Security & Development Practices

1. Overview

ABAIQ is an AI-powered documentation assistant for Applied Behavior Analysis (ABA) professionals. It helps clinicians generate session note drafts faster by working alongside any web-based practice management system through a Chrome browser extension.

ABAIQ is not an electronic health record (EHR), a medical record system, or a clinical decision-making tool. It is a documentation productivity tool designed with healthcare data security as a foundational requirement, not an afterthought.

This document describes the security architecture, safeguards, and development practices that ABAIQ follows to protect your clinical data and maintain compliance with the HIPAA Security Rule.

2. Data Architecture & Flow

Understanding how your data moves through ABAIQ is critical to evaluating our security posture. Here is the complete data flow:

1. The Chrome extension reads clinical session data that is already visible on your screen within your practice management system. It does not access any backend systems, APIs, or databases of the platform you are using.
2. Your session inputs are sent over an encrypted (TLS 1.2+) connection to the ABAIQ backend API, which requires a valid authentication token for every request.
3. The ABAIQ backend — hosted on Amazon Web Services (AWS) HIPAA-eligible infrastructure under a Business Associate Addendum — forwards the session data to our AI providers, with whom we maintain Business Associate Agreements (BAAs). The AI providers process the data in real-time via streaming.
4. The generated clinical note draft is streamed back to your browser for review. You control whether to accept, edit, or discard the note.
5. Once you close the extension sidebar or export your note, no copy of the generated note remains on ABAIQ servers. For the base note-writing feature, we do not store the content of clinical notes. The optional QA Suite is an exception: if you enable it and send a note for supervisory review, that note is transmitted and retained on BAA-covered AWS infrastructure, encrypted, as described in Section 6 and the QA Suite Terms of Use.

3. Administrative Safeguards

Administrative safeguards establish the policies, procedures, and organizational measures to manage security:

• Access management: Only authenticated users with valid accounts can access the ABAIQ extension and API. Each user must register with a verified email address and phone number.
• Authentication: Users authenticate via email and password. Multi-factor authentication (MFA) via SMS is available, and is required at web login for accounts created on or after March 25, 2026, to add an additional layer of account protection.
• Business Associate Agreements: We maintain BAAs with our AI and infrastructure providers governing the handling, processing, and non-retention of clinical data, and we provide a BAA under which ABAIQ acts as your business associate (see Section 7).
• Breach notification: In the event of a confirmed data breach affecting personal or clinical information, we will notify affected users within 72 hours and notify applicable regulatory authorities as required by law.
• Personnel access: Access to production systems and infrastructure is restricted to authorized personnel on a need-to-know basis.
• Security reviews: We conduct regular security assessments of our codebase, infrastructure, and vendor relationships.

4. Technical Safeguards

Technical safeguards are the technology-based controls that protect data and control access:

5. Physical Safeguards

ABAIQ does not operate its own data centers or physical servers. All infrastructure is hosted by third-party cloud providers that maintain robust physical security controls:

• Our core infrastructure and database providers — including Amazon Web Services and our database provider — are SOC 2 certified, meaning they have been independently audited for security, availability, and confidentiality controls.
• Data centers used by our providers include physical access controls, surveillance, environmental protections, and redundancy measures.
• ABAIQ personnel do not have physical access to any servers or data center facilities. All infrastructure management is performed remotely through authenticated and encrypted channels.

6. Data Minimization

We follow the principle of collecting and processing only the minimum amount of data necessary to deliver the service:

