Can you text GLP-1 members about their health without breaking HIPAA?

Yes, but not on the tool you probably run today.

A GLP-1 lifecycle quickly moves past general campaign messages. A lead stops during signup because the price changes with the dose. A new member asks whether a medication they take can be used with the prescription they are about to start. At week three, the same member replies to a check-in about nausea. Another member misses a refill because the dose instructions are unclear.

Those messages touch the member's real health. They belong in a system that can handle protected health information under a healthcare business associate agreement.

Hello Patient builds conversational AI agents for consumer health brands. Hello Patient is HIPAA-compliant, SOC 2 Type 2 certified, and signs a BAA with every client. The agent can carry a two-way health conversation while keeping medical judgment with the brand's medical team. It never gives medical advice. When a question needs a human, it sends the conversation to the medical team with the context attached and logs the interaction.

That gives a GLP-1 brand a practical way to separate broad marketing from health-specific conversation. Braze, Iterable, or Klaviyo can keep sending non-clinical lifecycle campaigns. The healthcare conversational layer can take over when a lead or member replies with a dose, side effect, safety concern, refill problem, or another detail tied to their care.

This is the compliance layer behind the signup-recovery program that brings stalled GLP-1 leads back into conversation. The message can continue without asking the lead to move to a form or wait for support to reopen.

Where does your marketing platform's BAA actually stop?

A signed BAA can create a false sense that every healthcare message is now covered. The document still has a scope. The acceptable-use rules still apply. A platform can agree to handle limited healthcare data while keeping medical records, diagnoses, test results, or health-specific messages outside the service.

Braze will sign a BAA. The agreement itself still has limits. It does not allow medical records or images on the platform, and it does not allow messages that carry diagnoses, test results, or similar sensitive medical information. It is written for engagement and marketing use. The exact terms are in Braze's BAA, as of July 2026.

Klaviyo draws the line earlier. Its acceptable use policy does not allow medical records or health information on the platform, including protected health information as HIPAA defines it, and it lists telehealth as a prohibited use. The full wording is in Klaviyo's acceptable use policy, as of July 2026.

That boundary is easy to miss when the first message looks like ordinary lifecycle marketing. A cart reminder that says a signup is unfinished can stay broad. The reply, "My doctor moved me to a higher dose and now the price is different," has entered a health-specific conversation. The tool carrying the reply matters as much as the tool that sent the first message.

Why does a GLP-1 lifecycle keep crossing that line?

The health detail often appears in the reason someone stopped, delayed, or went quiet.

A lead starts an eligibility quiz and leaves when the cost question no longer feels simple. They may want to know whether the quoted price changes with dose or what happens after the first month. A generic reminder can point them back to the signup. A real recovery conversation has to answer the question that stopped them, and that answer may depend on what they are being prescribed.

Before the first dose, a new member may ask about another medication, a prior condition, or a safety concern. The agent should not answer that question medically. It can recognize that the conversation needs the medical team, collect the relevant context, and hand it over without making the member repeat the whole exchange.

At week three, the member may reply to a check-in with nausea or another side effect. A refill may lapse because they are unsure which dose comes next. These are common reasons members pause inside the lifecycle.

Outside support hours, a message can sit until morning. By then, the member may have abandoned the refill, stopped responding, or decided the program cannot help with the question they have. A healthcare conversational layer keeps the thread open and routes the parts that need medical judgment.

What does a healthcare BAA let the conversation do?

The right BAA and operating setup let the conversation stay where the health question appears.

The agent can answer the parts the brand has approved for it to answer, including program information, cost questions, and process questions that do not require medical judgment. It can keep the member in the same thread instead of sending them to a general inbox or a new form. When the member names a side effect, asks whether two drugs can be taken together, or raises another safety question, the agent hands the conversation to the medical team with the earlier messages attached.

That same structure helps with refills and dose confusion. The agent can ask what is holding the refill up, explain the next non-medical step, and route any question that requires a medical decision. The member gets an answer or a clear handoff rather than another automated reminder.

The mechanics are covered in more detail in the pages on GLP-1 refill and dosage conversations and reactivating lapsed GLP-1 members. In both cases, the useful part is the reply. The system has to be allowed to receive it, understand why the member paused, and move the conversation to the right next step.

