Privacy notice
Your information.
Handled with care.
Effective September 26, 2026. This notice describes the BLYX website, its contact process and requirements for client implementations.
About this notice
BLYX provides customized voice-receptionist setups for clinics. This notice covers this website, introductory conversations and related business correspondence. A separate written agreement will describe any services a client purchases.
Implementation privacy: HIPAA safeguards and BAAs
Protecting patient information must be part of the implementation from the beginning. The requirements below describe the review and safeguards BLYX requires before enabling a client workflow that handles protected health information (PHI). They are deployment requirements, not a claim that every proposed integration or our public demo has already completed that review. Client-specific obligations, approved services and responsibilities must be recorded in written agreements.
1. Define the data flow and assess risk
Before launch, we require a documented inventory of the information collected, its purpose, who can access it, and every system that receives or stores it. This includes telephony, voice and AI processing, hosting, databases, connected clinic software, logs, recordings and backups. The review must identify risks, mitigation steps, responsible parties and any unresolved issues. We limit collection and tool access to the approved workflow and the minimum information needed, where applicable.
2. Put the required agreements in place
Where BLYX acts as a business associate, a Business Associate Agreement (BAA) with the clinic must be signed before BLYX handles PHI. Each downstream business associate must also be covered by the appropriate agreement. We must verify that the exact vendor product, account, plan, feature and use case are eligible and covered; a vendor offering a BAA for one service does not cover all its products. A BAA is a contract that sets responsibilities, not a certification or a substitute for HIPAA safeguards. Services without the required coverage must not receive PHI.
3. Verify encryption and protect credentials
Our deployment standard requires encrypted application connections using current TLS and secure media transport where supported, encryption for stored PHI and backups, and documented key-management responsibilities. The implementation review must verify these controls on each connection and storage service, including configuration, certificate validation and credential protection. Secrets belong on protected servers or in managed secret stores, with restricted access and rotation procedures.
Encryption in transit and at rest is different from end-to-end encryption. Authorized voice, AI and clinic systems may need to decrypt information to perform their work. Ordinary telephone networks can also introduce transport limitations. We do not promise end-to-end encryption across every call or integration. Before launch, the clinic must receive a clear description of processing boundaries, who can access decrypted information, and any limitations requiring a different design.
4. Restrict access and test the workflow
Production requirements include individual staff accounts, least-privilege permissions, multifactor authentication for administrative access, separation between clients, and audit records for access and material changes. Scheduling actions must be limited to the permissions and rules the clinic approves. Access, tenant isolation, booking behavior, failure handling and recovery must be tested before launch. Staff training, access reviews, patching and reassessment after material changes form part of the operating plan.
5. Agree on recordings, retention and deletion
The clinic and BLYX must agree on whether recordings or transcripts are needed, applicable notice or consent, retention periods, deletion procedures and backup handling. PHI must be excluded from unnecessary analytics, support tools and diagnostic logs. AI-provider settings and contracts must be reviewed for data retention, secondary use and model training; we do not assume that an API setting alone removes every provider-held copy. Data return or disposal at the end of service must be addressed in the applicable agreements.
6. Plan for incidents and ongoing oversight
Before patient-data processing begins, the implementation must have named security contacts, monitoring and incident-response procedures, backup and recovery arrangements, and a process for reporting suspected incidents promptly. Investigation, mitigation, documentation and any breach notifications must follow the applicable BAA and law. Unresolved material safeguards or missing required agreements must be addressed before enabling PHI processing. Providers can request the implementation data-flow summary, vendor list, agreement status and documented safeguards during onboarding.
The public demo is not approved for patient information. Use an alias and demonstration details only. Its medical icon is an original illustration of a winged medical staff; it is not a government seal, certification or proof of compliance.
These requirements are informed by HHS guidance on the HIPAA Security Rule, business associates and cloud services. A client implementation needs its own documented review; this notice is not an audit or certification.
Information you share
If you contact BLYX, we receive your contact details, business information and the message you send. Please leave out passwords, payment-card details, sensitive personal information and patient information or confidential clinic records.
