On this page
Lovable is not HIPAA compliant, by its own account: its documentation says “Lovable does not currently sign Business Associate Agreements and is not HIPAA-compliant. Do not upload protected health information or other restricted categories of data” (Lovable). Base44 says the same about itself, Replit says it “is not HIPAA-compliant” (Replit) and Bubble says apps built on it “won't achieve HIPAA compliance” (Bubble), all on pages checked November 9, 2026, so keep patient data off all four builders and keep intake on a tool that signs a BAA, such as Curve Compliance's HIPAA intake forms. Curve Forms are hosted by Curve under the BAA Curve signs on every plan, and form answers are never sent to ad platforms.
Book a call. Built a clinic or telehealth site with an AI app builder? Curve Compliance hosts HIPAA intake forms that embed with a script, an iframe or a hosted link, keeps form answers away from ad platforms and signs a BAA on every plan. Ask for a Curve Forms demo and a review of your intake funnel; Curve's team does the setup, typically live in about a week. Book a call with Curve.
The short answer for each builder
Each row quotes the builder's own pages, opened November 9, 2026. These pages change, so check them again before you launch.
| Builder | What its own pages say | BAA? |
|---|---|---|
| Lovable | “Lovable does not currently sign Business Associate Agreements and is not HIPAA-compliant” (Lovable docs). Its terms ask users “not to upload, input, or otherwise provide through the Services any protected health information subject to HIPAA” unless a plan or separate written agreement expressly permits it (Lovable terms) | No |
| Base44 | “Base44 isn't HIPAA compliant and can't sign a Business Associate Agreement (BAA)” (Base44 docs) | No |
| Replit | Its builder pages say “Replit does not sign BAAs for its standard hosting services, so it is not a HIPAA-compliant builder out of the box” and “You cannot use Replit's standard deployment for websites that handle PHI” (Replit). “Replit holds SOC 2 Type II certification” (Replit security), and its shared responsibility model puts “Regulatory compliance of your application” on the customer and lists HIPAA among the examples (Replit docs) | No, for its standard hosting |
| Bubble | Its manual says “apps built on Bubble won't achieve HIPAA compliance” and “we currently do not recommend using Bubble for apps that require HIPAA compliance” (Bubble manual). “Bubble complies with the SOC 2 Type II standard for security and offers a GDPR-compliant data processing agreement (DPA)” (Bubble security) | No BAA statement found; Bubble does not recommend it for HIPAA apps |
SOC 2 Type II is a security audit report, and a GDPR data processing agreement is a European privacy contract. Neither is a BAA, which Lovable's FAQ calls “the contracts HIPAA requires” (Lovable FAQ). If a builder's team offers you a BAA in writing, that changes the answer for that builder. Until then, keep PHI out of it.
Why the backend and the form matter more than the front end
An AI builder writes the pages. Patient data goes wherever the form on those pages sends it: the builder's own database, a backend you connect, or a form tool you embed. HHS describes a tracking technology as “a script or code on a website or mobile app used to gather information about users or their actions,” and says that when those vendors handle PHI on a regulated entity's behalf, the entity must “enter into a business associate agreement (BAA) with these tracking technology vendors to ensure that PHI is protected in accordance with the HIPAA Rules” (HHS).
Base44's own healthcare guide puts the fix plainly: “use Base44 for the frontend and route actual patient data through a HIPAA-compliant backend” (Base44). The same split works for any of the four. Whether your project handles PHI at all depends on who you are and what the app collects, so talk to your counsel before launch.
Supabase, Vercel and hosting BAAs
Some of the services an AI-built app runs on do sign BAAs, on their own terms. Supabase says “Organizations must have a signed BAA with Supabase and have the Health Insurance Portability and Accountability Act (HIPAA) add-on enabled when dealing with PHI” (Supabase; Directory entry). Vercel says “We sign Business Associate Agreements (BAAs) with customers” and “The HIPAA BAA is available to Enterprise and Pro customers who are covered entities or business associates under HIPAA” (Vercel; Directory entry).
