FAQs

Webflow as a platform is not a HIPAA Business Associate by default, which means Protected Health Information (PHI) must not flow through Webflow's native form storage or CMS. Flowtrix designs around this constraint by routing any PHI-adjacent form data through HIPAA-compliant third-party intake systems (compliant CRMs, secure form processors, or encrypted middleware). The Webflow site functions as the compliant marketing front-end, while sensitive data flows to appropriately certified back-end systems. Flowtrix documents this data-flow architecture and advises clients on their BAA and compliance obligations.