SleekAI is a plugin you install on your own server. There is no SleekAI-side data store of visitor messages, so SleekAI is not a Business Associate of yours. The BAA you need is with the model provider whose API key you configured, since that party processes the text of chat messages for completion.

OpenAI offers a BAA on Enterprise and ChatGPT Enterprise tiers. Azure OpenAI offers a BAA on Microsoft's covered enterprise agreements. Google offers a BAA on Google Cloud Vertex AI under qualifying contracts. Anthropic offers a BAA for enterprise customers. Always verify current terms with the provider before launch.

Into a custom table inside your own WordPress database. SleekAI does not phone home with conversation content or metadata. The host you put WordPress on (Pantheon HIPAA, WP Engine HIPAA, Azure, AWS) is the storage layer for those logs, and a BAA with that host covers the at-rest piece.

Yes, with a few patterns. Mark postmeta keys or custom-table columns as PHI in the data mapper so they never enter the system prompt. Use display conditions to keep PHI-aware bots scoped to authenticated portal pages. Add a pre-send filter that strips obvious patterns like SSNs or MRNs from user input as a safety net.

Configure each bot's data mapper to expose only the fields it needs for its job. A pre-visit FAQ bot may only need office hours, insurance accepted, and provider names. A refill-status bot behind the portal needs more, but still nothing about diagnoses unless the use case demands it. Tighter mapping is simpler audit.

By default no. You can opt in for security purposes under a legitimate-use justification, but most clinical deployments skip it. Page URL, model name, and token count are the default per-conversation metadata, all of which are usually fine for audit without raising additional HIPAA concerns.

SleekAI ties into WordPress user roles and capabilities. A PHI-aware bot can be restricted to logged-in users in specific roles (such as portal-patient) via display conditions. Pair that with a strong portal authentication setup (MFA, session timeout) on the WordPress side for a defensible access model.

Yes. Multibot mode runs several chatbots on one site with separate system prompts, data sources, and display conditions. The public site can run a marketing bot on a cheaper model with broad logging, while the portal runs a tightly scoped PHI bot on a BAA-covered model with minimal logging metadata.