Business associate agreements
Appropriate BAAs with each practice and vendors handling protected health information, covering the exact services used.
Patient trust.
Built into the work.
We’re designing Common Standard around healthcare privacy and security requirements. Agreements, safeguards, and permitted uses are established before any live patient data is connected.
Clear responsibilities.
Careful boundaries.
Access and protection
Encryption, role-based permissions, and access controls are requirements for the live product.
Consent and choice
A record of communication permissions, opt-outs, and applicable channel restrictions.
Review and traceability
Audit records for access, AI actions, and communications, with staff approval where required.
Sensitive information
Additional safeguards for sensitive categories and applicable rules, including substance-use records where 42 CFR Part 2 applies.
Data boundaries
No third-party advertising pixels on patient pages. Sensitive message content belongs in appropriately protected channels.
Administrative help.
Human judgment where it belongs.
AI is intended to support scheduling, routine information, and communication workflows. It does not provide clinical advice. Clinical or urgent requests go to the practice’s staff under agreed escalation procedures.
Working toward independent assurance.
We plan to pursue SOC 2 Type 2 or HITRUST. The choice and timing remain open; neither an audit nor a completed attestation or certification is claimed.
Our design work considers HIPAA, communications consent and opt-out rules, applicable email and texting requirements, and health-data tracking restrictions. The exact requirements depend on the workflow and the parties involved.
A few practical details.
Are the demos connected to patient records?
No. Every public demo uses fictional records and runs in your browser. It does not connect to an EHR, send a message, book an appointment, or start an advertising campaign.
How is this website inquiry handled?
The form sends business contact details and your practice’s stated needs to our inquiry service so we can follow up. Do not include patient information. We do not place third-party advertising pixels on these inquiry pages.
Can you share your security documentation?
We’ll discuss the agreements, controls, data flows, and review requirements with prospective design partners before live onboarding.
Help shape what comes next.
Bring your workflows, your EHR, and the things your team wishes worked better. Get direct founder access and help build the modules your practice needs.
Become a design partner