This provision prohibits use of the Perplexity API to process Protected Health Information as defined under HIPAA unless a separate Business Associate Agreement has been executed between Customer and Perplexity.
This analysis describes what Perplexity AI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Without a Business Associate Agreement, any use of the Services involving Protected Health Information is prohibited, creating a compliance risk for customers operating in healthcare-adjacent contexts.
Under this clause, Customers are contractually prohibited from transmitting or processing Protected Health Information via the API unless a Business Associate Agreement is separately executed with Perplexity. The agreement does not indicate whether Perplexity offers a BAA as a standard commercial option.
How other platforms handle this
May harm the reputation of Tinder or its affiliates, meaning the uploading or sharing of content on the Tinder platform that is defamatory to Tinder or its affiliates or advocates misuse of the Service...
Political content, including for dissemination in electoral campaigns.
Gore, such as dismemberment, beheadings, mutilations, and exposed organs/bones/muscle
Monitoring
Perplexity AI has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Customer may not use the Services to create, receive, maintain, transmit, or otherwise process any information that includes or constitutes "Protected Health Information"...unless Customer and Perplexity have executed a Business Associate Agreement.— Excerpt from Perplexity AI's Perplexity API Terms of Service
1) REGULATORY LANDSCAPE: This provision directly engages HIPAA, specifically the Privacy Rule at 45 C.F.R. Section 160.103, enforced by the HHS Office for Civil Rights. HIPAA requires covered entities to execute BAAs with business associates before sharing PHI. The absence of a BAA while transmitting PHI would constitute a HIPAA violation by the Customer as a covered entity, regardless of Perplexity's contractual prohibition. 2) GOVERNANCE EXPOSURE: High for healthcare or healthcare-adjacent Customers. The agreement prohibits PHI processing but does not specify technical safeguards that prevent PHI from being submitted, meaning compliance depends entirely on Customer-side controls. If PHI is transmitted without a BAA, both parties may face regulatory exposure. 3) JURISDICTION FLAGS: HIPAA applies to covered entities and business associates operating in the United States. State health data privacy laws (such as California's Confidentiality of Medical Information Act or New York's health data regulations) may impose additional restrictions on health data processing that go beyond HIPAA and may not be addressed by this provision. 4) CONTRACT AND VENDOR IMPLICATIONS: Healthcare organizations and vendors should verify whether Perplexity offers a BAA before deploying the API in workflows that could involve PHI. The agreement does not commit Perplexity to offer a BAA, so procurement teams should confirm BAA availability as a condition of deployment in health-related use cases. 5) COMPLIANCE CONSIDERATIONS: Compliance teams in covered entities or business associates should conduct a use case review before deploying the Perplexity API to identify any workflows that could result in PHI transmission. System configurations should enforce data sanitization or de-identification of health data before API submission. If a BAA is required, it should be executed before any API deployment in clinical or health-adjacent contexts.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 3 platforms + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
Without a Business Associate Agreement, any use of the Services involving Protected Health Information is prohibited, creating a compliance risk for customers operating in healthcare-adjacent contexts.
Under this clause, Customers are contractually prohibited from transmitting or processing Protected Health Information via the API unless a Business Associate Agreement is separately executed with Perplexity. The agreement does not indicate whether Perplexity offers a BAA as a standard commercial option.
ConductAtlas has identified this type of provision across 247 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Perplexity AI.