Every interaction is logged. The medical team can see what the member said, what the agent answered, and why the conversation was handed over.

How should a GLP-1 brand split the stack?

Keep the marketing platform for the work it is built to do. Broad campaigns, educational sequences, general reminders, and non-clinical lifecycle messages can continue through Braze, Iterable, or Klaviyo according to the platform's terms and the brand's own compliance review.

Move the health-touching reply into the healthcare conversational layer. That is the message that names a dose, connects cost to treatment, describes a side effect, asks a safety question, or explains that a refill stopped for a clinical reason. The agent can continue the non-medical part of the conversation and send the rest to the medical team.

A Series B GLP-1 brand used this structure to recover stalled signups. Over 16 months, the program recovered 4,739 signups from 92,290 leads, a 5.13% conversion rate. The brand reported a 140% lift over the static re-engagement program it replaced.

The recovery rate and the lift measure different things. A 5.13% recovery rate is not the same as 5.13% incremental lift. The 140% figure came from comparing the conversational program with the brand's prior static program.

The new layer was live in under three weeks, with no engineering work on the brand's side. The marketing stack kept its broad campaign role. The conversations that could include health information moved to a system set up to carry them.

Frequently asked questions

Can you send GLP-1 refill and side-effect messages under HIPAA?

Yes, Hello Patient can carry GLP-1 refill and side-effect conversations in a HIPAA-compliant system under a BAA. The agent can ask what is holding up a refill, answer approved non-medical questions, and keep the conversation in the same thread. When a member describes nausea, asks about a drug interaction, or raises another question that needs medical judgment, the agent does not answer it. It sends the conversation to the medical team with the context attached. Hello Patient logs every interaction, and the agent never gives medical advice.

Why isn't a marketing platform's signed BAA enough for a GLP-1 lifecycle?

A signed BAA is not enough when the platform's own terms still limit the health information that can pass through it. Hello Patient gives the GLP-1 brand a separate conversational layer for replies that name a dose, side effect, safety concern, or refill problem. The marketing platform can continue carrying broad non-clinical campaigns. The agent handles the health-touching conversation under Hello Patient's healthcare BAA and routes medical questions to the medical team. The brand has to confirm both that a BAA exists and that the platform's terms permit the messages and replies it plans to carry.

Does Klaviyo allow telehealth or PHI in a healthcare funnel?

Klaviyo's own acceptable use policy does not allow medical records or health information on the platform, including protected health information as HIPAA defines it, and it lists telehealth as a prohibited use, as of July 2026. Hello Patient can sit beside the marketing platform and carry the health-touching two-way conversation under its own BAA. The agent can handle approved non-medical answers and send medical questions to the medical team with context. A GLP-1 brand should review the exact policy and its own use case before deciding where each message belongs.

What counts as protected health information in a GLP-1 message?

A GLP-1 brand should treat a message as health-touching when an identifiable lead or member shares information about a dose, medication, side effect, safety concern, or clinical reason for stopping a refill. Hello Patient is built to carry those conversations under a healthcare BAA. A broad reminder that a signup is unfinished may stay non-clinical. A reply that describes nausea, asks about another medication, or explains why treatment stopped contains information about the member's health. The brand's compliance team should map the first message and the replies it may receive before deciding which system carries the conversation.

How does the agent avoid giving medical advice while answering health questions?

Hello Patient's agent separates approved program and process answers from questions that require medical judgment. It can explain a non-medical next step, answer an approved cost or program question, and ask what is blocking a refill. When a member reports a side effect, asks about a drug interaction, or raises a safety concern, the agent hands the conversation to the medical team. The handoff includes the messages that came before it, so the member does not have to start over. The agent never gives medical advice, and every interaction is logged.

How fast can a GLP-1 brand move this layer onto a compliant platform?

A Series B GLP-1 brand was live with Hello Patient in under three weeks, with no engineering work on the brand's side. The brand kept its marketing platform for broad campaign traffic and added the agent for two-way conversations that could include health information. Over the following 16 months, the program recovered 4,739 stalled signups from 92,290 leads, a 5.13% conversion rate. The brand reported a 140% lift over its prior static re-engagement program. That recovery rate is not the same as incremental lift, and the 140% comparison came from the program the agent replaced.

Book a call to see how your health-touching conversations can move onto a healthcare conversational layer.