Auryc is a digital experience analytics platform that provides session replay and customer feedback tools for understanding how people interact with websites and applications.

Auryc is now part of Heap, and its capabilities have been integrated into Heap’s product suite. Heap is now part of Contentsquare and is offered as Contentsquare Product Analytics.

Is Auryc HIPAA compliant? Auryc should not currently be used to collect or process PHI based solely on publicly available documentation. Although a 2023 Heap article states that Heap signed BAAs, Contentsquare’s current public terms and Product Analytics documentation do not clearly confirm that a BAA remains available for the services incorporating Auryc’s former capabilities.

 

What changed this year?

As of September 2026, our review identified a change to the policies governing Auryc’s capabilities.

Heap’s privacy page now directs users to Contentsquare’s consolidated privacy policy, which applies to the Heap website, software, and related services. The Contentsquare Services Privacy Policy, effective April 2026, states, “Our Services are not designed, nor intended to collect any sensitive Personal Data under applicable data protection laws (e.g. health data).”

Contentsquare’s June 2026 data processing agreement identifies Heap, Heap Platform, and Heap Connect as Product Analytics services. However, it does not identify PHI as a supported data category or confirm that Contentsquare offers a BAA for those services.

An older Heap blog post remains available and states that Heap signs BAAs. That statement was published in 2023 and predates the current Contentsquare policies. It is not repeated in Contentsquare’s current legal documents.

 

Will Auryc sign a BAA?

BAA availability could not be confirmed from Contentsquare’s current public legal documentation. An older Heap article states that Heap signed BAAs, but Contentsquare’s current Product Analytics service schedule does not state whether that option remains available.

Auryc is no longer marketed as a standalone product, and the current Contentsquare legal terms and Product Analytics service schedule do not confirm that Contentsquare will sign a BAA covering Auryc or Product Analytics.

 

Conclusion

Based on current public information, healthcare organizations should not assume that Contentsquare Product Analytics, including capabilities formerly provided by Auryc, is suitable for PHI. Organizations should obtain confirmation directly from Contentsquare that it will execute a BAA covering the particular services and configuration before using the platform with PHI.

Learn more: HIPAA Compliant Email: The Definitive Guide

 

FAQS

What is a BAA?

A BAA is a legally binding contract establishing a relationship between a covered entity under HIPAA and its business associates. The purpose of this agreement is to ensure the proper protection of PHI as required by HIPAA regulations.

 

What is HIPAA?

HIPAA sets national standards for protecting the privacy and security of certain health information.

HIPAA is designed to protect the privacy and security of individuals’ health information and to ensure that healthcare providers and insurers can securely exchange electronic health information. Violations of HIPAA can result in significant fines and penalties for covered entities and business associates.

 

Who does HIPAA apply to?

HIPAA applies to covered entities, which include healthcare providers, health plans, and healthcare clearinghouses. It also applies to business associates that perform certain functions or activities involving PHI on behalf of covered entities.