BAA/HIPAA compliance

Hi Sarah,

Thanks for circling back on this — it's a fair question, and one we hear from clinicians occasionally.

Calendly is built as a secure platform (encryption in transit and at rest, infrastructure hosted in AWS's audited data centers, and ongoing internal security practices), but as it stands today it isn't intended for collecting Protected Health Information, and we don't currently offer a BAA. If you do use Calendly in a clinical context, the safest approach is to keep any personal or medical details out of your invitee intake questions, and to check with your own legal/compliance team on what your practice requires.

On the bigger question — whether we'll adopt a BAA so practices can use Calendly with patients — I want to be transparent: we don't have a firm roadmap commitment or a date to share right now. That said, this is a need we genuinely recognize, and its importance has grown as our product has expanded into new areas. It's an active part of the conversation internally, though we can't promise anything on timing yet.

I'll be sure your feedback here is added to that discussion. In the meantime, our Privacy Policy has more detail. Thanks for taking the time to post!

Best,
Allie