Does Canva AI / Magic Studio sign a BAA?

Not confirmed

None of Canva's official pages that were checked mention HIPAA or a BAA, including its terms, DPA, AI product terms, trust portal, and compliance and privacy pages. Whether Canva will sign a BAA is unknown.

Based on 6 sources, all from Canva unless marked.

Business associate
Canva
Tool
Canva AI / Magic Studio
Plans with a BAA
Not stated
Checked
Not confirmed
No BAA offer found on Canva's own pages.

By plan

PlanBAAHow to get itConditions
Free / Pro / TeamsNot confirmedNot statedThe Terms of Use and DPA do not mention HIPAA, PHI, or a BAA. The DPA says Canva does not intentionally process sensitive data.[3],[4]
EnterpriseNot confirmedNot statedThe Canva Subscription Agreement and trust portal do not mention HIPAA or a BAA. The trust portal lists SOC 2 Type 2, ISO 27001, PCI DSS, and other frameworks.[5],[6]

Are the AI features covered?

Vendors often sign a BAA for the core product but leave some AI features out. Here is what Canva says about each one.

AI featureUnder the BAADetails
Magic Studio / Canva AI (Magic Write, design generation, etc.)Not statedThe AI Product Terms say inputs may go to technology partners. They do not mention HIPAA or health data, and they forbid using AI Products for licensed medical advice without a qualified professional involved.[2]

Workspace and collaboration AI that offer a BAA

All BAA-ready alternatives to Canva AI / Magic Studio

Sources

  1. Canva ComplianceCanva, Trust center. Checked Oct 11, 2026.
  2. AI Product TermsCanva, Legal terms. Checked Oct 11, 2026.
  3. Canva Terms of UseCanva, Legal terms. Checked Oct 11, 2026.
  4. Data Processing AddendumCanva, Legal terms. Checked Oct 11, 2026.
  5. Canva Subscription AgreementCanva, Legal terms. Checked Oct 11, 2026.
  6. Canva Trust & Security PortalCanva, Trust center. Checked Oct 11, 2026.

A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.