Compliance Posture

Compliance is the floor.
Not the ceiling.

We're a managed service provider for medical aesthetic practices. That means HIPAA compliance, signed BAAs, and California 2026 regulatory alignment aren't features we charge extra for — they're the foundation of what we do. This page is for owners, operations leads, and attorneys who want to verify our posture before signing.

Our approach

Compliance posture, by design.

Claustro AI is built specifically for healthcare-adjacent practices. Every component of our infrastructure — voice processing, backend logic, telephony, communications — is selected and configured to support our clients' obligations as covered entities under HIPAA, and to align with California's January 2026 Medical Board updates.

For every client
  • ✓ Signed Business Associate Agreement
  • ✓ Sub-processor BAA chain documentation
  • ✓ HIPAA Security Rule technical safeguards
  • ✓ California 2026 regulatory alignment
  • ✓ Data return or destruction within 30 days of termination
  • ✓ Quarterly compliance posture review
For attorneys reviewing
  • ✓ Sample BAA available before signing
  • ✓ Sub-processor list provided on request
  • ✓ Architecture diagram available
  • ✓ Breach notification SOP documented
  • ✓ Technical safeguards documentation
  • ✓ Direct line to engineering for questions
Infrastructure stack

Every sub-processor under signed BAA.

A voice AI runs on a chain — voice engine, backend, telephony, communications. Each layer must be HIPAA-eligible and BAA-covered, or the chain breaks. Here's our full stack:

Voice layer

Retell AI

Voice infrastructure. Self-serve BAA via HIPAA-eligible tier. ISO 27001 certified, SOC 2 Type II compliant. Built-in safety guardrails and PII redaction.

Backend layer

Xano

Backend logic and data layer. HIPAA-eligible Pro plan with dedicated hardened infrastructure. HIPAA + BAA add-on activated. ISO 27001 certified.

Telephony

Twilio

HIPAA-eligible Programmable Voice, SMS, and SIP. Enterprise Edition with signed BAA. Industry-leading telephony reliability and compliance posture.

Documentation

Google Workspace

Internal documentation and communications. BAA-covered via Business Standard plan. Audit logging, 2FA enforcement, access controls.

A current sub-processor list — including any updates — is provided on request and incorporated into our client BAA.

Technical safeguards

The HIPAA Security Rule.
Implemented as architecture.

Encryption in transit

TLS 1.2+ for all data movement between systems. No exceptions.

Encryption at rest

AES-256 encryption for all stored data. Applied across every layer of the stack.

Access controls

Role-based access controls (RBAC) across all systems. Principle of least privilege enforced.

Two-factor authentication

2FA mandatory for all internal team members on every system handling PHI.

Audit logging

Every call, every action, every data access logged. Retention per HIPAA Security Rule requirements.

Data segregation

Multi-tenant architecture with strict client data segregation. No commingling of PHI across clients.

California 2026 alignment

Built for the regulations
in effect right now.

California's Medical Board updates that went into effect January 2026 explicitly tightened the rules around AI in medical practice settings. Most voice AI vendors haven't read these. We've built our agent architecture around them.

No clinical recommendations

The AI never recommends treatments to specific callers. Clinical questions route to consultation booking with a licensed provider.

No price improvisation

Pricing for medical procedures is never quoted by the AI. All pricing routes through provider consultation per California guidance.

Patient-specific orders respected

The AI does not generate or implement patient-specific orders. Orders remain the responsibility of supervising physicians.

Recording disclosures (CIPA)

California Invasion of Privacy Act-compliant recording disclosures on every call. Two-party consent properly handled.

Vendor evaluation

Five questions every California med spa
should ask any AI vendor.

Whether you choose us or someone else, these are the questions that separate compliance-conscious operators from everyone else. We'll answer all five honestly. Many vendors won't.

Question 1

Will you sign a BAA with our practice?

Can you send a sample BAA for our attorney to review? Under HIPAA, no BAA means no compliant data handling.

Question 2

Who are your sub-processors?

Voice platform, backend, telephony. Does each sub-processor have a BAA in place? Full chain, no gaps.

Question 3

Where is patient data stored?

Which cloud provider, which region, what's the retention policy, how is data deleted on contract termination?

Question 4

What's your breach notification process?

If a breach affects patients, how quickly are we notified? Industry standard is 24-72 hours. Anything longer is a yellow flag.

Question 5

How does the AI handle clinical questions?

Are clinical recommendations explicitly blocked? Is pricing locked to your data? Or can the AI improvise?

Our answers

In writing, on request.

Full compliance documentation — sub-processor list, BAA template, breach SOP, technical safeguards — for your attorney to review before you sign.

Administrative safeguards

Policies in place.

HIPAA isn't just technical safeguards. It requires administrative processes, documented policies, and ongoing operations. Here's what we maintain:

Risk analysis & management

Annual security risk assessment with documented mitigations.

Workforce training

HIPAA training for all team members handling PHI. Refreshed annually.

Breach notification SOP

Documented incident response and breach notification procedures. Tested.

Contingency planning

Data backup, disaster recovery, and continuity plans for client operations.

Have questions about our compliance posture?

Let's talk.
Or have your attorney reach out.

We're happy to walk through our infrastructure, send our BAA template, or set up a call with your legal counsel. Compliance done right is a conversation, not a checkbox.

Call us · (951) 418-2579