Contracting
We sign BAAs where applicable; coverage, permitted uses, and responsibilities remain program-specific.
Proof
Review company controls and workflow approval separately.
Current diligence materials cover Rely as a company. Each launch still requires approval for its data, communications, and clinical boundaries.
Review company controls and workflow approval separately.
Company controls and workflow-specific approval meet at two separate gates.
- 01Company posture
- 02Data map
- 03Workflow risk review
- 04Contract and controls
- 05Program approval
- 06Launch evidence
A badge, certification, or BAA does not approve a specific patient-facing workflow.
Review company controls and workflow approval separately. Company controls and workflow-specific approval meet at two separate gates. The diagram shows Company posture, Data map, Workflow risk review, Contract and controls, Program approval, Launch evidence. A badge, certification, or BAA does not approve a specific patient-facing workflow.
Company posture
Company posture
Ask for current, dated materials rather than trusting a logo.
Diligence materials
Current security, privacy, architecture, testing, subprocessor, retention, incident, and continuity materials are available during review.
Program clearance
Every workflow earns its own approval
Nothing here is inherited from a previous program.
Data
Minimum necessary fields, purpose, access, retention, integration, and reconciliation.
Communication
AI disclosure, recording, consent, cadence, channels, language, and stop rules.
Clinical and operational
Permitted actions, clinical boundary, acceptance, fallbacks, testing, owners, and monitoring.
Diligence
Five questions to settle early
Are you HIPAA compliant?
We sign BAAs where applicable and provide current control documentation. Compliance is assessed for the specific arrangement, not asserted with a badge.
What data do you actually need, and where does it go?
Each field needs a purpose, system of record, destination, access rule, retention rule, and reconciliation path.
Do you use our data to train models?
This is answered per program and per subprocessor, in writing. We do not give a blanket reassurance that hides program-specific terms.
Will patients know they are speaking with AI?
Yes. Disclosure, recording, and consent language are approved and version controlled for the program.
What happens when a caller has a clinical need?
Rely stops and routes it to the designated licensed owner. The accepting owner and fallback are named before launch.
Send us your security questionnaire.
Bring the workflow, population, and proposed data scope so the review can be specific.