--- title: "HIPAA compliant med spa software" description: "AEVA is HIPAA compliant and signs a Business Associate Agreement (BAA) with every customer at sign-up. See how AEVA treats patient data, AI training and access." url: https://aevadigital.com/security --- 1. [Home](/) 2. Security Security # HIPAA compliant med spa software AEVA is HIPAA compliant. AEVA signs a Business Associate Agreement (BAA) with every customer at sign-up. [Book a demo](/book-a-demo) ![The Practice OS forms and intake screen for a demo practice: a template library of consent and intake forms, a list of the practice forms with their status and response counts, and a panel for sending a digital intake form by patient app, portal, email or text.](/_astro/practice-os-forms-intake-2560x1440.Bt6roupI_Z1myOAD.webp) Practice OS, forms and intake. Demo data. - Growth Engine Marketing on the same data Every Growth Engine plan includes Practice OS. - Practice OS Where your patient data lives CRM, scheduling, charting and payments share the same data. HIPAA ## HIPAA compliant, in plain words HIPAA has no official certificate, so here's what we do and what we won't claim. ### What we do For every customer - AEVA is HIPAA compliant. - AEVA never uses patient data to train AI models. - Role-based permissions across your whole team. - Two-factor authentication options, on the public scheduler too. ### No official certificate What to ask for instead - That's why we say HIPAA compliant and show no badge. - The signed BAA is the document you can hold us to. - Ask any vendor that handles patient data for one too. The BAA ## A signed BAA from day one AEVA signs a Business Associate Agreement (BAA) with every customer at sign-up. [Book a demo](/book-a-demo) Your BAA Signed at sign-up - What a BAA is The contract HIPAA requires before a vendor handles your patients' data. - Signed when you start It's part of sign-up, with nothing extra to request. - Signed on every plan Every customer gets one, whatever the plan or the practice size. On every plan AI training ## No training on patient data ### Patient data AEVA never uses patient data to train AI models. - That holds for every customer, on every plan. - Charts, consent forms, messages and call recordings all count. - Nobody at your practice has to opt out. - Bring your AI questions to the demo. ### Your AI assistant Connect ChatGPT, Claude, Gemini or another AI assistant to your practice data through the AEVA MCP. - It signs in with your own AEVA login. - It sees only your practice, within that user's permissions. - Its only writes, booking and rescheduling, wait for your OK. - AEVA grants MCP access on request. Access and sign-in ## Permissions and two-step sign-in Roles set what each person can reach, and two-factor options guard sign-in. - ### Role-based permissions Role-based permissions across the team set what each person can see and change. Your front desk and your providers can have different access, set by role. - ### Two-factor authentication Two-factor authentication options add a second check after the password. Those options reach the public scheduler too, where patients book online. - ### A profile per person Every team member gets a profile with role-based permissions of their own. Separate toggles set who shows on the calendar and on the public scheduler. - ### Consent forms that lock Send consent forms, HIPAA consent included, through the patient app or portal. Both sides sign, then the form locks so the signed record can't be altered. ## Key facts Products Practice OS andGrowth Engine. Founded 2021 - ### Patient data AEVA never uses patient data to train AI models. - ### Security AEVA is HIPAA compliant.AEVA signs a Business Associate Agreement (BAA) with every customer at sign-up. - ### Team access Role-based permissions across the team, plus two-factor authentication options. - ### AI assistants AEVA grants MCP access on request, within each user's permissions. - ### Your expert Every practice works directly with an AEVA expert, whatever the plan. - ### Contact sales@aevadigital.com1-833-4-MYAEVA FAQ ## Security questions Short answers on HIPAA, the BAA, AI training and who can see patient records. Is AEVA's med spa software HIPAA compliant? Yes. AEVA is HIPAA compliant. AEVA signs a Business Associate Agreement (BAA) with every customer at sign-up. That goes for med spas and every other practice we work with. [See what Practice OS does](/platform) Do I have to ask for a BAA? No. AEVA signs a Business Associate Agreement (BAA) with every customer at sign-up. It comes with getting started on any plan, so there's nothing extra to request. Does patient data train AEVA's AI? No. AEVA never uses patient data to train AI models. That covers charts, consent forms, messages and call recordings, and you don't have to switch anything off. [How to remove your ad platform data](/legal/data-deletion) Who certifies HIPAA compliance? No government agency does, so no official certificate exists. Ask any vendor that holds patient data for its BAA, the contract you can hold it to. Who on my team can see patient records? Inside your practice, role-based permissions across the team set what each person can see. Two-factor authentication options add a second check at sign-in. Try - [Do you work with dental offices?](/contact?q=Do%20you%20work%20with%20dental%20offices%3F) - [How fast can we launch?](/contact?q=How%20fast%20can%20we%20launch%3F) - [How does Practice OS connect to my EMR?](/contact?q=How%20does%20Practice%20OS%20connect%20to%20my%20EMR%3F) ## Bring your security questions to a demo AEVA is HIPAA compliant. Book a demo to learn more about our BAA, AI training, team access, etc. [Book a demo](/book-a-demo) [sales@aevadigital.com](mailto:sales@aevadigital.com) [1-833-4-MYAEVA](tel:+18334692382)