> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rivvi.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Compliance & consent

> How Rivvi keeps outreach within the rules — BAA/HIPAA gating, consent and opt-outs, and calling hours.

Rivvi is built for regulated outreach. The guardrails below aren't settings you have to remember — they're **enforced by the product on every outreach path.**

<Note>
  See your organization's compliance status — including your BAA — from **Settings → Compliance** in the workspace.
</Note>

## HIPAA & your BAA

Handling protected health information (PHI) requires a signed **Business Associate Agreement (BAA)** between your organization and Rivvi.

* **PHI workflows stay off until your BAA is in place.** Anything that moves protected health information — most notably the [Echo](/connectors/leadingreach) referral-calling program — is held until your BAA is signed. You can connect tools and query your data in chat right away; it's live PHI calling that's gated.
* **The gate matches your data, not your plan.** Rivvi classifies what an outreach path actually touches. Organizations that don't handle PHI aren't asked to clear a PHI bar they'll never cross. A BAA is included with Rivvi at no extra cost — it's part of the product, not an upsell.

<Card title="Sign or upload your BAA" icon="file-signature">
  New organizations are sent a BAA to sign at signup. You can review status and upload a signed agreement from **Settings → Compliance**. Questions? [support@rivvi.ai](mailto:support@rivvi.ai)
</Card>

## Consent & opt-outs

* **Opt-outs are always respected.** Anyone who has opted out is never contacted again, and an opt-out captured *during* a call takes effect immediately — the contact won't be dialed or texted on any later run.
* **You set the consent bar per program.** Where a program requires consent before reaching a contact, Rivvi enforces that requirement before anyone is contacted — contacts without the required consent are held back, not called.

## Calling hours

Rivvi won't place calls outside the **office hours and time zone** you set during [Discovery](/get-started/discovery) (and can change any time). This keeps outreach inside calling-time rules automatically — you don't have to schedule around it.

## You approve every launch

No outreach goes out without your click on the **launch card**. Rivvi never dials on its own — it drafts the run, shows you exactly who it will reach and what it will say, and waits for your approval. See [Launching outreach](/workspace/launching-outreach).

## Questions

For a security review, a BAA, or a data-handling question, reach out at [support@rivvi.ai](mailto:support@rivvi.ai).

## Next

<CardGroup cols={2}>
  <Card title="Security & privacy" icon="lock" href="/account/security-and-privacy">
    How Rivvi protects your data.
  </Card>

  <Card title="Connector permissions" icon="sliders" href="/connectors/permissions">
    Control exactly what the agent can do with each tool.
  </Card>
</CardGroup>