Trust & Security | NexorLink

Encryption in transit & at rest BAA for healthcare clients Recording disclosure on every call We never sell caller data

Healthcare and HIPAA

NexorLink is designed for HIPAA-covered clients. For medical, dental, and HMO practices:

A Business Associate Agreement (BAA) is included at no extra charge for healthcare clients. Pro, Enterprise, and HMO Premium plans include it by default; Starter and Growth healthcare clients receive it automatically when their use case requires it.
Protected health information is handled only by subprocessors operating under a signed BAA. Systems in our stack that do not offer a BAA never receive patient information, by policy and by architecture.
We do not sell, share, or mine patient data. Ever.

Plain language: we sign the paperwork that makes us your Business Associate, and we keep patient information inside the BAA-covered chain.

Call recording and consent

Florida is a two-party consent state and we operate accordingly everywhere. Calls are recorded with a disclosure at the start of the call, and recordings and transcripts are available to you as the client. If you prefer certain call types not be recorded, we configure that with you at onboarding.

Encryption and data handling

Call data is encrypted in transit (TLS) and at rest.
Access to client configurations is restricted to authorized NexorLink personnel.
Data retention follows your service agreement, and we delete client data on written request at offboarding.

Subprocessors

We build on established infrastructure providers. Healthcare traffic stays within the BAA-covered providers below.

Provider	Purpose	Healthcare data
Retell AI	Voice AI conversations	Yes, under BAA
Twilio	Telephony and SMS carrier	Yes, under BAA
Google Workspace	Email and business documents	Yes, under BAA
Stripe	Billing and payments	No patient data
Netlify	Website hosting	No patient data
Crisp	Website live chat	No patient data

Compliance posture

Our telephone numbers are registered under SHAKEN/STIR caller authentication, our outbound calling follows TCPA calling-hour rules, and our team completes HIPAA training for Business Associates. As we grow with enterprise clients, we add formal attestations to match their requirements.

Questions or security concerns

Write to richard@nexorlink.com and you will hear back from the founder directly.

Want the BAA and service terms for your practice?

Book a 15-min call