AI Vendor BAA Check

Does Tidio Lyro sign a BAA?

No BAA available

Tidio's terms say outright that Tidio is not a HIPAA business associate, and its FAQ says it offers no HIPAA compliance documentation. It does not sign BAAs, and the Lyro AI agent is not for PHI.

Based on 2 sources, all from Tidio unless marked.

Business associate
Tidio
Tool
Tidio Lyro
Plans with a BAA
None
Checked
No BAA
Tidio won't sign a BAA for Tidio Lyro.

By plan

PlanBAAHow to get itConditions
All plansNo BAANot offeredSection 20 (Tidio AI Supplementary Terms), clause 11, says Tidio is not a HIPAA business associate and the customer remains responsible for any ePHI it submits. The FAQ says Tidio does not provide official HIPAA certification or compliance documentation.[1],[2]

Are the AI features covered?

Vendors often sign a BAA for the core product but leave some AI features out. Here is what Tidio says about each one.

AI featureUnder the BAADetails
Lyro AI AgentExcludedNo BAA exists. The FAQ says Tidio's AI cannot be used for healthcare and medical advice. The AI terms bar medical advice without qualified human oversight and require prior written consent for high-risk uses such as health-care diagnosis.[1],[2]

Customer support AI that offer a BAA

  • AdaBAA on: Enterprise contracts (Ada is sales-led)Some plans only
  • Freshdesk / Freddy AIBAA on: Freshdesk, Freshchat (standalone), Freshcaller, Freshdesk OmnichannelSome plans only
  • Intercom FinBAA on: Fin workspaces (Fin AI Agent standalone), Intercom ExpertSome plans only
  • Jotform AI AgentsBAA on: Enterprise, GoldSome plans only
  • Kustomer AIBAA on: Enterprise or Ultimate with HIPAA add-on packageSome plans only
  • LivePerson Conversational CloudBAA on: Conversational Cloud (enterprise contracts)Some plans only

All BAA-ready alternatives to Tidio Lyro

Sources

  1. Terms | TidioTidio, Legal terms. Checked Oct 11, 2026.
  2. Tidio FAQ: Features, Billing, Security, and IntegrationsTidio, Help center. Checked Oct 11, 2026.

A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.