Data handling and confidentiality
We work on marketing data only. We do not need, ask for, or accept protected health information (PHI) to do our job, and we help health and wellness brands keep it out of their email marketing system.
HIPAA
Signify Studio is not a HIPAA business associate and does not sign business associate agreements. Klaviyo, the platform we specialize in, does not sign a business associate agreement (BAA), so protected health information should never be stored in the email marketing system. That means two things for you:
- Your email marketing system should contain marketing data only: purchase history, engagement, consent and preferences. No diagnoses, treatment details, appointment content or other health records.
- If your organization is a covered entity, or your emails could reveal health conditions about an individual, talk to your compliance team or counsel first. We are happy to work within the rules they set, including designing segments and flows that avoid sensitive data.
What is safe and what to avoid in Klaviyo
Safe
- Segments based on general purchase history or site browsing behavior
- Broad educational content, product offers and brand announcements
- Basic contact info and standard ecommerce transaction data
Avoid
- Segmenting by diagnosis, symptom quiz answers or prescriptions
- Messaging that implies a recipient has a specific medical condition
- Syncing intake forms, health records or detailed health surveys into profiles
We audit your custom properties and integrations so health details do not leak into profiles.
Confidentiality
- A mutual NDA is available before we look at anything. We provide the template or sign yours.
- We treat your account data, results and revenue figures as confidential and do not name clients publicly without permission.
- When an engagement ends, we remove our access within 5 business days and, on request, delete any exports or documents we hold within 30 days.
Access
- We ask to be added as a user in your Klaviyo account through the platform's own invite, with the Manager role. We request Admin only when account-level work such as sending-domain setup requires it, and never Owner. We never ask for a shared password.
- You can see and remove our access at any time.
- Our free deliverability scan only reads public DNS records for your domain. It does not access your accounts or any customer data.
Questions
Email [email protected] or book a call.