Your patients trust you with their information. You trust Kaia with it. This page explains how Ad Vital protects it, what we have in place today and what we are still building.
Ad Vital, LLC is a Texas company at 1518 Aldrich St, Houston, TX 77055. We build Kaia, the AI platform for aesthetic and plastic surgery practices, med spas and cosmetic dental practices.
Our commitment
Patient data belongs to your practice. We handle it only to run Kaia for you, under the agreement we sign with you.
We don't sell personal information. We don't use your patients' information for our own advertising.
We tell you what is in place and what is still in progress. If something on this page is not finished yet, we say so.
HIPAA and BAAs
Ad Vital acts as a HIPAA business associate for the practices that use Kaia.
- We sign a Business Associate Agreement (BAA) with every practice before Kaia handles its patient data.
- We have signed BAAs with the subprocessors that handle patient data on our behalf.
- The BAA governs how we use, disclose and protect protected health information (PHI). If our Terms and the BAA conflict on PHI, the BAA controls.
HIPAA has no official certification. What matters is the BAA, the safeguards behind it and how a vendor responds when something goes wrong.
Infrastructure and subprocessors
Kaia runs on HIPAA-eligible cloud hosting and communications providers. Each one that handles patient data does so under a BAA with Ad Vital.
We use subprocessors in these categories, only as needed to deliver Kaia:
- Cloud infrastructure and hosting
- Communications carriers (calls and text messages)
- Payment processors (for Vital Pay)
Want the current list of subprocessors with access to your data? Email support@advital.app and we will send it. We give practices advance notice before we add a new subprocessor, and you can object on reasonable grounds.
Access control and workforce
Fewer people with access means less risk. Here is how we handle access inside Ad Vital.
- Access is role-based. Team members get the access their job needs.
- When someone leaves Ad Vital, their access is removed the same day.
- Every team member completes HIPAA and security awareness training.
- Every team member accepts our security policies.
- Satyam Arora is our Security, Privacy and Compliance Officer.
We review who has access to our systems at least once a year, and our policy calls for a review every quarter. We are finishing multi-factor authentication enrollment for every workforce account. Our policy requires full-disk encryption on every laptop and device our team uses.
Inside your practice, you decide who on your team can use Kaia. You are responsible for keeping your account credentials safe and telling us right away about any use you didn't authorize.
Kaia supports multi-factor authentication for practice users. Our agreement asks every practice to turn it on for all of its users.
Data protection
Recording starts only when your provider turns it on, and only with the patient's consent. Your practice is responsible for any notices and consents your state requires.
You keep ownership of your practice and patient data. You can ask for an export or deletion of your data, subject to your order terms and the law. Patients should send requests about their own health information to the treating practice.
- In transit. Data moving over public networks is encrypted with TLS 1.2 or higher.
- At rest. Data stored in our systems and databases is encrypted with industry-standard methods.
- Activity logs. We log system activity and access events, so we can monitor for problems and investigate if something goes wrong.
- Your data after you leave. You can ask for your data back for 30 days after your agreement ends. When a practice leaves or asks in writing, we return or destroy its patient data under the BAA, including copies in backups, and we document it.
Incident response and breach notification
If a breach affects your practice's data, Ad Vital will notify you within 5 business days of discovering it. That is our policy.
Our notice will tell you what we know at that point. We will keep you updated as we learn more and work with you on next steps your BAA calls for.
We follow a written incident response plan: detect, contain, investigate, fix and notify. Satyam Arora leads our response, with our CEO as backup. We test the plan with a tabletop exercise at least once a year. Our most recent exercise was in October 2026.
Insurance
Ad Vital carries cyber liability insurance.
Compliance roadmap
We are building our compliance program in the open. Here is where it stands.
In place today
- HIPAA business associate, with a signed BAA for every practice
- Signed BAAs with the subprocessors that handle patient data
- HIPAA-eligible hosting and communications providers
- Designated Security, Privacy and Compliance Officer (Satyam Arora)
- Role-based workforce access, removed the same day someone leaves
- HIPAA and security awareness training for every team member
- Written security policies every team member accepts
- Breach notice to practices within 5 business days of discovery
- Cyber liability insurance
In progress
- Ongoing HIPAA compliance monitoring
- Multi-factor authentication enrollment for every workforce account
- An independent penetration test and vulnerability scan
We have not completed a SOC 2 examination.
We will update this page as items move from in progress to in place. We will not claim a certification or audit we don't have.
Reporting a concern
If you think you've found a security issue, or you have a privacy concern about Kaia, tell us.
- Email: support@advital.app
- Security, Privacy and Compliance Officer: Satyam Arora, Satyam@advital.app
- Phone: (832) 835-5730
Tell us what you found, where you found it and how to reach you. Please don't include patient health information in your report. Our Security, Privacy and Compliance Officer reviews every security and privacy report.
Related: Privacy Policy · Terms & Conditions