Children’s health information, handled with care.

Our commitment

Ayra Desk is built by InQuantic Technologies, Inc. (“InQuantic”, “we”, “us”) for therapy practices that are covered entities under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (“HIPAA”). When a clinic uses Ayra Desk, we handle protected health information (“PHI”) on the clinic’s behalf as its business associate.

Business associate agreement

We sign a business associate agreement (“BAA”) with each clinic before any PHI is sent to Ayra Desk. Until a BAA is signed, please don’t send us any patient information, including through our website or email.

Under the BAA, we:

• use and disclose PHI only to provide Ayra Desk to the clinic, as the BAA permits, or as required by law, and limit it to the minimum necessary;
• apply appropriate administrative, physical and technical safeguards to protect electronic PHI, as the HIPAA Security Rule requires of business associates;
• require subcontractors that create, receive, maintain or transmit PHI for us to agree in writing to the same restrictions;
• report security incidents and breaches of unsecured PHI to the clinic, as described in the BAA;
• help the clinic respond to patient requests for access, amendment and an accounting of disclosures, where the BAA requires it; and
• return or destroy PHI when our services end, where feasible, as described in the BAA.

Safeguards

Administrative

• A designated security lead responsible for our security program.
• Periodic risk analysis and risk management for systems that handle PHI.
• Written security and privacy policies, and training for team members before they get access to PHI.
• Least-privilege access: team members get access to PHI only when their role requires it, and that access is reviewed and removed when no longer needed.

Physical

• Ayra Desk runs on cloud infrastructure providers that sign BAAs with us and maintain physical security controls at their data centers.
• We don’t store PHI on paper or on removable media.

Technical

• Encryption. Records, documents and stored message logs are encrypted in transit using TLS and encrypted at rest. Standard text messages aren’t encrypted by mobile carriers, so texts carry minimal detail and documents move through a secure link.
• Access control. Each staff member has their own account. Clinic administrators assign roles that limit what each person can see and do.
• Audit logs. Agent actions, staff approvals and access to case records are logged.
• Backups. Data is backed up so it can be restored after an outage.

AI safeguards

• A person approves. Agents prepare work and wait. Nothing is sent to a payer or a referring office, and nothing is written to your practice system, until a staff member approves it. Some family messages run automatically once your clinic turns them on and approves the templates: weekly check-ins and answers to status questions from the number on file.
• Sources shown. Information read from a referral is shown beside the original page, and fields the AI isn’t sure about are flagged for review.
• No clinical decisions. Ayra Desk doesn’t diagnose, decide clinical priority, decide medical necessity or decide insurance coverage. Clinicians and payers make those decisions.
• AI disclosure. Each conversation and call starts by saying it’s an AI assistant for the clinic, and families can ask for a person at any time.
• AI providers. AI model providers that process PHI for us do so under a BAA with us.

When the AI is wrong

AI can misread a document or draft the wrong thing. Ayra Desk is designed so that a person catches it before it matters:

• What staff verify. Before approving a case, staff check flagged fields against the source page, especially phone numbers, the child’s name and date of birth, and the payer.
• What can’t go out unchecked. Requests to referring offices, authorization packets and new client records always need a staff click.
• If something goes wrong. If a message reaches the wrong person or contains the wrong information, tell us right away at security@meetayra.com. We investigate it with the clinic as a possible security incident under the BAA, and help the clinic decide whether breach notification is required.
• Responsibility. How responsibility and indemnities are shared is set out in each clinic’s customer agreement and BAA.

Messages to families

• Texts go only to families who have agreed to receive them, as described in our Consent and Messaging Policy.
• Messages include only the information a family needs about the next step. Documents are exchanged through a secure link, not as text attachments.
• Replying STOP stops texts. Replying HUMAN reaches a person at the clinic.

Your data

• The clinic owns its patient data. We use it only to provide Ayra Desk to that clinic.
• We never sell PHI, and we never use it for advertising or marketing.
• When a clinic stops using Ayra Desk, we return or delete its PHI as described in the BAA and our customer agreement.

Subcontractors

We use a small number of vendors for hosting, fax, messaging and AI processing. Each vendor that handles PHI for us signs a BAA. Clinics can request our current subprocessor list at security@meetayra.com.

Incident response

We keep a written plan for detecting, investigating and responding to security incidents. If we discover a breach of unsecured PHI, we notify the affected clinic without unreasonable delay and no later than 60 days after discovery (45 CFR 164.410), or sooner if the BAA requires, so the clinic can meet its own notification duties.

Shared responsibilities

Security packet

Clinics evaluating Ayra Desk can request our security packet, which covers:

• our BAA template and current subprocessor list, including hosting, fax, messaging and AI model providers;
• how data moves through Ayra Desk, from fax to practice system;
• independent audit and penetration-test status;
• sign-in and authentication options;
• role permissions across multiple locations; and
• retention periods, including for children who never start services.

Report a vulnerability

If you believe you’ve found a security issue in Ayra Desk, please email security@meetayra.com with enough detail for us to reproduce it. Please don’t access or change data that isn’t yours, and don’t include patient information in your report. We’ll acknowledge your report and keep you updated.

For security questionnaires and the security packet, request a security review.