HIPAA & Security
HelloMedSpa builds communication systems for medical spas and aesthetic practices. Because those conversations can touch protected health information (PHI), our platform is built with patient privacy in mind at every layer. This page explains how we handle data, what we commit to, and what remains the responsibility of your practice.
Data we process
On behalf of a practice we may process caller and patient contact details, appointment requests, call and chat transcripts, message history, and the treatment interests a patient volunteers. We do not request diagnoses, clinical records, insurance identifiers, or payment card data through our AI channels, and our assistants are instructed not to solicit them.
How data is protected
- Encryption in transit over TLS and encryption at rest on our managed infrastructure.
- Role-based access control; internal access is limited to staff who need it to deliver or support your service.
- Row-level database security so one practice's records are never readable by another.
- Audit logging of administrative access and configuration changes.
- Secrets and API credentials stored in a managed secret store, never in application code.
- Backups of production data with restoration procedures tested as part of routine operations.
Business Associate Agreements
Where HelloMedSpa acts as a business associate to a covered entity, we will execute a Business Associate Agreement (BAA) that governs permitted uses of PHI, safeguards, breach notification, and return or destruction of data at termination. We also maintain agreements with the subprocessors that support telephony, messaging, hosting, and CRM functions. A current subprocessor list is available on request.
AI conversation safeguards
- Our assistants identify themselves as a virtual assistant, not a clinician.
- They do not diagnose, interpret symptoms, or promise treatment outcomes, and they route clinical questions to your staff.
- Prompts and knowledge bases are scoped to the practice that owns them.
- Conversation data is used to operate your service — not sold, and not used to train third-party public models.
Retention and deletion
Records are retained for as long as needed to operate your service and to meet the retention terms in your agreement. A practice may request export or deletion of its data at any time, and we return or destroy practice data after termination in line with the applicable BAA.
Incident response
We maintain an incident response process covering detection, containment, investigation, and notification. If we discover a breach of unsecured PHI, we notify the affected practice without unreasonable delay so the covered entity can meet its own notification obligations.
Your responsibilities
HIPAA compliance is shared. Your practice remains responsible for its own policies, staff training, patient consent and communication preferences, user account hygiene, and for the content it configures our assistants to send. We do not claim certification on your behalf; HIPAA has no official certifying body.
Questions
For a BAA, subprocessor list, or a security review, email success@hellomedspa.ai or call 888-468-1615. See also our AI Compliance and Privacy Policy pages.