HIPAA-Covered Services

1. HIPAA-Covered Services (available to accounts with an executed BAA and the HIPAA configuration enabled)

• The HIPAA Add-on with,
  
  • Client profiles and client records, including client notes and appointment notes
  • Appointment booking, scheduling, confirmations, and reminders
  • Intake, consent, and clinical forms (GeniusForms)
  • Treatment notes, charting, and SOAP notes
  • Client photos, including before/after and photos received by text
  • Payments and invoices via Stripe
  • Transactional e-mail notifications
  • Data export of client records
• Onboarding and data migration (covered only when performed after customer BAA is signed)

2. Available with conditions

• Calendar sync and other customer-directed integrations: covered up to the point PHI leaves the Services.
• Marketer, including review requests, review responses, drafting personalized client outreach, and Google Business Profile actions: covered entities may not use PHI for marketing purposes without the patient’s authorization.

3. Not HIPAA-Covered Services (PHI may not be entered or processed)

• Text marketing campaigns and promotional communications
• Growth Analyst, Reception, and other Generative Tools
• Websites built on the platform, booking pages, and any public-facing content
• Gift cards, BNPL, and payroll partners
• Any Beta Service or feature designated pilot, evaluation, or non-production, unless written authorization says otherwise
• Analytics, evaluation, and model-improvement pipelines, including Braintrust; HIPAA accounts are excluded from these
• Marketer, including review requests, review responses, drafting personalized client outreach, and Google Business Profile actions

‍