Current, factual status: NerdFax is not HIPAA compliant and does not have a signed Business Associate Agreement (BAA) in place with its infrastructure providers. Do not send real patient health information through NerdFax. This page exists to say that plainly, not to claim otherwise.
Health Data & HIPAA Disclosure
Effective August 12, 2026. NerdFax is a product of Habibi Asset Management LLC.
1. What "HIPAA-ready" means today, precisely
NerdFax's architecture was built with HIPAA-adjacent handling in mind — for example, avoiding storing protected health information in logs or error-tracking metadata, and time-bounding how long document content is retained. "HIPAA-ready" describes an architectural intent, not a compliance status, a certification, or a guarantee. NerdFax is not currently HIPAA compliant.
2. Business Associate Agreement (BAA)
A BAA has not been signed with NerdFax's database provider or hosting platform. NerdFax has no BAA of its own to offer a customer, and no infrastructure-level BAA coverage exists for any document processed by the service.
3. What this means in practice
- Do not send documents containing protected health information through NerdFax while this notice is current.
- NerdFax's underlying database is currently provisioned on a plan tier that does not itself offer a BAA option.
- NerdFax's current release is a general consumer beta, not a healthcare product. A healthcare organization that wants to use NerdFax once a compliant tier exists should register interest rather than send any document today — see the next section.
3a. If you're a healthcare organization
Please don't upload a document or any patient information through the current product. Instead, register your organization's interest and we'll reach out once the compliant tier is ready: tell us you're interested. That form only collects your name, work email, organization, and an optional message — never a document, never patient information.
4. What NerdFax does today for every document, regardless of content
- Document content is never included in application logs or error reports.
- Document content is deleted from storage on a bounded schedule after a fax reaches its final outcome — see the Privacy Policy for specifics.
- The public proof/trace link for any fax exposes only non-identifying facts (dates, delivery status, page count, a cryptographic proof) — never the document, never a fax number, never a name.
5. Questions
Questions about this disclosure, or about NerdFax's current status for a healthcare use case: support@nerdfax.com.