Honest, specific, and a little dry on purpose.
Chairwise sells marketing and front-desk AI to dental practices — a market where protected health information is one careless integration away. This page is the short, factual version of how we keep that from happening.
If you are evaluating us against a compliance checklist, the fastest path is to forward this page to your compliance lead and book a 15-minute call with the team.
What's in scope
One platform. Three deliberate boundaries.
Compliance posture is easier to defend when the surface is small. The platform is built around a deliberate, dental-only scope — and intentionally avoids the data classes that would force a heavier regulatory posture downstream.
Anonymized call analytics
Calls are transcribed and summarized at the conversation level — appointment intent, objections, and next steps — never at the patient-record level.
No PHI in, no PHI out
No protected health information is stored, transmitted, or processed by the platform. Patient identifiers never leave the practice management system.
Built only for dental
Every model, dataset, and integration is shaped for dental operations. Nothing here is a horizontal tool retrofitted for a clinic.
How we handle data
Four stages, four monitored boundaries.
The data path is short and the audit surface is short with it. Each stage below is the kind of line item a compliance reviewer will want to walk through with us.
Storage
Application data
Call summaries, lead events, and audit metadata are stored in a managed Postgres instance and encrypted at rest by the platform provider.
Inbound
Practice telemetry
Reviews, ad performance, and PMS booking signals arrive over TLS 1.2+ and are processed in memory only — never persisted raw to the analytics store.
AI
Model calls
LLM calls are routed through an audited proxy. Inputs are stripped of identifiers before they reach the model, and responses are pinned to a structured schema.
Logs
Operational logs
Request logs, queue events, and error traces are retained for 30 days and segregated from production data stores — no clinical fields land in logs.
Encryption
Standard TLS in transit, provider-managed at rest.
We rely on platform-managed encryption rather than a bring-your-own-key story, because the marginal lift on dental marketing workloads is small — and the assurance of a managed primitive is bigger.
BAA & compliance posture
Where we are today, and what is committed next.
We treat the BAA / SOC 2 posture as a public surface, not a sales asset. The current posture and the upcoming commitments are stated plainly, in one place, with the dates a procurement team can pin to a calendar.
Today
Current posture
- No-PHI architecture on every data path — call summaries, lead events, and PMS signals.
- Role-based access with single sign-on, hardware-key support, and quarterly access reviews on the production plane.
- Immutable audit logs for every privileged action, retained for one year and exportable on request.
What's coming
Roadmap commitments
- A stand-alone BAA template delivered to qualifying practices within the current quarter — already in place on enterprise contracts.
- SOC 2 Type II readiness on a public roadmap, with a booked audit window for the current cycle.
- Region pinning on the enterprise tier for practices that need a specific data-residency boundary.
Frequently asked
The questions a dental compliance lead usually opens with.
If something here does not match the answer your team needs, the fastest path is an email to the team — every FAQ below is answered faster in person.
Still have questions
Forward this page to your compliance lead.
The most useful next step is a 15-minute call with the team — we walk through the data path line by line and answer the specific questionnaire your team is filling out.
HIPAA-compliant data handling · no-PHI architecture · BAA available on the enterprise tier.