Scheduling a conversation
Our scheduling link opens Calendly, a separate website. When you book, BLYX receives your name, email address, selected time and the answers you provide. Calendly marks required fields on the booking form. We use these details to arrange the meeting, prepare for it and follow up about your request.
Booking details and answers may appear in confirmation messages and calendar events and may sync to Attio through our connected Outlook account. Calendly also processes website and technical information under its own Privacy Notice. Its booking page provides its cookie choices.
Video meetings
Introductory video meetings use Zoom. Calendly shares the scheduling details needed to create the meeting, and Zoom processes participant and connection information to provide the call under its own Privacy Statement. Booking a meeting does not give permission to record it. We will discuss any proposed recording before it begins.
Receptionist voice samples
The Try It Out section plays prerecorded, AI-generated samples hosted with this website. Listening does not turn on your microphone, place a phone call or send your voice to an AI provider. The section currently does not collect phone numbers. Our fictional clinic demo is not a patient-care service; do not submit patient information through this website or a demo.
Interactive clinic demo
See It In Action lets you speak with an AI receptionist and create demonstration appointments. Starting a call activates your microphone and sends audio to OpenAI. We request no stored recordings and do not save call recordings or captions in our application; OpenAI may process service data under its own retention policies. An optional name or alias, appointment details and booking activity are stored in our dedicated Supabase database. Please use an alias and do not share patient or medical information.
A necessary seven-day browser cookie separates your demo records from other visitors. Closing or clearing the cookie does not delete database records. These records remain until removed by BLYX; you can request removal at the address below. Daily hashed network identifiers and request counters help limit misuse. The demo does not book real clinic visits or send its appointments to Attio or n8n.
How we use information
We use contact and meeting information to respond, understand your business goals, prepare for conversations, track follow-up, maintain business records and protect the service. Contacting us or booking a conversation does not purchase services or subscribe you to unrelated marketing.
Services that help us operate
OpenAI Sites and its Cloudflare-backed hosting provide this website. Hosting, access controls and security services may process IP addresses, browser details, request logs and security-check results. BLYX has not added advertising pixels or marketing analytics to this website.
Microsoft email, provided through GoDaddy, supports correspondence and the Outlook calendar. An existing forwarding connection to GoDaddy Conversations may create another copy of incoming messages. Outlook email and calendar information can sync to Attio for relationship management. n8n supports the separate private test-record handoff and manual inquiry review. Authorized BLYX operators and the providers supporting these functions can process relevant information. Providers may process information outside your state or country.
This website does not automatically send inquiry or booking messages to an AI model for analysis.
Browser signals
The interactive clinic demo uses a necessary, signed browser cookie to keep your calendar separate from other visitors. It lasts for seven days. A different browser or clearing cookies starts a new calendar; people sharing the same browser profile share its demo calendar. Demo records remain in our database until removed; cookie expiry does not delete them.
Hosting, sign-in and security services may use necessary cookies, browser storage or technical signals. This website does not change its behavior in response to the older Do Not Track signal. Calendly is a separate website with its own privacy and cookie controls.
Keeping and removing information
Our procedure is to review saved website inquiries monthly once their last meaningful interaction was at least 90 days ago. We assess whether they are still needed for an active matter, business records or legal obligations. This is a manual review, not automatic deletion after 90 days.
Removing saved inquiry contact fields can leave a minimal receipt record to prevent retries from restoring the information. Booking records, correspondence, CRM copies, provider logs and backups require separate review and may follow different retention schedules.
Questions and privacy requests
For questions or requests to access, correct or remove your information, email hello@blyxsacramento.net with the subject “Privacy request.” We may need enough information to verify that the request concerns you. We will explain the action taken and any applicable reason information must be retained. Do not send identification documents unless we agree on an appropriate method first.
Changes to this notice
Updates will appear here with a new date. Material changes will also be noted on the website, with additional notice or consent where required. Changes to this notice do not by themselves change an existing service agreement.
Return to BLYX