Della
← Help · Trust + Privacy

Privacy + HIPAA — how we protect patient data

The short version: we treat patient data like the regulated material it is. PHI is stored encrypted, redacted at render boundaries, and never leaves the BAA chain. Every admin unredact action is audit-logged. This article spells out exactly how each layer works.

The vocabulary

Three roles map to three permissions:

  • Owner — you, the medspa business. Under HIPAA you're a covered entity. You see full PHI for your own patients because that's the permitted use of the data you collected.
  • Admin — Nate (and any future Della staff). Under HIPAA we're a business associate. We see PHI as [redacted: PHI] by default. When we need to investigate something specific, the unredact path is available — every admin unredact action writes an audit-log entry visible to you in the Trust Center.
  • Customer — the end patient. They never see this UI. They interact with the Operator on the phone or in SMS.

The Business Associate Agreement (BAA) chain

PHI in Della passes through specific vendors. We have signed BAAs with each one. If any vendor in the chain doesn't have a BAA, we don't use them for PHI flows.

The full chain:

  • Della ↔ You (the Owner) — primary BAA, signed at onboarding.
  • Della ↔ Anthropic — for Claude inference. BAA active.
  • Della ↔ Retell — for real-time voice agents. BAA active.
  • Della ↔ Deepgram — for speech-to-text. BAA active.
  • Della ↔ Telnyx — for PSTN voice + SMS. BAA active.
  • Della ↔ Cartesia or ElevenLabs — for text-to-speech. BAA active.
  • Della ↔ Boulevard (your PMS) — your contract with Boulevard, plus our Boulevard integration. BAA active.

If you ever ask "where exactly does this patient's data go," the answer is one of those seven entities, plus the encrypted-at-rest database where we keep it.

What we redact, where, and when

Redaction happens at render boundaries, not at storage. The raw text is stored encrypted; the API + UI apply the redaction policy for the role making the request.

Patterns we redact for non-Owner reads:

  • Phone numbers (US 10-digit + international).
  • Email addresses.
  • Social Security numbers.
  • Date-of-birth patterns.
  • First+last name pairs (conservative — we err toward redacting non-PHI rather than leaking PHI).

Patterns we deliberately do NOT redact when an Owner views their own data: those same fields, because you have the right to see them. The redaction policy is parameterized by role at every render call.

What we won't store

Some categories don't go into our system at all:

  • Voice recordings beyond their use in disclosure compliance. We keep transcripts (redacted) and disclosure utterances (verbatim). The raw audio is held by the voice vendor under their BAA for the period required by law, then deleted.
  • Chart notes from your PMS, except the explicit fields we pull through the integration (appointments, services rendered, contact info). Boulevard chart notes stay in Boulevard.
  • Photos, except where you've explicitly attached one to a ticket via the opt-in screenshot path in "Report an issue."

What you control

  • Kill switches — global, per-category (voice / communications / booking / financial / marketing / discovery), per-skill, per-channel, per-client. Trip any switch and the Operator stops within 1 second.
  • Autonomy mode per skill — supervised, autonomous, or hybrid. Hard guardrails (medical advice, refunds, complaints, medication dosing, PHI disclosure) are never autonomous regardless of mode.
  • Disclosure script — every voice call opens with the disclosure language you signed off on. The default includes state-specific consent language. Edits write a Receipt and require a 24h cooldown before going live.
  • Data export — you can export every receipt, every conversation, every appointment, every correction at any time. The export is in your name.
  • Data deletion — if you terminate, we delete your client data within 30 days, except where retention is legally required (e.g., specific HIPAA logs).

The audit log

Every admin action that touches PHI writes an audit-log entry. You can see all of them at workspace → Trust → Admin actions. Each entry includes:

  • Who: the admin who did the action.
  • When: timestamp.
  • What: the action (e.g., "unredact receipt X to investigate a support ticket").
  • Why: the reason given.
  • Receipt ID: the specific data accessed.

If an admin viewed your data without a corresponding open ticket or your prior consent, you'll see it in the audit log and it's grounds for terminating our agreement on the spot.

Breach response

If we believe PHI was exposed outside the BAA chain (a vendor compromise, a misconfigured export, anything), our breach protocol fires within 1 hour:

  • We notify you in writing within 24 hours of detection (HIPAA requires 60 days; we commit to 24 hours).
  • We send a forensic timeline of what was exposed.
  • We engage your designated counsel and ours.
  • We file the required regulatory notices (60-day window for HIPAA).

Full breach protocol is in your MSA as an exhibit.

Anything we missed?

If you have a privacy question this article didn't answer, hit "Report an issue" or email support@hellodella.com. We log every privacy question and write a follow-up article when we see the same one twice.