HIPAA & Business Associate Agreement
Effective Date: October 10, 2026
1. Overview
Calladhere is a compliance and call management platform operated by RingFuze Technologies LLC (“RingFuze,” “we,” or “us”), doing business as Calladhere. Many of our customers are Medicare and ACA insurance agencies that handle protected health information (“PHI”) as defined by the Health Insurance Portability and Accountability Act of 1996, as amended by the HITECH Act, and their implementing regulations (collectively, “HIPAA”).
This page summarizes how we support HIPAA compliance, how to execute a Business Associate Agreement (“BAA”) with us, and what each party is responsible for. It is a summary only. It is not the BAA itself, and it does not create, modify, or replace any obligation in the BAA. If you have executed a BAA with us, the signed BAA governs.
2. Our Role as a Business Associate
When a customer that is a HIPAA covered entity, or a business associate of a covered entity (for example, an agency acting on behalf of an insurance carrier), uses Calladhere to store, transcribe, analyze, or audit call recordings and related customer records containing PHI, RingFuze acts as that customer’s business associate (or as a subcontractor business associate, as applicable).
In that role, we create, receive, maintain, or transmit PHI only on the customer’s behalf and only to provide the Service. The customer remains the covered entity or upstream business associate and is responsible for its own HIPAA obligations, including its relationships with carriers, beneficiaries, and other parties.
For account, billing, and website data that is not PHI, RingFuze acts independently, as described in our Privacy Policy.
3. Who Needs a BAA
You should execute a BAA with us before uploading, syncing, or otherwise submitting PHI to Calladhere if your organization is a HIPAA covered entity or a business associate of one. For most Medicare and ACA agencies, this includes call recordings, transcripts, and customer records containing information such as names, dates of birth, contact details, Medicare Beneficiary Identifiers, enrollment and plan details, and policy information.
If your organization is a covered entity or business associate that requires a BAA, do not submit PHI to the Service until your BAA has been executed and countersigned. If you are unsure whether you need a BAA, consult your compliance or legal advisor, or contact us at compliance@calladhere.com.
4. How to Execute the BAA
In-app execution. An authorized representative of your organization can review and sign our standard BAA electronically inside the Calladhere app at Settings → API Keys & Agreements → Business Associate Agreement.
Signature record. When you sign, we record the signer’s name and title, along with signature metadata such as the date and time, IP address, and browser user agent, as evidence of execution.
Countersignature and effectiveness. After you sign, Calladhere reviews and countersigns the BAA. The BAA becomes effective on the date Calladhere countersigns it. You can view the status of your agreement in the same settings area.
Negotiated or enterprise BAAs. If your organization requires a negotiated BAA or uses its own BAA form, contact compliance@calladhere.com. For enterprise or custom agreements more broadly, contact sales@calladhere.com.
5. Summary of Key BAA Commitments
Our standard BAA includes commitments consistent with HIPAA’s requirements for business associate contracts. At a summary level, we agree to the following:
Permitted uses and disclosures. We use and disclose PHI only to provide the Service to you, as required by law, and as otherwise permitted by the BAA, including for our proper management and administration as HIPAA allows.
Safeguards. We maintain administrative, physical, and technical safeguards designed to protect the confidentiality, integrity, and availability of electronic PHI, and we comply with the applicable requirements of the HIPAA Security Rule. Our practices are described in our Security Overview.
Subcontractors. We require subcontractors that create, receive, maintain, or transmit PHI on our behalf to agree in writing to restrictions and conditions that are at least as protective as those that apply to us under the BAA.
Reporting. We report breaches of unsecured PHI, security incidents, and uses or disclosures not permitted by the BAA, as described in Section 6.
Individual rights. We make PHI available to you so you can respond to individuals’ requests for access and amendment, as required by HIPAA.
Accounting of disclosures. We document disclosures of PHI and provide information you need to respond to requests for an accounting of disclosures.
HHS access. We make our internal practices, books, and records relating to PHI available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining compliance with HIPAA.
