Built for practices that handle patient data.
Apex Tools AI is designed around HIPAA obligations. A Business Associate Agreement is available, data is encrypted in transit and at rest, and practice data is never used to train outside models.
HIPAA and the BAA
Apex Tools AI acts as a Business Associate to each practice. A Business Associate Agreement is executed before any patient data is handled, and the terms of that BAA govern the data.
Encryption in place
Integration tokens and keys are encrypted with AES-256-GCM at the application layer before storage. Data in transit is forced over HTTPS with HSTS.
Where data lives
Account records, configuration, transcripts, and credentials reside in Cloudflare D1 databases hosted within North American cloud regions.
How the data is protected.
User passwords are hashed with PBKDF2-SHA256 using a minimum of 100,000 iterations and a separate per-user salt. Plain-text passwords are never stored.
Integration tokens and keys are encrypted via AES-256-GCM before being written to storage. Primary keys are held separately in isolated Cloudflare Secret managers.
All traffic is served over HTTPS and enforced with HTTP Strict Transport Security (HSTS), which prevents connections from silently downgrading.
Call recordings and transcripts run and improve each practice's own assistant. Practice data is not used to train third-party foundation models.
Kept only as long as needed.
The vendors behind the service.
A short list of infrastructure providers supports the service. Each is bound by its own data-protection commitments.
Edge hosting, encrypted cloud storage, and the D1 databases that hold account records, call logs, and tokens.
Real-time voice infrastructure that powers the bilingual phone receptionist.
Subscription billing. Card and bank details are handled by Stripe and are never stored by Apex Tools AI.
Florida is an all-party consent state for call recording. A practice using Apex Tools AI is responsible for providing the appropriate caller notice or consent, and Apex Tools AI helps configure a compliant greeting during onboarding. This page summarizes the controls in plain language; the Privacy Policy and each signed BAA are the controlling documents.
Need a BAA to move forward?
Share a few details about the practice and a Business Associate Agreement follows, along with answers to any security questions.
BAA available on request · 30-day money-back · Live in about five business days