Trust & compliance
HIPAA compliance at Wavez
This page is maintained by Wavez Automation to answer common security and privacy questions about how the AI receptionist service handles dental patient information. It is not a certification and does not constitute legal advice.
Business Associate Agreement
Wavez signs a BAA with every dental practice before handling live patient calls. Request a copy at wavezautomation@gmail.com.
Shared-responsibility model
HIPAA compliance is shared between the covered entity (the dental practice) and its business associates (Wavez, plus any subprocessors Wavez uses). The practice controls what phone lines are pointed at Wavez, what data is entered into its PMS, and how it handles the patient record. Wavez is responsible for the technical and administrative safeguards that apply to the call handling and booking layer.
Technical safeguards in place today
- Encryption in transit for all voice, transcript, and API traffic.
- Encryption at rest for stored call audio and transcripts.
- Role-based access controls internal to Wavez, with access limited to what a role requires.
- Audit logs of PMS API activity performed on behalf of the practice.
Data handling commitments
- Minimum-necessary principle: Wavez only accesses the patient data required to book, reschedule, or log an appointment.
- No secondary use: patient call content is not used to train third-party foundation models.
- Subprocessor list available to any practice under BAA on request.
Specific hosting regions, retention windows, subprocessor names, and incident-response SLAs are provided in the BAA and technical addendum shared during procurement.
Common questions
Does Wavez sign a Business Associate Agreement (BAA)?
Yes. Wavez signs a BAA with every dental practice before handling live patient calls. Request a copy at wavezautomation@gmail.com.
Is Wavez itself a covered entity under HIPAA?
No. Wavez is a Business Associate of the dental practice, which is the covered entity. Our role and obligations are defined in the BAA.
Where is call data stored?
Call audio, transcripts, and appointment data are stored on encrypted, US-hosted cloud infrastructure. A current list of subprocessors is available on request.