BAA before PHI
Subprocessors that touch PHI sign before a single message is routed.
Security
Cosmetic is still clinical. We treat it that way.
Medical intake, pregnancy status, medication history, and photos are not “just aesthetics.” Aria is deployed under a Business Associate Agreement. Compliance walkthrough is part of scoping — not a PDF we email after you are live.
Encryption
AES-256 at rest. TLS in transit. Least-privilege access on the operator dashboard.
No model training on your clients
We do not feed identifiable spa content into foundation-model training.
Observability without gossip
Transcripts live in your dashboard. Escalations are routed, not crowdsourced.
Honest AI disclosure
If a caller asks whether they are speaking to AI, Aria says so and continues.
Clinical hard stops
No diagnosis, no prescribing, no script-handling an unhappy result.
We’ll walk the BAA on the demo if you want it first.
Operators should weight ‘what happens when she cannot handle the call’ as heavily as the happy path.