← Back

Data Privacy & PHI Policy

Majestik Magik, Inc. · Last updated June 2026

The short version

Majestik Magik, Inc. is a zero-knowledge infrastructure provider. We build and operate the platform. Your agency owns the data — every form, every signature, every audit log. We cannot read it, we do not want it, and we will never use it to train AI.

Your patient data is encrypted before it leaves the device. We do not hold the decryption key. Even if compelled, we cannot produce plaintext PHI — because we do not have it.

What we can and cannot access

Intake forms (DMAS-97AB, 98R, 99)NoAES-256 encrypted at rest. Key derived from your staff's Cognito credentials. We do not hold the key.
SignaturesNoStored in your agency's private S3 bucket. Accessed only via short-lived signed URLs issued to authenticated users.
Audit logsNoEncrypted at rest in your agency's DynamoDB table. We cannot read the contents.
EVV records & GPS coordinatesNoEncrypted at rest. Never transmitted to any third party.
Cognito user accountsNoEach agency has its own isolated Cognito User Pool. We do not have admin access to your pool.
Agency branding configYesName, colors, logo URL only. No PHI. Used to render your portal correctly.
Stripe billing recordsYesBilling relationship only — plan, payment status, subscription ID. No clinical data.

AI training prohibition

No data processed by this platform — including form content, signatures, audit logs, EVV coordinates, or any derivative thereof — will ever be used to train, fine-tune, evaluate, or benchmark any AI or machine learning model by Majestik Magik, Inc. or any vendor we engage.

This prohibition applies to AWS, Vercel, and any future third-party integrations. Before any new vendor is added to the platform, their data processing terms are reviewed against this prohibition. If a vendor cannot contractually guarantee that customer data will not be used for model training, they will not be used.

Your patients' health information will never become a training signal for anyone's AI. Full stop.

Shared responsibility model

HIPAA compliance is a shared responsibility between Majestik Magik, Inc. (Business Associate) and your agency (Covered Entity).

Majestik Magik, Inc. is responsible for:

  • Maintaining encrypted, isolated infrastructure per agency
  • Ensuring no PHI is accessible to the operator or third parties
  • Applying security patches and keeping the platform current
  • Executing a BAA before your agency goes live with real patient data

Your agency is responsible for:

  • Managing who has access to your portal (invite, revoke, role assignment)
  • Ensuring staff devices are secured and not shared with unauthorized individuals
  • Complying with Virginia DMAS documentation requirements
  • Notifying Majestik Magik, Inc. of any suspected breach or unauthorized access

Business Associate Agreement

A Business Associate Agreement (BAA) must be signed between your agency and Majestik Magik, Inc. before any real patient data is entered into the portal. The BAA governs our obligations under HIPAA and explicitly prohibits us from using PHI for any purpose other than providing the contracted service.

To request a BAA, email contact@majestikmagik.dev with the subject line BAA Request — [Agency Name].

Contact

Questions about this policy or how your data is handled:

contact@majestikmagik.dev · Majestik Magik, Inc. · Richmond, VA