Trust & support / 02
Compliance & BAA
HIPAA, BAA, GDPR/DPA, and recording rules. Sales paperwork, not a Lite checkbox.
This is not legal advice
Avaga lists SOC 2 Type II, GDPR, HIPAA, and SSO / SAML on the trust band. A Business Associate Agreement and a DPA are paperwork conversations. Do not self-serve Lite and assume a BAA is attached.
HIPAA and BAA
If you handle protected health information, you likely need a BAA and a security review. That is Enterprise, quoted by sales. Keep PHI off the line until that review is done: hours, directions, and empty booking slots only.
After the BAA: pause/resume on cards and member IDs, a written disclosure, a short list of who can play recordings, and the same rules for any after-hours AI employee. Full policy: BAA / HIPAA.
GDPR and DPA
GDPR appears on the footer trust list. If you need a data processing agreement, talk to sales. Confirm where transcripts, summaries, CRM logs, and recordings land. AI notes are still records. Full policy: DPA / GDPR.
Before the first protected call
- Confirm whether you need a BAA. If yes, stop self-serve.
- Decide who can play recordings.
- Train pause and resume for cards and identity documents.
- Write the disclosure the caller hears. Match states and channels you actually use.
- Give overflow AI employees the same recording rules as humans.