HIPAA Business Associate Agreement

Effective 2026-05-01

Standard HIPAA BAA. Auto-applies to Enterprise customers enrolled via /admin/hipaa; available on request for Pro customers.

Scope

Silux Voice acts as Business Associate to the Customer (Covered Entity). PHI may be processed within Silux Voice's recordings, transcripts, and Receptionist call logs.

Permitted uses + disclosures

PHI processed solely for service delivery + de-identified aggregate metrics. No marketing use. No sale of PHI.

Safeguards

TLS in transit; AES-256 at rest; KMS-encrypted recordings for HIPAA-enrolled customers; audit logs retained 6 years.

Breach

We will notify Covered Entity within 24 hours of confirming a breach involving PHI.

Termination

Upon termination, all PHI returned or destroyed within 30 days, with destruction certificate provided.

Other documents: Privacy Policy · Terms of Service · Cookie Policy · Data Processing Agreement · Service Level Agreement · Acceptable Use Policy · Sub-processors · Accessibility Statement · Security Overview