We execute a Business Associate Agreement with every covered entity that uses Curee, before any PHI flows. Our standard BAA is reviewed by external healthcare counsel and posted in our trust center.
We also execute BAAs with every subprocessor in our chain — cloud providers, model hosting, analytics. The chain is visible to customers in our subprocessor list.
We do not modify BAAs in ways that weaken HIPAA's baseline. We will sign customer paper, but only above the floor.
