Does Canva AI / Magic Studio sign a BAA?
Not confirmed
None of Canva's official pages that were checked mention HIPAA or a BAA, including its terms, DPA, AI product terms, trust portal, and compliance and privacy pages. Whether Canva will sign a BAA is unknown.
- Business associate
- Canva
- Tool
- Canva AI / Magic Studio
- Plans with a BAA
- Not stated
- Checked
Not confirmed
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| Free / Pro / Teams | Not confirmed | Not stated | The Terms of Use and DPA do not mention HIPAA, PHI, or a BAA. The DPA says Canva does not intentionally process sensitive data.[3],[4] |
| Enterprise | Not confirmed | Not stated | The Canva Subscription Agreement and trust portal do not mention HIPAA or a BAA. The trust portal lists SOC 2 Type 2, ISO 27001, PCI DSS, and other frameworks.[5],[6] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what Canva says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| Magic Studio / Canva AI (Magic Write, design generation, etc.) | Not stated | The AI Product Terms say inputs may go to technology partners. They do not mention HIPAA or health data, and they forbid using AI Products for licensed medical advice without a qualified professional involved.[2] |
Workspace and collaboration AI that offer a BAA
- Adobe Acrobat AI AssistantBAA on: Acrobat Studio for enterprise: Analyzer in Acrobat, Acrobat Studio for enterprise: Knowledge Base in AcrobatSome plans only
- Airtable AIBAA on: Enterprise ScaleSome plans only
- Asana AIBAA on: AsanaGov, Enterprise+Some plans only
- Atlassian Rovo / Atlassian Intelligence (Confluence, Jira)BAA on: Enterprise, Standard / Premium (Jira, Jira Service Management, Jira Product Discovery, Confluence)Some plans only
- Box AIBAA on: Enterprise / Enterprise Plus / Enterprise AdvancedSome plans only
- ClickUp BrainBAA on: EnterpriseSome plans only
All BAA-ready alternatives to Canva AI / Magic Studio
Sources
- Canva Compliance
- AI Product Terms
- Canva Terms of Use
- Data Processing Addendum
- Canva Subscription Agreement
- Canva Trust & Security Portal
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.