HIPAA
Our role
TurboVOB acts as a business associate under HIPAA and signs a Business Associate Agreement with every customer that processes protected health information through the platform.
Your practice is the covered entity. TurboVOB is a business associate, which means we handle protected health information on your behalf, under a contract that makes our obligations to you enforceable. You can read our BAA before you talk to us.
What we don't say
We don't describe ourselves as "HIPAA certified" or "HIPAA compliant" as a badge. There is no HIPAA certification body, so no vendor can hold one — a vendor claiming otherwise is telling you something about how carefully they write. Compliance is a set of ongoing obligations between your practice and us, and the BAA is where those become concrete.
Subprocessors
These are the vendors involved in running the service, and what each one touches.
| Vendor | Role | PHI |
|---|---|---|
| Microsoft Azure | Application hosting and managed Postgres database (United States). | Processes PHI |
| Cloudflare | DNS, TLS termination, and CDN in front of the application. | Processes PHI in transit |
| Stripe | Subscription billing and payment processing. | No PHI — billing contact and payment data only |
| Resend | Transactional and notification email. | No PHI — account and sales correspondence only |
| PostHog | Web analytics on public marketing pages only. Scoped out of every authenticated product route. | No PHI |
Related
Security lists what is technically in place, and what we're not claiming yet. Privacy covers data handling outside the PHI relationship.