CampfireIs it HIPAA compliant, and who owns the data?
The marketing system never needs patient health information, so none goes into an AI model. The AI roles work from your FAQ, your calendar and your marketing data, not your records, and anything that could be PHI is stripped in a separate step before a model sees it. Your data stays in accounts you own. Clinical records stay in your EMR.
What the system touches
Names, phone numbers, emails, appointment times, and what someone asked about. That's marketing and scheduling data. Diagnoses, notes, and anything from the chart stay in your EMR, which is where HIPAA lives for your practice.
How we keep PHI out of models
Any message that could contain health details passes through a separate workflow that strips it before an AI role reads it. The roles answer from your approved FAQ and your calendar. They do not read charts, and they do not need to.
Who owns what you put in
You do. The CRM and the automations are in your accounts. Model providers' data policies change, which is one more reason the roles are designed not to need patient data in the first place.
Personal-brand and coaching builds
Same rule, simpler: clinic data stays out of the personal-brand system entirely.
If your compliance officer or attorney has specific questions, bring them to the call. It's a better conversation with the actual setup on screen.
Questions around the fire
Do you sign a business associate agreement?
Ask on the call. Because the marketing system is built not to handle PHI, most practices don't need one for it, but your situation decides, not ours.
Does the AI learn from my patients' messages?
No. The roles don't train on your data, and PHI is removed before any model sees a message.
Where does the data live?
In your CRM account and your ad accounts, under your logins. Not on our servers.