• Screen reading only: The extension reads only data that is already visible to you on your screen. It does not access hidden fields, internal APIs, databases, or backend systems of any third-party platform.
• Targeted data processing: Only the clinical session data necessary to generate a note draft is sent to our AI providers. No additional patient records, history, or unrelated data is transmitted.
• No note storage (base note-writing feature): Clinical notes generated by the base feature are never stored on ABAIQ servers or in our database. Notes exist only in your browser memory during the active session. Exception — optional QA Suite: if you enable the ABAIQ QA Suite and send a note for supervisory review, that note and its AI evaluation are transmitted, stored, and retained — encrypted in transit and at rest — on the BAA-covered AWS infrastructure, as described in the ABAIQ QA Suite Terms of Use and the BAA. Only client initials are transmitted, never full names, and both parties sign a data-sharing consent first.
• Metadata only: We retain only usage metadata (number of notes generated, timestamps) for billing and analytics. For the base note-writing feature, note content is never recorded. The optional QA Suite retains notes you send for supervisory review; see Section 6.
• Voice input (optional): If you use voice dictation, your speech is captured through your browser microphone, only with your explicit permission, and transcribed through a BAA-covered provider. It is never sent to an unsecured browser speech service, and the microphone is used only while you are actively dictating.
• No secondary use: Your clinical data is never used for advertising, marketing, analytics, AI model training, or any purpose other than generating your requested note.

7. Business Associate Agreements

Business Associate Agreements are a cornerstone of HIPAA compliance when third parties handle protected health information:

• AI provider BAAs: We maintain signed BAAs with our AI providers that govern how clinical session data is processed. Under these agreements, our AI providers process data in real-time under a Zero Data Retention configuration, do not retain session data, and do not use it for model training or improvement.
• Cloud infrastructure BAA: Our backend is hosted on Amazon Web Services (AWS) HIPAA-eligible infrastructure under a Business Associate Addendum with AWS.
• BAA for your organization: ABAIQ (Hybreu Digital LLC) makes a Business Associate Agreement available under which we act as your business associate. It is available to review and accept at abaiq.ai/baa.html (and from your account dashboard). Only users who accept the BAA are covered by it; if you process Protected Health Information through the Service, accepting it is your responsibility. Questions? Contact support@abaiq.ai.

8. Third-Party Vendors

ABAIQ uses a limited number of third-party services to operate. We evaluate each vendor for security practices and compliance posture:

Service Category	Purpose	Data Handled
Cloud Infrastructure (Amazon Web Services)	Backend hosting on HIPAA-eligible infrastructure	Base note-writing: session data in transit, not stored. QA Suite: note content stored encrypted. All under a BAA.
Authentication & Database	User registration, login, account storage	Account, usage, and billing data only (no patient PHI; BAA not required)
AI Providers	Real-time clinical note generation	Session inputs (processed under Zero Data Retention, not retained)
Payment Processor	Subscription billing	Billing details (we never see full card numbers; no PHI)
SMS Provider	Multi-factor authentication delivery	Phone number (for OTP codes only; no PHI)

Each provider maintains their own security certifications and compliance standards. Our AI providers and AWS operate under Business Associate Agreements with ABAIQ.

9. Extension Permissions & Behavior

Transparency about what the ABAIQ Chrome extension can and cannot do:

• What it reads: Visible on-screen data within your practice management system, including session fields such as client initials, dates, behavior descriptions, and service codes.
• What it writes: Write-back is available only on platforms where it is supported, and only at your explicit direction. On platforms where write-back is not enabled, the extension operates in read-only mode: it reads only the data already visible on your screen to generate your draft in the ABAIQ side panel, and does not write to, autofill, modify, or inject any content into the page. In read-only mode you copy the reviewed draft into your system yourself.
• What it does NOT do: The extension does not access other browser tabs, intercept network traffic, access internal APIs or databases of any third-party platform, read data from other users, or communicate with any server other than the ABAIQ backend.
• Local storage: The extension stores per-client preferences (such as behavior functions and training objectives) locally on your device in Chrome's extension storage, encrypted using AES-GCM. This data is not synced to the cloud and is not accessible to other extensions or websites. You can clear it at any time.

10. Compliance Posture

ABAIQ implements administrative, technical, and physical safeguards consistent with the HIPAA Security Rule (45 CFR Part 164, Subparts A and C). Key aspects of our compliance posture:

• We design our architecture around the principle that clinical note content should never be stored on our servers.
• We maintain BAAs with downstream vendors that process clinical data.
• We implement access controls, encryption, and audit logging across all system components.
• We are available for security assessments and can provide documentation to support your organization's vendor evaluation process.

