Most AI vendors charge extra for HIPAA compliance, or hide it behind an enterprise sales call. We built it in from the start, at every price, with no upcharge. This page is for you and for your attorney. It says what's finished and what's still in progress — because you'll find out either way, and we'd rather you find out here.
Your patients' conversations are never used to train AI. Some vendors feed call recordings into AI systems that learn from them. We don't, and it isn't a policy we could quietly change — the system has no path to do it.
We keep a record of every time patient information is accessed. Every call, every booking, every look at a record — logged with a timestamp. If anyone ever asks who saw what and when, there's an answer.
Text messages to your patients never mention treatments. A confirmation text says the date, the time, and your practice's name. Never "Botox" or "filler" or anything about their treatment. That's deliberate: it keeps your patients' text messages from becoming medical records sitting on a phone.
The AI won't discuss anything medical. It can't recommend a treatment, quote a procedure price, or answer a clinical question. It books a consult instead. Built in, not a setting.
Everything is encrypted, moving between systems and sitting in storage.
Delivering this service means a handful of specialized companies are involved. HIPAA requires a signed agreement with each one that handles patient information. Here's the complete list and where each one stands.
| What they do | Company | Where it stands |
|---|---|---|
| Powers the voice conversation | Retell AI | Signed agreement, July 2026. Independently security-audited. |
| Sends you booking notifications | Amazon Web Services | Signed agreement, July 2026. |
| Our internal email and documents | Google Workspace | Signed agreement, July 2026. |
| Stores your bookings and patient records | Xano | Agreement activated before we process any patient information. No patient data goes in before it's in place. |
| Phone line and text messages | Twilio | No agreement needed — by design. Because appointment texts never contain treatment information, they aren't medical records. If your practice needs texts that do mention treatments, we put an agreement in place before turning that on. |
| Our website | Vercel | No agreement needed. It never sees patient information. |
We'll send you this list on request, and it's part of the agreement we sign with you. If we ever add a company that will handle patient information, you hear about it before it happens.
California tightened oversight of medical aesthetic practices in 2026. Those rules govern clinical practice, not AI specifically — but they shape what an AI front desk can safely do. Here's where ours stops.
Ever, to anyone, under any phrasing.
Pricing for medical procedures goes through a consult with your provider.
That stays with your supervising physician.
As California's two-party consent law requires. Verified in our own live call records — not just written into the agent's instructions.
You're reading this before we have a hundred customers. Some of the formal documentation that comes with maturity is still being written. Here's exactly where each piece stands:
With our attorney now. Signed before we handle any patient information, and available for your attorney to read before you commit to anything.
Finished before our first practice goes live.
Who can access what, how devices are handled, how information moves.
Our incident and notification procedure.
Tested before launch.
If any of these matter to your decision, ask and we'll tell you exactly where it is. A vendor who tells you everything is finished, at our stage, isn't being straight with you.
Ask us. Ask whoever else you're talking to.
Without that agreement, no vendor can legally handle your patient information. Full stop.
One gap anywhere in the chain breaks the whole thing.
Which company, which country, how long they keep it, and how it gets deleted.
Ask about their commitment to you and their vendors' commitment to them. Those are often very different numbers, and a vendor who hasn't read their own contracts won't know theirs.
Ask them to demonstrate it. Try to talk their AI into recommending a treatment. If it does, that's your license on the line.
We commit to notifying you in writing within five business days of confirming a breach. Our voice vendor's contract gives them up to 21 business days to notify us. We think you should know both numbers.
We'll walk through any of this, share our draft agreement when it's ready for review, or get on a call with your counsel directly.