What we collect, and what we deliberately don't.
A straight answer, in plain language, before you have to ask for one. Included on every plan at every price — we don't sell compliance as a tier.
We are a business associate, and we act like it.
Caseloadflow handles information about prospective and current patients on behalf of your practice. That makes us your business associate under HIPAA, and we sign a Business Associate Agreement with every practice at signup — it's part of checkout, not something you have to request.
We run on HIPAA-eligible infrastructure with a BAA in place with our platform provider.
What the funnel collects.
Your quiz asks the questions needed to route someone to the right service, confirm they're in a state you serve, and understand how they intend to pay.
- Name and contact information
- Which service they're asking about
- Location or state
- Payer type, if they choose to share it
- Scheduling preferences and appointment times
- How they found your practice
Some of that is protected health information, and we treat all of it that way. It's stored in your own account, encrypted, and access-controlled.
What we deliberately don't collect.
We built the funnels to ask what's needed to route a person, and nothing more. There is no field anywhere in Caseloadflow for a diagnosis, a clinical note, or a treatment plan.
- No diagnoses or clinical assessments
- No session or treatment notes
- No treatment plans or care documentation
- No insurance claims or billing records
- No open-ended "describe your symptoms" fields
That's your EMR's job. We don't duplicate it and we don't want a copy of it. Less data held is less data at risk.
How it's protected.
Multi-factor authentication is required on every account, including ours.
Staff access is limited to what a role actually requires.
We maintain a written incident response procedure with defined notification timelines.
Anyone who could access practice data signs a BAA before they get access.
Messaging consent.
Every SMS-enabled contact opts in explicitly, and every message honors STOP. Campaigns are registered under 10DLC and quiet hours are enforced — nothing sends before 8am or after 8pm in the recipient's time zone.
Our automations are also written never to reference why someone is seeking care. A text from your practice says we received your request, not anything about a condition.
Questions your compliance officer will ask.
Send them to us directly. We'd rather answer a hard question before you sign up than after.