Termination. At termination, we return or destroy PHI as described in Section 10.
6. Breach and Security Incident Notification
If we discover a breach of unsecured PHI, a security incident, or a use or disclosure of PHI not permitted by the BAA, we will notify the affected customer within the time frames specified in the BAA and required by HIPAA. Our notice will include the information reasonably available to us that the customer needs to meet its own notification obligations, such as a description of what happened and, to the extent known, the individuals affected.
We will cooperate with the customer in investigating the matter and take reasonable steps to mitigate harmful effects known to us. The customer, as covered entity or upstream business associate, is generally responsible for notifying affected individuals, regulators, and other parties, unless otherwise agreed in writing.
If you believe PHI in Calladhere has been compromised, contact security@calladhere.com immediately.
7. Public API and PHI
Calladhere offers a public API and MCP server that let customers access their data programmatically. API access to PHI, including call transcripts, is restricted to a dedicated PHI scope.
To enable the PHI scope on an API key, your organization must (a) accept our API Terms and (b) have a BAA in effect that has been countersigned by Calladhere. API keys without the PHI scope cannot retrieve PHI through the API. API requests are logged.
You are responsible for ensuring that any system, application, or AI tool you connect to the API is authorized to receive PHI under your own HIPAA obligations, including having any BAA you need with that third party.
8. Customer Responsibilities
HIPAA compliance is a shared responsibility. As a customer, you are responsible for the following:
Execute a BAA first. If you need a BAA, do not submit PHI until the BAA is countersigned and in effect.
Minimum necessary. Submit only the PHI reasonably necessary for your intended use of the Service, and configure integrations and data fields accordingly.
Consents and authorizations. Obtain any consents, authorizations, and notices required by law or contract, including call recording consents. See our Call Recording & Consent Notice.
User access management. Grant access only to workforce members who need it, assign appropriate roles and permissions, enable multi-factor authentication for your users, and promptly remove access for users who leave your organization or no longer need it.
Authorized tools only. Do not export, copy, or send PHI from Calladhere to tools, applications, or individuals that are not authorized to receive it, including AI tools or integrations that are not covered by an appropriate agreement with your organization.
Restrictions you have agreed to. Notify us of any restriction on the use or disclosure of PHI that you have agreed to and that may affect our handling of PHI, to the extent the BAA requires.
Retention settings. Configure recording retention in the app to align with your record-keeping obligations.
9. De-identified Data
We may create de-identified information from PHI only as permitted by the BAA and only in accordance with the de-identification standards of HIPAA (45 C.F.R. § 164.514). Information that has been de-identified in accordance with those standards is no longer PHI. We do not use PHI to train our own or third-party foundation models. For more about how AI is used in the Service, see our AI Transparency Statement.
10. Termination, Return, and Destruction
Upon termination of the BAA or your Calladhere account, we will return or destroy PHI as provided in the BAA. Before termination, you can export your data from the Service. After termination, upon your written request, we will delete or return Customer Data within 60 days, except for data held in backups (which roll off in the ordinary course) and records we are required to retain by law.
If return or destruction of any PHI is not feasible, we will extend the protections of the BAA to that PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible, for as long as we retain it.
11. Order of Precedence
With respect to PHI, the BAA controls over our Terms of Service, our Data Processing Addendum, and any other agreement or policy between you and RingFuze. If there is any conflict between the BAA and those documents regarding the use, disclosure, or protection of PHI, the BAA governs. In all other respects, the Terms of Service continue to apply.
This summary page is provided for convenience. It does not amend the BAA, and in the event of any inconsistency, the signed BAA controls.
12. Contact Us
For questions about HIPAA, to request a negotiated BAA, or for other compliance matters, contact compliance@calladhere.com.
To report a suspected security incident or breach involving PHI, contact security@calladhere.com.
RingFuze Technologies LLC (dba Calladhere)
3770 Shaw Ave, Suite 102-226
Clovis, CA 93619
USA