the first seconds of a call. Customers cannot turn this notice off. Source: Terms of Service §11 and Privacy Policy §11.

  Call recordings and transcripts: 90 days by default. HIPAA-mode: 30 days, or 6 years for a designated record-set when the workspace configures that window. Source: Privacy Policy §7.

• What a BAA covers

  A Business Associate Agreement, when countersigned, covers protected health information the operator creates, receives, maintains, or transmits on behalf of the covered entity. The template is NDA-gated and is not a public URL.

  • Permitted use

    Perform the services; run the operator; data aggregation the HIPAA rules allow. No sale of PHI. No marketing use of PHI without the covered entity’s written authorization.

  • Safeguards

    Administrative, physical, and technical safeguards under 45 CFR §§164.308, 164.310, 164.312, and 164.316.

  • Subcontractors

    A written agreement with each subcontractor before that party receives PHI, at least as stringent as the BAA.

  • Breach notice

    Notice of a breach of unsecured PHI without unreasonable delay, and in no case later than 30 calendar days after discovery. High-severity events: as soon as practicable, and not later than 72 hours.

  • End of the agreement

    Return or destroy PHI when the agreement ends. If return or destruction is not feasible, the same protections stay on the PHI that remains.