Voibe Business Associate Addendum
Last updated: October 2026
This Business Associate Addendum ("BAA") forms part of the Voibe Terms of Service at https://www.getvoibe.com/terms (the "Agreement") between Essence AI Ltd, a company registered in England and Wales (Company No. 16349308) trading as Voibe ("Voibe"), and the customer that has accepted the Agreement ("Customer"). This BAA applies to the extent Customer is a Covered Entity or Business Associate under HIPAA and uses the Services to create, receive, maintain or transmit PHI. It takes effect automatically on acceptance of the Agreement and requires no signature.
1. Definitions
1.1 "HIPAA" means the Health Insurance Portability and Accountability Act of 1996, as amended by the HITECH Act, and the regulations at 45 C.F.R. Parts 160 and 164 (the "HIPAA Rules").
1.2 "PHI" means Protected Health Information, as defined at 45 C.F.R. § 160.103, that Voibe creates, receives, maintains or transmits on behalf of Customer through the Services. PHI excludes information de-identified in accordance with 45 C.F.R. § 164.514.
1.3 "Services" means the Voibe desktop application, Voibe Work, the Voibe Transcription API and any other service provided under the Agreement.
1.4 "Security Incident" has the meaning at 45 C.F.R. § 164.304, excluding Unsuccessful Security Incidents.
1.5 "Unsuccessful Security Incident" means pings, port scans, denial-of-service attempts, failed log-on attempts, malware blocked at the perimeter and similar activity that does not result in unauthorised access to, use or disclosure of PHI.
1.6 "Breach" has the meaning at 45 C.F.R. § 164.402.
1.7 Capitalised terms not defined here have the meaning given in the HIPAA Rules or, failing that, in the Agreement.
2. Permitted uses and disclosures
2.1 Voibe may use and disclose PHI only (a) to provide the Services to Customer, (b) as Required by Law, and (c) for Voibe's proper management and administration, provided that any disclosure under (c) is Required by Law or made with reasonable written assurances of confidentiality and breach notification from the recipient.
2.2 Voibe shall not use or disclose PHI in any manner that would violate Subpart E of 45 C.F.R. Part 164 if done by Customer, except as permitted under 2.1(c).
2.3 Voibe shall not use PHI, or any transcript, summary or other output derived from it, to train, fine-tune, evaluate or improve any machine-learning model, whether Voibe's own or a third party's.
2.4 Voibe shall not sell PHI, and shall not use or disclose PHI for marketing or fundraising.
2.5 Voibe shall request, use and disclose only the minimum PHI necessary to provide the Services.
3. Voibe obligations
3.1 Safeguards. Voibe shall implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of electronic PHI, in accordance with Subpart C of 45 C.F.R. Part 164. PHI is encrypted in transit using TLS 1.2 or higher. Audio is deleted on completion of transcription. Dictation text and meeting notes are not written to persistent storage controlled by Voibe. Where the Services do retain PHI (Transcription API transcripts, speaker labels, timestamps and summaries), it is encrypted at rest and deleted automatically 24 hours after the job completes, or sooner on Customer request.
3.2 Reporting. Voibe shall report to Customer in writing, at Customer's account email, (a) any use or disclosure of PHI not permitted by this BAA, (b) any Security Incident, and (c) any Breach of Unsecured PHI, in each case without unreasonable delay and no later than 10 business days after discovery. The report shall include, to the extent known, the nature of the event, the PHI involved, the individuals affected and the steps Voibe is taking in response, and Voibe shall supplement it as further information becomes available. This clause constitutes notice of Unsuccessful Security Incidents, for which no further report is required.
3.3 Mitigation. Voibe shall mitigate, to the extent practicable, any harmful effect known to Voibe of a use or disclosure of PHI in violation of this BAA.
3.4 Subcontractors. Voibe shall obtain and maintain a written agreement with each Subcontractor that creates, receives, maintains or transmits PHI on Voibe's behalf, under which the Subcontractor agrees to the same or substantially similar restrictions and conditions as those in this BAA.
3.5 Access, amendment and accounting. Voibe does not maintain a Designated Record Set. If Voibe receives a request from an individual under 45 C.F.R. §§ 164.524, 164.526 or 164.528, it shall forward the request to Customer within 10 business days. To the extent Voibe does maintain PHI in a Designated Record Set, Voibe shall make it available to Customer as needed to satisfy those sections.
3.6 Delegated obligations. To the extent Voibe carries out any of Customer's obligations under Subpart E of 45 C.F.R. Part 164, Voibe shall comply with the requirements of Subpart E that apply to Customer in performing those obligations.
3.7 Books and records. Voibe shall make its internal practices, books and records relating to the use and disclosure of PHI available to the Secretary of the U.S. Department of Health and Human Services for the purpose of determining Customer's compliance with the HIPAA Rules.
4. Customer obligations
4.1 Customer shall not request Voibe to use or disclose PHI in any manner that would not be permissible under the HIPAA Rules if done by Customer.
4.2 Customer shall notify Voibe of (a) any limitation in its Notice of Privacy Practices, (b) any change in or revocation of an individual's permission to use or disclose PHI, and (c) any restriction on the use or disclosure of PHI that Customer has agreed to under 45 C.F.R. § 164.522, in each case to the extent it affects Voibe's use or disclosure of PHI.
4.3 Customer is responsible for obtaining any consent, notice or authorisation required to record, transcribe or summarise a conversation, call or meeting that contains PHI, including under applicable recording-consent laws.
4.4 Customer is responsible for the security of PHI on its own devices, including transcripts, summaries and notes that the Services save locally on Customer's device, and for the configuration of Customer's own accounts and devices.
5. Term and termination
5.1 This BAA is effective from the first date on which Customer, as a Covered Entity or Business Associate, uses the Services to process PHI, and ends when the Agreement ends.
5.2 Either party may terminate this BAA and the Agreement if the other party materially breaches this BAA and fails to cure within 30 days of written notice. Where cure is not possible, termination is immediate on notice.
5.3 On termination, Voibe shall return or destroy all PHI it maintains in any form and retain no copies. If return or destruction is infeasible, Voibe shall extend the protections of this BAA to that PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible, for as long as Voibe maintains it.
6. General
6.1 Regulatory references. A reference to a section of the HIPAA Rules means the section as in effect or as amended.
6.2 Amendment. Voibe may update this BAA by posting a revised version at https://www.getvoibe.com/legal/baa with a new "Last updated" date, where required to comply with the HIPAA Rules. Material changes that reduce Customer's protections take effect 30 days after posting.
6.3 Interpretation. Any ambiguity in this BAA shall be resolved to permit compliance with the HIPAA Rules. In the event of a conflict between this BAA and the Agreement regarding PHI, this BAA prevails.
6.4 No third-party beneficiaries. Nothing in this BAA confers any right or remedy on any person other than Customer and Voibe.
6.5 Survival. Sections 3.2, 3.3, 3.7 and 5.3 survive termination.
6.6 Governing law. This BAA is governed by the law stated in the Agreement, except that the HIPAA Rules govern the meaning and application of HIPAA-specific terms and obligations.
6.7 Contact. HIPAA enquiries: hi@getvoibe.com, subject line "HIPAA".