Trust & Security

HIPAA and Health Information in LeadGPT

Last updated: September 30, 2026

Selling health coverage means hearing about people's health: their age, whether they use tobacco, the doctors and prescriptions they want covered. This page explains what of that ends up in LeadGPT, who processes it, and how it is protected, so you and your compliance team can decide what your agency stores.

What LeadGPT stores

  • Lead fields you or your lead sources fill in, such as age, spouse and children, tobacco use, current insurance company, and comments.
  • Notes, attachments, and text conversations with each lead.
  • Recordings, transcripts, and AI summaries of calls made or answered in LeadGPT. Calls are always recorded, with no automatic announcement.
  • If you use Enriched Profile (beta), AI estimates about a lead, which can include estimated health risks. They are AI estimates, not medical facts or verified data.

Who processes it

  • Calls and texts run through Twilio, which also stores call recordings.
  • OpenAI transcribes calls and powers call and text analysis, Sofia, the AI Assistant, and Enriched Profile estimates.
  • Vapi runs the AI Receptionist and AI calling campaigns, together with the speech providers it uses.
  • Mailgun sends LeadGPT's email, including call summaries.
  • Amazon Web Services hosts the application, the database, and file storage.

The full list, and how data is protected in transit and at sign-in, is on our Security page.

Business Associate Agreements

If your agency needs a Business Associate Agreement before storing protected health information in a vendor's system, email support@leadgpt.com before you store it, and have the arrangement confirmed in writing. Don't assume one is in place.

What to confirm with your compliance team

  • Whether HIPAA applies to your agency's work, which depends on your role and your contracts with carriers and other partners.
  • Which health details you actually need to store to serve each client. Keep Medicare numbers, Social Security numbers, and medical histories out of notes and texts unless you need them.
  • Whether recording calls and processing them with AI fits your carrier agreements, and what recording disclosure your state requires. LeadGPT does not play one for you.
  • Who on your team should have access. Team admins can review members' recorded calls, transcripts, and AI summaries, but not their leads or text conversations.

This page is general information, not legal advice. Questions about how LeadGPT handles data go to support@leadgpt.com.