Important: ABAIQ is a documentation assistance tool. It does not replace or reduce the compliance obligations of covered entities or business associates under HIPAA. You are responsible for ensuring your overall use of ABAIQ complies with HIPAA and applicable state regulations. All generated notes must be reviewed, verified, and approved by a qualified professional before clinical use.

11. HIPAA Compliance — Frequently Asked Questions

Is ABAIQ HIPAA compliant? Yes. ABAIQ is operated by Hybreu Digital LLC as a HIPAA Business Associate and is engineered to comply with the HIPAA Privacy Rule, Security Rule, and Breach Notification Rule. ABAIQ maintains signed Business Associate Agreements with every subprocessor that processes Protected Health Information (PHI), offers a BAA to its own customers at abaiq.ai/baa.html, runs all AI processing under Zero Data Retention, and encrypts data in transit and at rest. The base note-writing feature does not store the content of generated clinical notes; the optional QA Suite, when enabled, retains notes sent for supervisory review on BAA-covered AWS infrastructure, encrypted, with only client initials transmitted and a signed data-sharing consent required first, as described in the QA Suite Terms of Use.

What laws does ABAIQ operate under? ABAIQ complies with HIPAA and its implementing regulations, including:

• HIPAA Privacy Rule — 45 CFR Part 160 and Part 164, Subparts A and E.
• HIPAA Security Rule — 45 CFR Part 164, Subpart C (§§ 164.302–164.318).
• HIPAA Breach Notification Rule — 45 CFR §§ 164.400–164.414.
• Business Associate provisions — 45 CFR § 164.502(e), § 164.308(b), and § 164.314(a).
• HITECH Act (2009) and the HIPAA Omnibus Final Rule (2013), which extend direct HIPAA liability to Business Associates and their subcontractors.

Who are the parties under HIPAA? The clinician or ABA agency that uses ABAIQ is a Covered Entity (or a Business Associate of one). ABAIQ is a Business Associate of that clinician or agency, governed by the customer BAA at abaiq.ai/baa.html. ABAIQ's AI and cloud-infrastructure providers (Anthropic, OpenAI, AWS) are subcontractors of ABAIQ, each under its own signed BAA.

Does ABAIQ need a BAA with my EMR or practice-management platform (such as ABA Matrix, CentralReach, Rethink, Motivity, or Catalyst)? No — and HIPAA does not contemplate one.

• HIPAA requires a BAA only where one party creates, receives, maintains, or transmits PHI on behalf of another (45 CFR § 164.502(e) and § 164.308(b)).
• ABAIQ and your EMR are two independent vendors of the same Covered Entity. Your EMR is your Business Associate under its own separate BAA; ABAIQ is your Business Associate under ABAIQ's BAA. Neither vendor handles PHI on behalf of the other, and neither is a subcontractor of the other.
• HIPAA neither requires nor contemplates a BAA between two independent Business Associates that do not handle PHI on each other's behalf.
• The correct HIPAA chain is therefore: Covered Entity → ABAIQ → ABAIQ's subprocessors (Anthropic, OpenAI, AWS). Your EMR sits on a separate, parallel chain: Covered Entity → your EMR. The two chains do not need to connect.

12. Related Policies

For additional information about how we handle your data and the terms governing the Service, please review:

• Privacy Policy — Full details on data collection, storage, retention, and your rights
• Terms of Service — Usage terms, professional responsibility, and liability limitations
• Business Associate Agreement (BAA) — Our HIPAA business associate obligations to you, available to review and accept (you are covered once you accept it)
• About ABAIQ — Our story, values, and mission

13. Contact Us

For security questions, BAA requests, or to report a vulnerability, contact us:

Hybreu Digital LLC (DBA ABAIQ)
Email: support@abaiq.ai