Security, Privacy & HIPAA

Last updated: November 2026

Buzzwisely answers phone calls for healthcare practices and other businesses. Those calls can include protected health information (PHI), so we built the service around HIPAA's requirements from the start. This page explains how we handle your data and lists every vendor that handles PHI on our behalf.

Questions? Email trust@buzzwisely.com.

At a glance

• We sign a Business Associate Agreement (BAA) with our healthcare customers.
• We have a BAA with every subprocessor that handles PHI. They are all listed below.
• PHI stays in BAA-covered systems. Our engineering, project-management, support and AI coding tools are deliberately kept PHI-free.
• Your call data isn't used to train AI models. The AI that handles your calls runs on an enterprise cloud AI platform under contract terms that prohibit using customer data to train models.
• Each business's data is isolated from every other customer's, and access within your organization is role-based.
• Access to call records and tickets is recorded in a tamper-proof audit log.

Our HIPAA program

• Security & Privacy Officer. Amin Khaef is accountable for Buzzwisely's HIPAA program and is the point of contact for any security or privacy matter.
• Business Associate Agreements. We sign a BAA with each healthcare customer before handling PHI for them, and we hold a BAA with every downstream subprocessor that receives PHI.
• Workforce training. Everyone at Buzzwisely with access to production systems completes HIPAA training.
• Minimum necessary. We collect and share only what is needed to answer the call and do the job. For example, product-analytics session recordings of our web app mask all on-screen text and form inputs, so they show how the app is used but never what a patient said.
• HIPAA mode for each phone line. HIPAA mode can be turned on for any phone line. It keeps that line's voice processing on BAA-covered speech vendors and removes patient details from email and text notifications, which then point you to the secure app instead.

How we protect your data

Access control

• Your staff sign in through a dedicated identity provider. Within your organization, each user has a role (owner, admin or member) that determines what they can see and change.
• Every request is checked against the business it belongs to, so one customer can never reach another customer's calls, tickets or settings. Automated tests check this isolation on every code change.
• Buzzwisely's administrative access requires multi-factor authentication and is limited to the people who need it to run and support the service.

Encryption

• Data is encrypted in transit with TLS between our services and to every vendor listed below.
• Data at rest is encrypted. Our primary database and our call-recording storage both encrypt everything they store.
• Credentials for systems you connect, such as your practice-management system, are only ever released to our own service while it is handling one of your calls.

Auditing and monitoring

• Viewing or changing call records, tickets, team access and invitations is recorded in an append-only audit log that nobody can edit or delete.
• Production services are monitored continuously. Errors and unusual activity raise alerts to our engineering team.

Secure engineering

• Every signal that can start or change a call (telephony webhooks, payment webhooks, scheduled jobs, connections between our own services) must carry a cryptographic signature or secret key. Anything without one is rejected.
• We maintain an internal threat model covering every trust boundary in our system. Automated tests check each boundary, so a regression fails the build instead of reaching production.
• User-entered text is checked against strict rules, and the AI is told to treat business data as data, not as instructions. Both defend against prompt-injection attacks.
• We ran our most recent internal security audit in September 2026.

Data retention and deletion

• Retention periods for call records, transcripts and recordings are set out in our data retention schedule, which we provide on request.
• You can ask us to delete specific calls, or all of your data, at any time by emailing trust@buzzwisely.com.
• When your agreement ends, we return or destroy PHI as set out in our BAA.

Incident response

• If we discover a security incident or a breach of unsecured PHI, we notify affected customers without unreasonable delay, within the timeframes set by our BAA and HIPAA's Breach Notification Rule.

Subprocessors that handle PHI

We have a signed BAA with every subprocessor in this table.

We identify our subprocessors by role rather than by name. The named list, with current certifications, is available under NDA — email trust@buzzwisely.com and we will send it, usually the same business day.

Other service providers (no PHI)

These providers help us run the service. They never receive PHI.

Documents available on request

• Our Business Associate Agreement
• Our data retention schedule
• Completed security questionnaires (for example, a vendor risk assessment from your compliance team)

To request either, email trust@buzzwisely.com.

We update this page whenever we add or change a subprocessor.