Security & Data
Last updated: 29 October 2026
Clinics ask us which tools touch their data and whether each one is covered by a Business Associate Agreement (BAA). This page answers that. It describes how we build, not a certification: we don't claim any, and the exact setup for your clinic is confirmed in writing before launch.
Our rule
Patient information goes only to a vendor that has agreed to a BAA (or a DPA where GDPR applies) covering the specific service we use. If a vendor doesn't offer one, we don't send patient information to it. We sign our own BAA or DPA with your clinic before go-live, on every plan.
Vendors and what is covered
| Vendor | What we use it for | BAA position | How we use it |
|---|---|---|---|
| OpenAI (API) | AI replies and call handling | BAA available for the API. Eligible services only. ChatGPT consumer plans are not covered. | Patient information goes only to API services covered by a signed BAA. Live web search is not used with patient information. |
| Twilio | Phone calls and SMS | BAA available for products on Twilio's HIPAA-eligible list. Email through SendGrid is not covered. | Calls and texts that may contain patient information use eligible products under a signed BAA. Patient information is not sent by SendGrid email. |
| n8n | Workflow automation | n8n Cloud does not sign a BAA. Self-hosted n8n is run by the operator, so the BAA question is about the hosting provider. | Workflows that touch patient information run on self-hosted n8n inside hosting covered by a BAA. |
| Voice AI and speech-to-text providers | 24/7 voice receptionist, call transcripts | Provider-specific. | Named in your agreement. Not used with patient calls until a BAA is signed with that provider. |
| Facebook, Instagram, WhatsApp (Meta) | Patient chat on social channels | No BAA available. | The AI doesn't ask for clinical details on these channels and points patients to a phone call or your secure form. |
| Google Business Profile | Patient chat from Google listings | Not covered by a BAA. | Same as Meta: no clinical details collected in chat. |
| Formspree and Calendly (this website) | Our contact form and scheduling | Not relied on for patient information. | Used only for visitors' names, emails and meeting times. Please don't send patient information through this website. |
Call recordings, transcripts and sentiment analysis
On Ultimate Autonomous Practice and Enterprise, calls can be recorded, transcribed and scored for sentiment so you can review them. Transcripts may contain patient information, so they are stored under the BAA with your clinic, and how long they are kept is agreed in writing. Plans without the voice receptionist don't create call transcripts.
Intake forms and booking
Intake forms collect only the fields your clinic chooses and send them to your own systems. We don't keep a separate copy of intake answers on our side.
Questions
Ask for the current vendor list for your plan, or a copy of our BAA, at admin@neuralflowenterprises.com. Vendors change their terms, so we confirm coverage again when we scope your build.