HIPAA AND PATIENT PRIVACY

OUR POSITION

Romea.AI provides AI patient communication and practice automation to plastic surgery, aesthetic and medspa practices. Almost all of these practices are cash-pay and are not covered entities under the Health Insurance Portability and Accountability Act (HIPAA). Romea.AI serves practices that are not covered entities.

Romea.AI is not a covered entity and is not directly subject to HIPAA. We recognize the role HIPAA plays for our clients and their patients, so we follow HIPAA principles as far as they reasonably apply to a non-covered entity, and we apply recognized privacy standards including US federal and state law (including California), the EU GDPR and the privacy laws of the other territories where we work.

We do not claim to be HIPAA compliant, and no vendor can be certified as such. What we can say is how we handle patient information, which is set out below and in the voluntary Business Associate Agreement we sign with every practice.

HOW WE HANDLE PATIENT INFORMATION

Your EMR holds the medical record

Clinical and medical records stay in your EMR. The Romea CRM holds contact, scheduling and communication data. We design every integration so that medical detail does not need to leave the EMR, and we advise every practice to keep it that way.

Minimum necessary

We mask or minimize personal information wherever reasonably practicable. AI and other third-party providers receive only the information needed for the specific step they perform, as determined at our judgment. Patient information is never used to train, fine-tune or improve any general purpose AI model, and it is never sold.

AI providers

Our standard service uses leading third-party AI models, and the providers we route to may change without notice as models improve. We cannot control what a third-party provider retains, logs or processes. That is exactly why medical detail stays in your EMR and why we minimize what reaches the AI layer.

A written agreement with every practice

Every practice signs a Business Associate Agreement with Romea.AI. For practices that are not covered entities it is a voluntary agreement that sets out in writing how we use, protect, minimize and return patient information, and it forms part of your services agreement.

ROMEA COVERED ENTITY PROGRAM

Practices that are covered entities under HIPAA are served only under the Romea Covered Entity Program (Romea CEP). Romea CEP is a separately negotiated agreement with a full Business Associate Agreement and a dedicated HIPAA package. It runs on dedicated self-hosted AI infrastructure: no patient information is sent to OpenAI, Anthropic, Google or any other third-party model provider. Scope, safeguards and pricing are agreed case by case. Contact us to discuss whether Romea CEP fits your practice.

WHAT WE ASK OF YOUR PRACTICE

Privacy is shared work. To protect your patients while using Romea.AI:

• Keep clinical notes, photos, results and medical history in your EMR, never in the CRM or in a text message
• Obtain express, separate consent for SMS, WhatsApp and social messaging, and keep marketing consent separate from appointment communication
• Give each staff member their own login, enable two-factor authentication and remove access when someone leaves
• Tell us in writing, without delay, if your practice becomes a covered entity or begins submitting electronic insurance claims
• Keep a copy of your signed services agreement and Business Associate Agreement with your practice records

PREVAILING LANGUAGE

The English language version of this statement, of our Terms and Conditions of Service and of every Romea.AI agreement is controlling in all respects and prevails over any translated version in case of inconsistency.