BAA and HIPAA

SmileMaxer signs a Business Associate Agreement (BAA) with every practice during signup. Here’s what that means and how the architecture stays defensible.

What a BAA is

Under HIPAA, the practice (the covered entity) is responsible for any third-party software that handles patient data on its behalf. A BAA is the contract that puts the software vendor (the business associate, that’s us) on the hook for the same data-protection obligations the practice has.

When you sign

During signup, right after Stripe checkout. Click-through digital signature, takes about 90 seconds. We store the signed data with timestamp, IP address, and user agent. You can download the PDF copy any time from your admin portal.

Need a wet signature instead?

Some compliance teams require a paper signature. Email support@periomaxer.com and we’ll send a PDF for legal review.

How the architecture supports the BAA promises

• Voice never leaves the device it was spoken into. Speech-to-text runs on-device: on the phone, or on the operatory computer when using the desktop microphone.
• Chart data never leaves your LAN. The phone sends parsed values directly to the operatory computer over your own network.
• Our cloud holds licenses, not patients. We know your license keys, billing details, and PMS choice. We don’t know any patient data. By architecture, not just by policy.
• Updates are cryptographically signed. Even if our update server is compromised, the desktop refuses unsigned binaries.

What we do with your data when you cancel

• License keys are revoked immediately.
• Audit log is retained for 1 year per HIPAA recommendation.
• Billing records retained per IRS requirements (7 years).
• Practice profile (name, address) can be deleted on request.