Gloseva

HIPAA & Health Data Processing

Effective date: April 12, 2026

1. Purpose and Scope

This HIPAA & Health Data Processing notice (this "Notice") describes how Gloseva ("Gloseva," "we," "us," or "our") processes sensitive health information when you ("you," the "Customer," or the "Clinic") use the Gloseva AI receptionist and related services (the "Service") in connection with a medical spa, aesthetic clinic, or other healthcare-adjacent practice.

This Notice supplements, and is incorporated by reference into, our Terms of Service and Privacy Policy. In the event of a conflict between this Notice and the Terms of Service regarding the processing of health information, this Notice controls with respect to such processing. Capitalized terms not defined here have the meanings given in the Terms of Service.

The Service is offered to clinics worldwide. References to the Health Insurance Portability and Accountability Act of 1996, as amended, together with its implementing regulations including the Privacy Rule, the Security Rule, and the Breach Notification Rule (collectively, "HIPAA"), apply where the Customer is subject to HIPAA. Customers located outside the United States remain responsible for compliance with the data protection and health-information laws applicable to them, as described in Section 4.

2. Definitions

  • "Protected Health Information" or "PHI" — individually identifiable health information that is created, received, maintained, or transmitted in connection with the provision of healthcare, as defined under HIPAA. For Customers outside the United States, this Notice treats equivalent categories of sensitive health or special-category personal data in a comparable manner.
  • "Sensitive Health Data" — PHI together with any other health-related, medical, or treatment information processed through the Service, regardless of the Customer's jurisdiction.
  • "Covered Entity" — a healthcare provider, health plan, or healthcare clearinghouse subject to HIPAA. As between the parties, the Customer is the Covered Entity (or its equivalent under applicable law).
  • "Business Associate" — a person or entity that performs functions or activities on behalf of, or provides services to, a Covered Entity that involve the use or disclosure of PHI. Where applicable, Gloseva acts as a Business Associate of the Customer.
  • "Data Subject" or "Patient" — the individual to whom Sensitive Health Data relates (for example, a current, former, or prospective patient of the Clinic).

3. How Gloseva Processes Health Information

The Service operates an AI receptionist that interacts with patients on the Clinic's behalf. In the course of providing the Service, and only to the extent directed and configured by the Customer, Gloseva may process Sensitive Health Data through the following functions:

  • Calls and conversations — handling inbound and outbound voice calls, chat, and messaging on behalf of the Clinic, including capturing the information a caller chooses to disclose.
  • Bookings and scheduling — creating, modifying, and cancelling appointments, and synchronizing them with the Clinic's connected calendar or practice-management systems.
  • Reminders and notifications — sending appointment reminders, confirmations, and follow-up communications configured by the Clinic.
  • Transcripts and records — generating and storing transcripts, call recordings, summaries, and interaction logs to operate, secure, and support the Service.

Gloseva processes Sensitive Health Data solely to provide, maintain, secure, and support the Service in accordance with the Customer's instructions and the applicable agreement. Gloseva does not sell Sensitive Health Data and does not use it to train AI models without the Customer's explicit instruction or consent. Where the Service relies on third-party large language model providers or other subprocessors, such processing is limited to delivering the Service (see Section 7).

4. Customer Responsibilities

The Customer is the Covered Entity (or the controller or equivalent responsible party under applicable law) with respect to all Sensitive Health Data processed through the Service. The Customer acknowledges and agrees that it is solely responsible for its own legal and regulatory compliance, including without limitation:

  • Regulatory compliance. Determining whether and how HIPAA and any other applicable laws (including state, national, and local health-information, privacy, telecommunications, and consumer-protection laws, and frameworks such as the GDPR or comparable regimes) apply to the Customer's use of the Service, and complying with them.
  • Patient consents and notices. Obtaining and maintaining all consents, authorizations, and notices required to collect, use, disclose, record, transcribe, and transmit Sensitive Health Data, including any consent required before calls are recorded, messages are sent, or data is shared with the Service.
  • Lawful configuration and use. Configuring, instructing, and supervising the AI receptionist so that its conduct, scripts, disclosures, and outputs comply with applicable law and professional standards, and ensuring that the agent is not used to provide regulated medical advice without appropriate human oversight.
  • Accuracy and access controls. Maintaining the accuracy of the data it provides, restricting access to authorized personnel, and promptly disabling access when no longer required.
  • Data subject requests. Receiving and responding to patient requests for access, correction, deletion, or restriction, with Gloseva providing reasonable assistance as set out in the applicable agreement.

