If your med spa handles protected health information, and nearly every med spa does, any software vendor that stores or processes that information on your behalf is a business associate under HIPAA. That means you need a Business Associate Agreement, or BAA, in place with them. For many owners, getting one is a slow back-and-forth with a vendor's legal team, or an extra line item on the invoice.
GlowScript takes a simpler approach. Our BAA is published on our site and is part of every subscription. It is entered into between your practice, as the Covered Entity, and Distinctly Developed LLC, doing business as GlowScript, as the Business Associate. It supplements our Terms of Service and is effective as of the date your practice accepts the Terms or begins using the platform.
What the BAA covers
The agreement sets out GlowScript's obligations for PHI that your practice creates, receives, maintains or transmits through the platform, under HIPAA and its Privacy, Security and Breach Notification Rules (45 CFR Parts 160 and 164). You can read the full current text, including its last updated date, on our /baa page before you sign up.
Why a BAA matters for a med spa
Med spas sit in an unusual spot. You run a retail-feeling front desk with memberships, gift cards and product sales, and at the same time you keep medical histories, consent forms and treatment photos. All of that client information may count as PHI. A practice management system that stores your charts and photos needs a BAA in place, and so does any vendor it relies on.
The safeguards behind the agreement
A BAA is a promise; safeguards are how that promise is kept. GlowScript includes HIPAA-focused safeguards in every account:
- AES-256 encryption at rest and TLS 1.2 or higher in transit.
- Multi-factor authentication available for sign-in, and role-based access controls.
- Automatic session timeouts and invite-only staff onboarding.
- Logging of account activity such as changes to records, plus infrastructure logging and monitoring.
- PHI in GlowScript stored in AWS US regions, which GlowScript uses under a signed AWS Business Associate Addendum.
- Encrypted, automated backups with point-in-time recovery.
Glow AI, the assistant inside GlowScript, runs under role-based permissions, and nothing it drafts is sent without staff approval.
How it fits into setup
There is no separate contract to request and no waiting on a countersigned PDF before you can start. When you create your GlowScript account and accept the Terms of Service, the BAA applies from that point. That means you can import client records, build consent forms and upload treatment photos during your trial with the agreement already in effect. Keep a copy of the current /baa text with your own compliance records, and review it again whenever the last updated date changes.
No separate pricing for the BAA
GlowScript has one plan: $299 per location per month. The BAA is not a separate add-on or a premium tier. You can start a 30-day trial, card required, before your first charge.
Your part of the picture
A BAA covers your vendor relationship. Your practice still needs its own HIPAA policies, staff training and risk assessment. GlowScript is built to support that work with access controls, activity logs and organized records, not to replace it.