It plugs into
what you already run
Nothing here asks you to move off your current system. Where a connection is still being built, the badge says so. See what we build on top of it, or how the receptionist uses your calendar.
Phones & messaging
Retell AI
the voice agent that answers the line
Twilio
numbers, SMS and the carrier leg
Cal.com
booking against a live calendar
Practice systems
athenahealth
clinical and scheduling data
Dentrix
dental practice management
Jane App
scheduling, intake and payments
AestheticRecord
med-spa charts and bookings
Growth & CRM
GoHighLevel
the CRM the follow-up runs through
Google Business Profile
the map listing patients call from
Google Workspace
mail, on a vendor that offers a BAA
Resend
transactional email in development
Platform
n8n
the automation runner, self-hosted
Claude
the chatbot and the compile step
Supabase
Postgres, with every row scoped to one clinic
Vercel
hosting and delivery
Payload CMS
content your team edits
Product names are used to describe what we connect to. None of these companies endorses, sponsors or certifies Cart Gaze.
Patient data is
protected by design
Here is what is in place, and where each piece is enforced.
HIPAA compliant by design
Every build follows the HIPAA Security Rule from the first line: encryption, access control, audit logging, and a signed Business Associate Agreement with every vendor that can see patient data. Not bolted on after a review.
Encrypted at rest and in transit
Where an engagement holds patient data, it sits in Postgres on Supabase, encrypted at rest with AES-256, and every connection to it is TLS. Nothing moves between our systems unencrypted.
A BAA on every vendor that can see PHI
Retell, Twilio, Supabase, Google Workspace and Vercel all offer a Business Associate Agreement, and we sign one before that vendor is on a path that can touch patient information.
No PHI by default
The receptionist does not ask for medical history, insurance IDs or symptoms, and declines when a caller offers them. Most engagements never hold protected health information at all.
One practice cannot see another's data
Every row belongs to one clinic, and the boundary is enforced in Postgres rather than by a filter in application code that a refactor could drop. Checked by a tenant-isolation suite that has to pass before anything ships: 73 checks, plus 24 more on what each clinic's own staff can see.
Consent and opt-out enforced by the database
A message cannot be sent without a consent record covering it, and cannot be sent to a number that has opted out. Both are foreign keys and triggers in Postgres, so a stray script or a hand-run insert is refused the same as the app would be. Proven across 44 checks on PostgreSQL 16.14.
One opt-out ends everything
A patient who opts out of one category is opted out of all of them. That is stricter than the rules require, and it means nobody has to ask twice.
Every action leaves a record
Calls, messages and escalations are logged with a timestamp and an actor. The alert log cannot be edited, including by us.
Texas HB 300 training on file
Muhammad Qasim Hammad completed Texas HB 300 privacy and security training through HIPAA Exams, an IACET-accredited provider, on August 14, 2026. Certificate #000042805515.
There is no such thing as a HIPAA certificate — HHS accredits nobody, and any vendor showing you one bought it from a training company. What there is, is the list above, and a Business Associate Agreement we sign with your practice before anything touches patient data. The full text is in our privacy policy.