Read this first
This page is not legal advice and not a certification. EAIBAP provides controls and evidence. Whether your use is compliant depends on your configuration, your processes, your contracts and the laws that apply to you. Please involve your own counsel and privacy or security officer.
Who is responsible for what
| GDPR | HIPAA | |
|---|---|---|
| When it applies | You process personal data of people in the EU, EEA or UK, or monitor or offer services to them | You are a covered entity or business associate and the platform handles protected health information |
| EAIBAP’s role | Processor for your customer data; controller for its own account, billing and security data | Business associate, with subcontractor arrangements for providers that handle PHI |
| Core contract | Data processing agreement | Business associate agreement |
| Common triggers | EU leads, callers and contacts | Health insurance and healthcare scheduling, claims intake with health information, recordings or transcripts containing health information |
GDPR: controls mapped to common duties
| Duty | How the platform helps |
|---|---|
| Lawful basis and consent (Art. 6, 7) | Consent records by channel, purpose, jurisdiction and evidence; withdrawal creates immediate suppression |
| Purpose limitation and minimization (Art. 5) | Purpose recorded per consent; minimized data sent to providers; no unnecessary sensitive data in the CRM |
| Accuracy | Provenance on imported, enriched and AI-derived fields; AI output distinguished from verified fact |
| Storage limitation | Retention policies by category and jurisdiction, covering recordings, transcripts, embeddings and caches |
| Data-subject rights (Art. 12–22) | Tooling to find, export, correct, restrict and erase across stores, with due-date tracking |
| Objection to direct marketing (Art. 21) | Opt-out and suppression applied across campaigns and channels |
| Automated decisions (Art. 22) | Human review for high-impact outputs; no autonomous underwriting, claims, credit or balance changes |
| Privacy by design and default (Art. 25) | Deny-by-default access; support access off by default; recording and transcription independently configurable |
| Processor duties (Art. 28) | Data processing agreement, subprocessor register and change notices; no training on your data |
| Records of processing (Art. 30) | Data inventory and processing records maintained |
| Security (Art. 32) | Encryption, access control, isolation testing, resilience and restore testing |
| Breach notification (Art. 33, 34) | Incident procedure; notice to you without undue delay so you can meet your own deadline |
| DPIA (Art. 35) | Impact assessment required before regulated or large-scale AI voice and profiling use cases |
| International transfers (Art. 44–49) | Regional options, documented subprocessors and transfer mechanisms |
HIPAA: a regulated deployment option
For tenants handling PHI, EAIBAP supports a stricter operating mode designed around the HIPAA Privacy, Security and Breach Notification Rules.
- Business associate agreement with you, and agreements with subcontractors that handle PHI. Providers without a signed agreement are technically blocked from receiving PHI.
- Minimum necessary: only the fields needed for a task go to providers; no PHI in logs, telemetry or test data.
- Recording and transcripts off by default, enabled only with a documented need.
- Identity verification before disclosing any PHI in calls or messages.
- Access controls and audit: unique user IDs, MFA, role-based access, append-only audit and review of staff access.
- No training on tenant PHI and no PHI in marketing outreach without the authorization HIPAA may require.
- Incident and breach procedures with notice to you according to the agreement.
- Contingency planning with tested restores.
Encryption is treated as mandatory in the platform even where HIPAA classifies it as addressable. Regulatory proposals evolve, so we track changes.
When requirements overlap
| Tension | Approach |
|---|---|
| GDPR erasure vs statutory retention or legal hold | Apply retention only where a documented obligation exists; restrict rather than delete when a hold applies |
| Append-only audit vs right to erasure | Audit records reference internal IDs, so erasing a person severs the link while preserving the audit fact |
| Opt-outs must persist vs erasure | Retain only a minimal hashed suppression entry with a documented basis |
| Different breach clocks | One incident workflow starts every applicable clock; the shortest contractual or legal deadline governs internal targets |
| Multiple profiles on one tenant | The strictest applicable control applies |
Other rules you may need to consider
Depending on your use case, other laws may apply, including UK GDPR and ePrivacy rules, US telemarketing and call-recording laws, collections regulations, state privacy laws, India’s Digital Personal Data Protection Act, and PCI DSS if card data were ever in scope (EAIBAP is designed not to store it). Assess each for your jurisdictions and channels.
Launch checklist for regulated customers
- Record the applicability decision (GDPR, HIPAA, other) with an owner.
- Sign the DPA and, where relevant, the BAA; confirm the provider list.
- Complete data inventory and processing records for your use cases.
- Complete a DPIA or risk assessment for AI voice, profiling and outreach.
- Configure and review consent, suppression and contact-window policies.
- Approve recording and transcription settings and disclosure prompts.
- Test retention, legal hold and data-subject request workflows including derived data.
- Test incident and breach notification with your contacts.
- Verify provider routing, especially for PHI.
- Obtain legal and compliance sign-off.