Security

Business Associate Agreement

No call for your practice is answered before your Business Associate Agreement with us is signed.

From then on we are a business associate of your practice. The obligations are ours in writing, not implied.

Not every vendor in the table further down has a signed agreement with us; the table shows which do. We will tell you which are outstanding before you sign anything.

What we access, and what we do not

We read your schedule with a key your practice enables and your practice can revoke. The list on the left is what the agent uses. The list on the right is what we do not read.

What we write back, entry by entry, is on the Open Dental page.

Transcripts and call audio

Calls are transcribed, and the caller is told so at the start of the call. Transcripts are stored in our own database, in a United States region.

Call recording is switched off for every practice until counsel has settled the call-start notice described below. Once a practice switches it on, only that practice’s authorized staff can play a recording. Nobody at Leady listens to call audio.

They belong to your practice. On request, we send you a copy of every transcript we hold for you and delete ours.

Not yet decided: a default retention period for practice accounts. Until one is set and written on this page we keep transcripts for the life of the account and delete them when you ask. Ask us and we will tell you exactly what we hold for you.

Getting your data back

Anything we hold is yours: on request, we send you a copy and delete ours.

Who else touches practice data

Every vendor in the path, and what each one sees. If this list changes, this page changes with it.

Voice platform

Carries the call and produces the transcript

What it sees: Call audio, transcripts, caller phone number

BAA signed: yes

Speech model

Understands the caller and speaks the agent’s replies

What it sees: Call audio and the text of the conversation

BAA signed: yes

Open Dental connector

Reads the practice schedule and books appointments into it

What it sees: Appointments, providers, chairs, patient names and phone numbers

BAA signed: no

Database and file storage

Our own records, in a United States region

What it sees: Appointments, caller names and numbers, transcripts

BAA signed: yes

Staff sign-in

Authentication for your team

What it sees: Staff names and email addresses. No patient data.

BAA signed: no

Billing

Takes the payment

What it sees: Your practice billing details. No patient data.

BAA signed: no

Signed means an agreement we have accepted, not one a vendor merely offers. Where it says no, no agreement is in place yet. The agreements shown as signed were accepted on 13 September 2026, the day before Leady AI LLC was formed, so they were accepted by our founder and not by the company; they are being re-accepted in the company’s name. No patient data has ever passed through any of them.

Telling callers what they are talking to

Every call starts with a notice that the caller is talking to an automated assistant and that the call is transcribed.

Not yet final: the exact wording of that notice. It is being settled with counsel under Florida law before any practice goes live, and we will not claim compliance we have not checked for your state.

What we are not claiming

• We are not SOC 2 certified, and we have not started an audit.
• We do not use "HIPAA compliant" as a badge. HIPAA is a set of obligations met in a signed agreement, not a logo.
• We have not had a third-party penetration test.
• We do not publish an uptime figure, because we do not yet measure one.
• We have never had a security incident — because we have not yet run a practice in production. That is a fact about our age, not about our controls.