HIPAA & Business Associate Agreements

Last updated: June 24, 2026

If you are a HIPAA-covered clinician evaluating Flowers, this page explains, in plain language, where Flowers sits in your compliance picture and why a Business Associate Agreement (BAA) is generally not required. Flowers is operated by Flowers App LLC ("Flowers," "we," "us").

The short version

• Flowers runs entirely on your own computer. Your sessions, transcripts, notes, conceptualizations, and client details never reach us.
• Because we never create, receive, maintain, or transmit your protected health information (PHI), Flowers App LLC is generally not a "business associate" under HIPAA.
• A BAA exists to govern a vendor's handling of your PHI. We handle none, so there is nothing for a BAA to govern.
• You remain the covered entity and the sole custodian of your records. Flowers is a tool that helps you meet your own obligations.

Why no BAA is required

Under HIPAA, a "business associate" is a person or company that creates, receives, maintains, or transmits PHI on behalf of a covered entity (45 CFR 160.103). The BAA requirement (45 CFR 164.502(e), 164.504(e)) flows from that relationship: if a vendor handles your PHI, it must contractually commit to safeguarding it.

Flowers is architected so that this relationship never forms. There are no Flowers servers that receive your clinical data. Transcription and note generation run locally on your Mac using on-device AI models. Your data is stored on your computer, encrypted at rest with AES-256-GCM, with the key held only in your macOS Keychain. We have no access to it, no ability to retrieve it, and no copy of it. A vendor with no access to PHI is not a business associate.

The one exception, and why it does not change this

Flowers offers an optional, off-by-default appointment-reminder feature. When you turn it on for a specific client, Flowers can send that client a brief, non-clinical reminder (such as a date and time). That message is sent through your own email account, configured by you. It does not pass through Flowers App LLC, and we never receive the client's address or the reminder. Routing a permitted, minimal reminder through your own systems is a disclosure you make as the covered entity, not one we make on your behalf, and it carries no clinical content.

What this means for your HIPAA obligations

You remain responsible for your own HIPAA compliance: securing your device, controlling access, obtaining any required client consents, and meeting the Security Rule for the PHI you maintain on your computer. Flowers is built to support those obligations — local-only storage, encryption at rest, an audit log, soft-delete with retention, and app-level locking — but using Flowers does not transfer any of your compliance duties to us, because we never hold your data.

If your organization requires a BAA anyway

Some clinics and health systems require a signed BAA from every software vendor as a matter of internal policy, regardless of whether the vendor handles PHI. We understand. If that applies to you, we are happy to provide and sign a BAA that accurately reflects our on-device architecture. Email [email protected] and we will send one for your review.

A note on scope

This page describes how Flowers is built; it is not legal advice and does not create an attorney–client relationship. Your specific obligations depend on your role, jurisdiction, and practice. For a definitive determination, consult your own counsel or compliance officer. For the technical detail behind the statements above, see our security overview, available on request.

Contact

Questions about HIPAA, BAAs, or how Flowers handles data can be sent to [email protected].