HIPAA at XreplyAI

Last Updated: November 5, 2026

Dental and physical therapy practices can use the Reviews Agent to ask their patients for reviews. That makes XreplyAI a business associate of each practice that does. This page covers the patient information we hold, where it lives, who can see it, and what we have not done yet. Everything here describes how the product works today.

For our security practices in general, see Security at XreplyAI.

1. Our agreement with your practice

We sign a business associate agreement (BAA) with each practice before it adds patient information. As of the date above, we have not signed one with a practice yet.

The U.S. Department of Health and Human Services, which enforces HIPAA, does not certify companies, and we do not claim a certification.

2. The patient information we hold

  • Your review request list: each patient's name and email address, whether you add them yourself or we read them from your completed visits.
  • Notes on your review page: what a patient chooses to write to you, with the name and contact details they choose to leave.

We hold no appointment details, treatment, diagnosis or insurance information, and we do not store patient photos.

3. Where it lives

  • Database: Railway, in the United States, under Railway's BAA. Names, email addresses and notes are encrypted in their own columns before they are written.
  • Email: review request emails and the email that brings you a patient's note are sent through Paubox, under Paubox's BAA. No other email provider carries them.

It does not reach any other service. Our logs and error reports filter it out, session recordings are blocked on the pages that show it, our nightly backup to Cloudflare leaves it out, and our API is not routed through a content delivery network. Our emails are fixed text, never written by AI, and patients' names, email addresses and notes are never sent to an AI model.

4. Who can see it

  • Only people in your workspace, with the roles you give them. Viewers can see but not change anything.
  • Every time someone in your workspace views, adds, stops or sends to your request list, or views your patients' notes, we record who, when and which records, by ID only. Those records are kept for at least six years and cannot be changed or deleted.
  • Anyone in a workspace that holds a request list is signed out after 30 minutes without activity.

5. What your patients see

  • Every review request email asks for an honest review, offers nothing in return, and has a link that stops them for good.
  • Each email says email is not a fully secure channel and asks patients not to reply with private information.
  • Replies we draft to your Google reviews never confirm that a reviewer is your patient.

6. What is not done yet

  • No BAA is signed with a practice yet.
  • Workspace users sign in without multi-factor authentication.
  • We have not yet completed a formal security risk assessment or written policies under the HIPAA Security Rule.

We will update this page as each one is done.

7. Contact

Questions about HIPAA, or a request for our BAA: john@xreplyai.com

Back to Home