Security & HIPAA
Your patients tell Bella things they would tell your front desk. Here is exactly what happens to it.
We sign a BAA
Before a single patient call reaches Bella, we execute a Business Associate Agreement with your practice. It is not an upgrade or an enterprise add-on. It comes with every plan, including the free week.
Encrypted end to end
Call audio and transcripts are encrypted in transit with TLS 1.2+ and at rest with AES-256. Nothing touches disk unencrypted, and nothing crosses the network in the clear.
Who can hear the recordings
Your practice can, through your own call log. On our side, access is restricted to named support staff, only when you raise a ticket that requires it, and every access is logged. We do not listen to calls for any other reason.
Your data is never training data
Patient calls are not used to train models, not ours and not a vendor's. PHI is not sold, shared with advertisers, or handed to any third party outside the subprocessors needed to place the call and write to your calendar.
It gets deleted
Recordings are deleted after 30 days. Transcripts and call metadata are kept for 12 months so you have a record of what was said, then removed. You can request earlier deletion at any time, and everything goes when you cancel.
Minimum necessary, by design
Bella collects what she needs to book the appointment and nothing more. Data is processed and stored in the United States.
The data policy, in one page
- What we collect
- The caller's phone number, what they said, what Bella said, and the appointment details she wrote to your calendar. Nothing beyond what is needed to book and to give you a record.
- Where it lives
- Encrypted storage in the United States, under your practice's account. It is your data. You can export it or ask us to delete it whenever you like.
- Who touches it
- You and your staff, through the call log. Our named support staff, only on a ticket you opened, with the access logged. The subprocessors that carry the call and write to your calendar, each covered by their own agreement.
- How long we keep it
- Recordings: 30 days. Transcripts and metadata: 12 months. Then deleted automatically. Cancel and everything is removed.
- What we will never do
- Train models on your patients' calls. Sell or share PHI. Use a recording for marketing. Keep your data after you have asked us to delete it.
- A breach
- Notified to you without unreasonable delay and within the timelines our BAA sets, with what happened, what was affected, and what we did about it.
Doing a security review?
Send your questionnaire, or ask for the BAA and we'll have it to you the same day. We would rather answer your compliance officer's questions before you buy than after.
info@autoappoint.me