Last updated: August 17, 2026. This is a working draft — we're finalizing our full policy with counsel.
When Sanivo handles Protected Health Information (PHI) on behalf of a covered entity (your practice), we act as a Business Associate under HIPAA. Every Sanivo subscription that touches PHI includes a signed Business Associate Agreement (BAA).
Sanivo services that process PHI run on HIPAA-compliant infrastructure with encryption at rest and in transit, access controls, and comprehensive audit logging. Our $250/month HIPAA infrastructure fee funds this posture.
PHI is stored only in HIPAA-compliant systems. It is never used for advertising, sold to third parties, or shared with anyone outside your practice and the vetted subprocessors listed in your BAA.
In the unlikely event of a breach involving PHI, Sanivo notifies affected practices in accordance with HIPAA Breach Notification Rule timelines.
Patients can request access to their PHI, corrections, and accounting of disclosures through their covered entity (your practice). Sanivo supports these requests as your Business Associate.
HIPAA questions: hipaa@sanivo.ai. Request a BAA: hipaa@sanivo.ai.
Questions? Email privacy@sanivo.ai for privacy matters, hipaa@sanivo.ai for HIPAA questions, or learnmore@sanivo.ai for anything else.
