We are not HIPAA compliant

Vavio is a pre-patient lead-capture tool by design. Here's what that means for your practice — and what to tell your compliance officer if they ask for a BAA.

Pre-patient by design

Vavio is the part of your practice’s website that talks to a prospective patient beforethey’re a patient. Someone Googles “Invisalign cost” on a Sunday night, lands on your site, types into the chat, and shares their name and what they’re interested in. Your treatment coordinator gets a lead summary on Monday morning.

That’s the whole product surface. We don’t touch patient charts, treatment plans, imaging, billing, or anything else that lives in your PMS (Dentally, Software of Excellence, Carestream, and so on). We’re not a clinical tool, not a record-keeping tool, not a recall system. We are a faster front door.

What this means for your practice

In practical terms: Vavio sits in front of your existing stack and replies to enquiries when your reception team can’t. The relationship Vavio has with the visitor is the same one your website already has — a marketing surface that captures interest and routes it. We don’t need a Business Associate Agreement because we don’t handle Protected Health Information.

  • What we collect:name, contact details, the treatment they’re interested in, the qualification answers they volunteered (timeline, finance comfort, basic fit signals), and the chat transcript.
  • What we don’t collect: diagnoses, treatment history, imaging, prescriptions, insurance details, payment card data, or anything that would be in a clinical record.
  • Where the data lives:Vavio’s hosted lead summary plus whatever inbox or PMS you choose to forward leads into. Your PMS continues to be the system of record for everything that happens after the patient walks through the door.

The data flow, plainly

  1. A website visitor types into the Vavio chat (e.g. “Invisalign for adult relapse, what’s the rough cost?”).
  2. The chat answers from your fee guides, asks the qualification questions you’ve configured, and captures the visitor’s name + contact + interest.
  3. The practice owner (or treatment coordinator) gets a lead summary by email or into your existing inbox / PMS workflow.

Visitor → lead → owner. There is no “patient → record” path inside Vavio. The patient relationship begins after the consultation is booked, in your PMS — not here.

If your compliance officer requires a BAA

Then Vavio is not the right fit for your practice today, and that’s a fair call. A BAA only matters if the vendor handles PHI; we don’t, so we can’t sign one in good faith. If your policy treats every prospect-stage interaction as PHI by default, we’ll politely step out and recommend you stick with your existing intake path.

Most practices we’ve spoken with treat the website chat the way they treat the website contact form — pre-patient marketing surface, not a clinical channel. If that’s how your compliance officer reads it, send them this page.

When this might change

We don’t currently handle Protected Health Information and we have no roadmap that requires us to. If we ever build features that step into the post-patient surface — automated recall, in-chair workflows, anything that touches the chart — we’d update this page first and the answer would change. Today the answer is clear: no PHI, no BAA, pre-patient only.

TL;DR for the email thread

Vavio is a pre-patient lead-capture chat. A visitor types in, we capture name + contact + interest, the practice owner gets a lead summary. We don’t touch patient records, treatment data, or anything requiring a BAA. If your compliance posture treats this as PHI by default, we’re not the right fit.

Pre-patient by design — see it on a real practice page.

The cosmetic-dentistry walkthrough shows the full lead-capture flow with the same boundary.

14-day free trial • Cancel anytime • No credit card required