Meta Business AI for Clinics: What the Terms Say

Meta Business AI is not offered as a HIPAA-compliant service: Meta's developer docs exclude the Health vertical from Meta Business Agent on WhatsApp, Meta does not sign a business associate agreement (BAA), and the Meta Business Agents terms that govern it never mention HIPAA (Meta; BAA Directory; Meta). Meta's Commercial Terms, now and in the version that takes effect November 20, 2026, say you may not use Meta's products "to collect from people" health information unless that product's terms "specifically allow it" (current; updated), and the Business Agents terms give Meta "a perpetual, worldwide" license to what you feed the agent (Meta). A clinic can keep patient intake on Curve Forms, hosted by Curve Compliance under the BAA it signs on every plan, and send Meta only neutral conversion events server-side.

Book a call. Curve Compliance sends your booked-patient conversions to Meta from its servers, and Curve's team does the setup. Book a call with Curve.

What Meta Business AI is

Meta launched Business AI on October 2, 2025: "With just a few clicks, you can configure Business AI for your WhatsApp and Messenger chats, Facebook and Instagram ads, and now, also on your website." Meta says "Your Business AI learns from your posts, responses, and campaigns on Meta products as well as on your commerce website" (Meta). Its October 6, 2026 announcements use the name Meta Business Agent: "With direct checkout tests in Meta Business Agent on Messenger, Meta AI, and Muse, people can now make purchases without leaving the conversation" (Meta).

The agent is also meant to talk to other agents. The same day, Meta previewed the Personal Agent Protocol, "an open standard Meta (Muse and Meta Business Agent) and Sierra are developing," and said "Today Muse buys things, makes appointments, and resolves support questions through a connector or directly on the business's website" (Meta). For what an agent-made booking does to your tracking, see when an AI agent books the appointment.

The contract behind Business AI is the Meta Business Agents and Platform Terms of Service, dated 16 July, 2026. They cover Meta Business Agent and "generative AI features that we make available to you for a business or commercial purpose" (Meta).

Health is excluded on WhatsApp

Meta's developer documentation sets eligibility for Meta Business Agent on WhatsApp phone numbers. The number's WhatsApp Business account must be in a supported vertical, and "all verticals are supported except Finance, Government, Health, Alcohol, Gambling, over-the-counter drugs, and matrimony services" (Meta). The same page says the agent connects to "your own APIs and webhook subscriptions so the agent can take actions and listen to events, such as booking an appointment or confirming a payment," and that "The Eligibility endpoint is the authoritative check" for a given number. The page covers WhatsApp only; it does not say whether the same vertical list applies on Messenger or Instagram. Meta's WhatsApp terms add that "Meta is not a Business Associate or Subcontractor" (BAA Directory).

What changes on November 20, 2026

Meta's updated Commercial Terms say "These updates will go into effect on November 20, 2026" (Meta). Set against the current version, effective March 6, 2024 (Meta), three additions touch Business AI:

• The Business Agents terms are named. They join the supplemental terms that are "incorporated by reference": "Meta Business Agents and Platform Terms of Service: These terms apply when you access and use Meta Business Agent" (Meta).
• AI output is your risk. "You are solely responsible for and assume any and all risks associated with such AI features and any resulting Content" (Meta).
• Meta may crawl your site. You authorize Meta "to use automated software (such as web scrapers, bots, robots, spiders, crawlers, and user agents)" on domains tied to your products or services (Meta). See AI crawlers on healthcare websites.

One thing does not change. Both versions bar sending Meta information that "includes health, financial, biometrics, or other categories of similarly sensitive information" unless a product's own terms allow it (current; updated).

Eight clauses a clinic should read

Each row quotes the Business Agents terms as they read today.

Clause	Meta's words	What it means for a clinic
Your inputs	"a perpetual, worldwide, non-exclusive, fully paid and royalty-free license to use any Input for the purposes described in these Terms," and the license "survives termination" (Meta)	FAQs, service pages and documents you load stay licensed to Meta, even after the terms end.
AI training	Meta may use Content "to improve our artificial intelligence models and algorithms, including Business Agents," including "through automated or manual (i.e. human) review" (Meta)	Agent conversations can be reviewed by people and used to improve Meta's models.
Patient messages	"Meta has independently obtained rights to use that content from such consumer end-users under separate terms" (Meta)	What a patient types to your agent is also Meta's to use under Meta's own terms with that person.
Handover to staff	"Business Agents shall be muted in the conversation with an end user but may continue to observe the content being shared in the chat" (Meta)	After your team takes over, the agent can still observe the rest of the chat.
Your website	Meta may "access, index, cache, analyze or crawl" your domains, and "Any content available from such domains, web pages or URLs shall be deemed Input under these Terms." (Meta)	Anything Meta fetches from your site counts as Input, under the same license.
Your website chat	Meta may "disable and/or suppress your website's pop-ups or web-chat in the interfaces where Business Agents are deployed (including within the in-app browser on Meta Company Products)" (Meta)	People who open your site inside Facebook or Instagram may not see your own chat widget or pop-ups.
Messages in your name	Meta may "generate and send messages proactively to consumer end-users on Meta Company Products on your behalf" (Meta)	Messages can go out under your clinic's name without a staff member writing each one.
Leads	"Any Business Agent lead generation features on Meta Company Products and your use thereof shall be subject to Meta's Lead Ad Terms." (Meta)	Leads the agent collects follow the Lead Ad Terms, which bar sensitive data.