Gloseva provides the technical means by which the Customer processes Sensitive Health Data; it does not determine the purposes for which the Customer processes that data and is not responsible for the Customer's compliance decisions.

5. Business Associate Agreement (BAA)

Where the Customer is a Covered Entity subject to HIPAA and the Service involves the processing of PHI, HIPAA requires a Business Associate Agreement (a "BAA") between the Customer and Gloseva. Gloseva makes a BAA available upon request. The Customer is responsible for requesting and executing a BAA before transmitting PHI through the Service.

Until a BAA has been executed, the Customer should not submit PHI to the Service, and the Customer assumes all risk associated with any PHI submitted in the absence of an executed BAA. Where a BAA is in effect, its terms govern the parties' respective obligations regarding PHI and, to the extent of any conflict with this Notice concerning PHI, the BAA controls. To request a BAA, contact us at info@gloseva.com.

6. Data Security and Retention

Gloseva implements reasonable and appropriate administrative, physical, and technical safeguards designed to protect the confidentiality, integrity, and availability of Sensitive Health Data, including encryption in transit and at rest, access controls, logging, and ongoing security practices. No method of transmission or storage is completely secure, and Gloseva cannot guarantee absolute security.

Sensitive Health Data is retained for as long as necessary to provide the Service and as configured by the Customer, and thereafter only as required to comply with legal, regulatory, tax, accounting, or legitimate operational obligations. The Customer may request deletion of data through the dashboard or by contacting us, subject to applicable retention requirements. Additional detail on retention is set out in our Privacy Policy.

7. Subprocessors and International Transfers

Gloseva engages trusted third-party subprocessors to deliver the Service, including cloud infrastructure, telephony and messaging providers, and large language model providers. Subprocessors are engaged under written agreements that require appropriate confidentiality and data-protection obligations and limit their processing to the provision of the Service.

Because the Service is operated globally, Sensitive Health Data may be processed in, or transferred to, countries other than the country in which the Clinic or its patients are located, including the United States. Where required by applicable law, such transfers are carried out under appropriate safeguards (for example, standard contractual clauses or recognized adequacy mechanisms). Further detail on subprocessors and international transfers is available in our Privacy Policy, or upon request.

8. Breach Notification

In the event Gloseva becomes aware of a confirmed breach of unsecured Sensitive Health Data that it processes on the Customer's behalf, Gloseva will notify the affected Customer without undue delay and will provide the information reasonably available to assist the Customer in meeting its own notification obligations. Where a BAA is in effect, the breach-notification provisions of the BAA govern. The Customer remains responsible for determining whether notification to patients, regulators, or other authorities is required and for making any such notifications.

9. Disclaimer and Limitation of Liability

9.1 "As Is." To the maximum extent permitted by applicable law, the Service is provided "as is" and "as available," without warranties of any kind, whether express, implied, or statutory, including any implied warranties of merchantability, fitness for a particular purpose, or non-infringement. Gloseva does not warrant that the Service will satisfy the specific compliance requirements applicable to any individual Customer.

9.2 Customer Assumption of Compliance Responsibility. The Customer assumes full responsibility for its regulatory compliance and for its configuration and use of the Service, including the matters described in Section 4. The Customer agrees that Gloseva is not responsible for the Customer's failure to comply with HIPAA or any other law applicable to the Customer.

9.3 Limitation of Liability. The limitations and exclusions of liability, and the indemnification obligations, set out in the Terms of Service apply to this Notice and to all processing of Sensitive Health Data, except as otherwise expressly provided in an executed BAA.

9.4 Not Legal Advice. This Notice is provided for general informational purposes only and does not constitute legal, compliance, or professional advice, and no attorney-client or advisory relationship is created by it. Healthcare and data-protection requirements vary by jurisdiction and by the specific facts of each practice. Clinics should consult their own qualified legal counsel and compliance advisors to determine the requirements applicable to them before relying on the Service to process Sensitive Health Data.

10. Changes to This Notice

We may update this Notice from time to time to reflect changes in the Service, our practices, or applicable law. We will indicate the date of the most recent revision at the top of this page and, where the changes are material, provide additional notice in accordance with our Terms of Service. Your continued use of the Service after an update takes effect constitutes acceptance of the revised Notice.

11. Contact

For questions about this Notice, to request a Business Associate Agreement, or to exercise data-related requests, contact us:

    HIPAA & Health Data Processing — GLOSEVA