Site builders vary. Webflow's terms say: “Please do not collect Protected Health Information using the Platform as Webflow does not offer HIPAA compliant services at the present time” (Webflow; Directory entry). If your app's backend is Supabase, that project needs its own BAA and add-on before PHI goes in, and the builder's terms still apply to anything that passes through the builder. For other tools, see HIPAA compliant AI tools that sign a BAA and HIPAA compliant website hosting.
Keep intake off the AI-built page: embed a HIPAA-hosted form
The simplest pattern keeps the AI-built site for marketing pages and puts every patient question in a form tool that signs a BAA. Curve Forms embed with a script that resizes itself, an iframe, a hosted link, a QR code or a custom domain, so the intake step can sit inside your page design while the submissions are hosted by Curve under the BAA Curve signs on every plan. Form answers are never sent to ad platforms.
Logic that shows or hides fields, screening by age, service area or insurance, and separate privacy and marketing consent checkboxes come with it, and a redirect after submit can send eligible patients to your booking page. See what makes an intake form HIPAA compliant.
Scan an AI-built site for pixels
It is easy to add an analytics or ad tag while building a page with an AI tool, and easy to forget it is there. Before launch, run the free website scan to list the pixels and trackers a page loads, and remove any tag that could see patient answers or booking details. For the same checks on a no-code site, see is Webflow HIPAA compliant.
How Curve Compliance helps
Curve Forms gives you HIPAA-hosted intake and lead forms with ad attribution attached. Every lead arrives in the Leads inbox with its answers, UTMs and ad click ID, and form events such as a completed submission reach Meta, Google Ads and your other destinations server-side, without the answers. For the rest of the site, Curve Compliance replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, and contact identifiers are off by default on Meta, Google Ads and TikTok. Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform.
Curve is SOC 2 Type II, signs a BAA on every plan, and its team does the setup, typically live in about a week. Comparing form tools? See Typeform alternatives for healthcare.
Sources, checked November 9, 2026: Lovable Lovable for Enterprise, FAQ and terms; Base44 Privacy and security and healthcare app development guide; Replit security, shared responsibility model and builder pages (therapy, medical); Bubble security and HIPAA manual page; Supabase HIPAA projects; Vercel HIPAA compliance guide; Webflow terms; HHS, Use of Online Tracking Technologies.
Frequently Asked Questions
Is Lovable HIPAA compliant?
No. Lovable's FAQ says “Lovable is not HIPAA-compliant and does not sign Business Associate Agreements, the contracts HIPAA requires” (Lovable).
Is Replit HIPAA compliant?
No, by Replit's own account: its builder pages say “Replit does not sign BAAs for its standard hosting services, so it is not a HIPAA-compliant builder out of the box” (Replit). Its shared responsibility model also leaves regulatory compliance of your app, including HIPAA, to you (Replit docs).
Is Base44 HIPAA compliant?
No. Base44 says it “isn't HIPAA compliant and can't sign a Business Associate Agreement (BAA)” (Base44).
Is Bubble HIPAA compliant?
No, by Bubble's own account. Its manual says “apps built on Bubble won't achieve HIPAA compliance” and “we currently do not recommend using Bubble for apps that require HIPAA compliance” (Bubble manual).
Can I build a telehealth intake page with an AI builder?
You can build the page, but keep patient answers off the builder: embed a form from a tool that signs a BAA, and send PHI only to a backend covered by one. Base44's own guide suggests the same split (Base44).
Does Supabase sign a BAA?
Yes. Supabase says organizations “must have a signed BAA with Supabase and have the Health Insurance Portability and Accountability Act (HIPAA) add-on enabled when dealing with PHI” (Supabase).
Does Vercel sign a BAA?
Yes, on Enterprise and Pro. Vercel says “The HIPAA BAA is available to Enterprise and Pro customers who are covered entities or business associates under HIPAA” (Vercel).
Talk to Curve Compliance
Book a call. Launching a clinic or telehealth site built with an AI tool? See a Curve Forms demo and get a review of your intake funnel: HIPAA-hosted forms that embed in your pages, form answers never sent to ad platforms, and a BAA on every plan. Book a call with Curve.