The terms also warn: "You should not rely upon or use Outputs to inform professional advice or decisions, including those related to medicine, finance, law, or pharmaceuticals" (Meta).

Your website chat inside Meta's in-app browser

Many clinics run booking questions or intake through a chat widget or pop-up. Under the clause above, Meta can switch those off "in the interfaces where Business Agents are deployed," including its in-app browser (Meta). So a person who taps through from Facebook or Instagram may reach your site without the chat your team relies on. Give every page a plain route that works without the widget: a visible link to your booking page or a hosted intake form. For consent rules on chat tools, see chat widgets on health sites.

Leads and Meta's health data rule

Leads from Business AI fall under the Lead Ad Terms, which say "You will not collect any data that is sensitive or prohibited by Meta's Advertising Standards" (Meta). For pixel and Conversions API data, the Business Tools Terms bar data that "includes or is based on, directly or otherwise, health information" (Meta); our Business Tools Terms guide walks through that clause. For field choices, see PHI-safe Meta lead ad fields.

Meta's WhatsApp terms also say "the WhatsApp Business Platform is not HIPAA compliant" (BAA Directory). For every ad platform's position, see which ad platforms sign a BAA.

A safer intake path

If you switch Business AI on, set it up so health details never need to pass through it:

• Limit what the agent answers. Keep it to general questions such as hours, location and the services you offer.
• Route health details to a form under a BAA. Send people who want to book or share symptoms to a HIPAA-hosted intake form such as Curve Forms.
• Keep a route that does not need chat. A plain link to your booking page or form still works when Meta suppresses your widget.
• Check what your site sends Meta. Curve's free website scan lists the pixels and trackers on a page; see how to remove the Meta pixel.
• Send Meta outcomes, not answers. Neutral event names from your server, with a fixed field list. See HIPAA-compliant Meta pixel alternatives.
• Get a legal read. Talk to your counsel before using Business AI for any patient conversation.

How Curve Compliance helps

Curve Forms gives your clinic HIPAA-hosted intake and lead forms under the BAA Curve Compliance signs on every plan, with ad attribution attached. Form answers, page titles and free text are never sent to ad platforms, and screened-out and crisis submissions send no conversion, so Meta learns from eligible leads. When a patient leaves to book in IntakeQ, Calendly, Acuity or Jane App, Curve keeps the ad attribution, and bookings made days later still match.

Curve sends conversions to Meta's Conversions API from its servers with neutral event names and a fixed list of fields. It checks every event for PHI-like patterns and strips PHI before data reaches an ad platform, and contact identifiers are off by default on Meta, Google Ads and TikTok. Event Logs show what Curve sent to Meta and what Meta accepted. Curve is SOC 2 Type II, and Curve's team does the setup, typically live in about a week.

Sources, checked October 26, 2026: Meta Business Agents and Platform Terms of Service; Meta Commercial Terms, effective November 20, 2026; Meta Commercial Terms, current; Meta Lead Ad Terms; Meta Business Agent developer overview; Meta Business Tools Terms; Meta, Introducing Business AI; Meta, Advertising Week New York 2026; Meta, A New Way for Businesses and Personal Agents to Work Together; BAA Directory: Meta; BAA Directory: WhatsApp.

Frequently Asked Questions

Is Meta Business AI HIPAA compliant?

Meta does not offer it as HIPAA compliant: Meta's developer docs exclude the Health vertical from Meta Business Agent on WhatsApp, and Meta does not sign a BAA (Meta; BAA Directory). Meta's Commercial Terms also bar using its products to collect health information unless a product's own terms specifically allow it (Meta).

Does Meta use Business AI chats to train its AI?

Meta's terms let it use agent content "to improve our artificial intelligence models and algorithms, including Business Agents," and may do so "through automated or manual (i.e. human) review." For what customers type, Meta says it "has independently obtained rights to use that content" under its own terms (Meta).

Can Meta turn off my website chat?

Yes, where Business Agents are deployed. You authorize Meta to "disable and/or suppress your website's pop-ups or web-chat," including in its in-app browser (Meta).

What happens when Business AI hands a chat to my staff?

The agent is muted "but may continue to observe the content being shared in the chat," and that content counts as Content under the terms (Meta).

Are Business AI leads covered by Meta's Lead Ad Terms?

Yes. The Business Agents terms say lead generation features are "subject to Meta's Lead Ad Terms" (Meta), and those terms bar collecting sensitive data (Meta).

Can a medical practice use Meta Business Agent on WhatsApp?

Meta's developer docs list Health among the verticals Meta Business Agent does not support on WhatsApp, and say "The Eligibility endpoint is the authoritative check" for a given number (Meta). Meta also does not sign a BAA for WhatsApp (BAA Directory).

Can I use Business AI and still track bookings?

Yes. Track the booking where it happens, then send Meta a neutral conversion from your server. Curve Compliance credits each booking to the original ad click; see booked appointment attribution.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, checks every event for PHI-like patterns and strips PHI before data reaches an ad platform. Curve's team does the setup, typically live in about a week.

Talk to Curve Compliance

Book a call. See what your site sends Meta today and how Curve Compliance removes PHI before anything is sent to an ad platform, under the BAA it signs on every plan, with intake on Curve Forms. Curve's team does the setup, typically live in about a week. Book a call with Curve.