HIPAA and Business Associate Agreements

1 · Who This Is For

The Health Insurance Portability and Accountability Act ("HIPAA") protects individually identifiable health information ("Protected Health Information" or "PHI"). If your business is a HIPAA covered entity, or a business associate of one, and you want Lyfework to run your website, follow-up, booking, messaging, or AI assistants, some of the information that flows through those systems can be PHI. Patient names tied to an appointment, a text asking about a treatment, or a form that mentions a condition all count.

Lyfework is not a covered entity. We are a business associate to our healthcare clients, and we only take on that role under a written Business Associate Agreement ("BAA"). If you are not a healthcare business, HIPAA does not apply to our work together and this page is informational only.

2 · What We Have Signed

The platform behind our CRM, pipelines, text and email messaging, phone numbers, calendars, forms, and automations is provided by HighLevel Inc. On November 5, 2026, Lyfework executed a HIPAA Business Associate Agreement with HighLevel Inc. covering the PHI our clients process on that platform.

• Permitted use only. HighLevel may use PHI only to provide the platform services to Lyfework, as the BAA permits, or as required by law. It may not use PHI for marketing, sell PHI, or disclose it to anyone outside the agreement.
• Safeguards. HighLevel must protect the confidentiality, integrity, and availability of electronic PHI in line with the HIPAA Security Rule.
• Incident reporting. HighLevel must report security incidents and non-permitted uses or disclosures to Lyfework within three business days of discovery, and any breach of unsecured PHI without unreasonable delay and no later than thirty days after discovery.
• Subcontractors. Every HighLevel subcontractor that touches PHI must sign a BAA with the same restrictions.
• Minimum necessary. Requests, uses, and disclosures of PHI are limited to the minimum needed for the purpose.
• Return or destruction. When the agreement ends, PHI is returned or destroyed, and any PHI that cannot be returned stays protected under the agreement.

3 · What a BAA With Lyfework Covers

When you sign a BAA with Lyfework, we commit to the following for the PHI we create, receive, maintain, or transmit on your behalf:

• We use and disclose PHI only to deliver the services in your agreement, as the BAA permits, or as required by law.
• We never use PHI for marketing, never sell PHI, and never use PHI to train AI models.
• We apply the minimum-necessary standard to our own access and to every request we make.
• We maintain administrative, physical, and technical safeguards consistent with the HIPAA Security Rule.
• We report incidents and breaches to you as described in Section 7.
• We bind every subcontractor that handles your PHI to the same restrictions, starting with the platform agreement described in Section 2.
• We help you meet your obligations to give patients access to their PHI, amend it, and account for disclosures, within the timeframes in the BAA.
• We make our relevant practices, books, and records available to the Secretary of Health and Human Services if compliance is ever reviewed.
• We return or destroy your PHI when the BAA ends.

4 · How We Protect PHI

• Access. Only the Lyfework workforce members who need to work in your account have access to it, through named user logins with role-based permissions. Access is removed when it is no longer needed.
• Encryption. Data is encrypted in transit and at rest on the platform.
• Logging. The platform records who did what in your account, so activity can be reviewed.
• Training. Our team is trained on HIPAA basics, the minimum-necessary standard, and how to handle PHI in client accounts.
• Devices. Lyfework work happens on password-protected, encrypted devices with screen locks.
• No PHI outside the platform. We do not copy PHI into spreadsheets, chat tools, email threads, or AI tools that are not covered by a BAA.

5 · Texting, Email, Forms, and AI Assistants

HIPAA does not ban texting or emailing patients. It requires you to manage the risk. Here is how we approach each channel.

• Text messages. Standard SMS is not encrypted end to end. We build appointment reminders and follow-ups so they carry the minimum: a first name, a date and time, and a link. No diagnoses, treatments, or results in a text. If you want more than that in a text, your BAA and your risk analysis decide it, not the template.
• Email. Same rule. Keep clinical detail out of automated email. Secure portals and your practice management system are the right place for records.
• Forms. Intake and booking forms on your site are built to collect what scheduling needs. If a form must collect health details, it runs inside the covered platform, not on a third-party form tool, and it is set up under your BAA.
• AI text and voice assistants. Assistants that answer messages and calls for your practice run on the covered platform and are configured to book, route, and answer general questions, not to give medical advice. Calls handled by a voice assistant are announced as automated. Recording and transcription are turned on only where the law and your consent process allow it.
• Marketing. We never use PHI to target, segment, or send marketing. Patient lists are not ad audiences. Review requests go out only in the form your BAA and your patient authorizations permit.
• Our public website. lyfework.io, our forms, and our email inboxes are not for PHI. Please do not send patient information to us there, even to ask a question about it.

6 · What Stays Your Responsibility

A BAA makes Lyfework responsible for how we handle your PHI. It does not take over your HIPAA program. You remain responsible for:

• Your Notice of Privacy Practices and any patient authorizations your communications require, including for marketing and reviews.
• Your own risk analysis, policies, and workforce training.
• Deciding which channels may carry PHI and telling us how you want them configured.
• Managing who on your team has access to your account, and removing people who leave.
• Responding to patient requests for access, amendment, and accounting. We support you with the records we hold.
• Notifying patients, regulators, and, where required, the media after a breach. We give you what you need to do it.
• Exporting records you need to keep before an account becomes inactive. The platform purges accounts that are inactive for 90 consecutive days.

7 · Incidents and Breaches

If we learn of a security incident, or a use or disclosure of your PHI that the BAA does not permit, we investigate it, contain it, and tell you in writing within the time your BAA sets. If the incident is a breach of unsecured PHI, we report it to you without unreasonable delay and no later than the deadline in your BAA and the HIPAA Breach Notification Rule, with the information you need to notify affected individuals, the Secretary of Health and Human Services, and, where required, the media. You control the timing and method of notifying your patients. We cooperate fully, document what happened, and keep the records.

8 · When We Part Ways

When your agreement with Lyfework ends, you keep what we built for you. Your contacts, conversation history, and records can be exported from your account during the 30-day window described in our Terms of Service. After that, we return or destroy the PHI we hold for you, in the format and timeframe agreed in the BAA. Where return or destruction is not feasible, the BAA's protections continue for as long as we retain the information, and we limit any further use to the purposes that make return infeasible.

9 · How to Request a BAA

1. Email team@lyfework.io with your practice name, the services you are engaging us for, and the name and title of the person who will sign.
2. We send our Business Associate Agreement for electronic signature. If you need to use your own BAA, send it and we will review it.
3. Nothing that could contain PHI is connected, imported, or turned on until the BAA is signed by both parties.
4. During onboarding we walk through the channel settings in Section 5 with you and document the configuration you approve.

10 · Contact

Questions about HIPAA, our BAA, or how a specific feature handles patient information:

This page describes our practices and our agreements. It is not legal advice, and it does not replace your own HIPAA risk analysis or the advice of your counsel.