Spruce is the fifth shape on this track, and the first that never touches the medicine.
Spruce describes itself, in its own index for assistants, as "a cloud-based platform for HIPAA-compliant communication for healthcare practices". Phone, two-way SMS, fax, video, secure messaging and team chat in one inbox, with a BAA in the terms. It does not staff the visit like SteadyMD, hold the chart like Healthie, run the clinic like OpenLoop or prescribe like MD Integrations. Its terms open in capitals: "SPRUCE DOES NOT PROVIDE MEDICAL SERVICES OR ADVICE".
So the ownership question is narrower, and sharper. What a clinic puts into Spruce is its phone number, its text line, its fax line, years of patient conversations and its HIPAA paperwork. The question is which of those come back out, in what order, and what still has to be built around it. Every claim below is read from Spruce's help center, its organization terms and its developer documentation, and linked so you can check it. Nothing here is medical or legal advice.
What does Spruce own?
The platform, under a licence it can withdraw. The Terms of Service for Organizations, last modified May 14, 2026, make Spruce "the sole and exclusive owner of all right, title, and interest in and to the Platform" and grant you an "internal, limited, revocable, nonexclusive, and nontransferable license". Spruce can amend the terms at any time, and "your sole and exclusive remedy is to discontinue your use of the Platform".
The Spruce Link. Secure messaging and video do not run on your phone number. They run on a Spruce URL. The help center defines Spruce Links as "unique URLs associated with your practice that represent the connection point a patient uses when they download the Spruce patient app and connect to your practice for secure messaging or video calling", in the form `https://spruce.care/practicename`. "When you send a secure message on Spruce, it is sent from a Spruce Link." There is no porting article for a Spruce Link; it is a spruce.care URL.
The questionnaires. Spruce Visits are "adaptive clinical questionnaires developed by the Spruce Health medical team", the PHQ-9 and GAD-7 among them. "We do not offer custom questionnaires", and patients complete them "in the Spruce mobile app (not available on patient web)". The intake that decides who gets stopped is not built here.
The SMS compliance layer, fixed. Spruce adds sender identification and opt-out instructions to every SMS conversation your organization starts: "You are messaging with [Your Organization Name]. To opt out, reply STOP." It says "We cannot turn off sender identification or opt-out functionality". Its telecom partner processes STOP, STOPALL, OPTOUT, CANCEL, END, QUIT, UNSUBSCRIBE and REVOKE, and after one of them, "SMS messages from all organization Spruce numbers to that contact" stop delivering. "Opting back in applies only to the Spruce number the contact sends START to." Our FCC post explains that from November 25, 2026 a sender may read a STOP to an informational text as leaving only that category. Spruce's documented behaviour is the all or nothing reading. That is compliant, since the new rule is a permission and not a duty, and it is not configurable. Beside it, the SMS article lists "prescription drugs" among the categories that "may trigger carrier review", and when a message is blocked its own advice is to switch to secure messaging. A program that texts about a medication should decide early whether SMS is the primary channel or the fallback.
What stays yours?
Find every sentence in the documentation that offers you a choice, because that is a thing you now own. Spruce's most important one is about a phone number.
The phone and fax numbers, if you leave in the right order. The ownership article: Spruce phone numbers "are owned by your practice and can be ported out if you ever leave." The port starts in the number's settings, and Spruce shares "your specific porting information (service address, PIN, etc.) in the Team Spruce conversation in the app as soon as it's available." Two constraints sit in two other articles. "Spruce does not support split porting, which means that you cannot port only SMS text messaging or only voice service to another service provider." And the cancellation article: "Numbers that are not transferred out of Spruce will be irretrievably lost shortly after cancellation." You "must do so before canceling your subscription to ensure continuity of service", and a port out "does not cancel your subscription; you must do that separately." Porting in "typically takes 1-4 weeks"; no timeline is given for porting out.
The carrier registration is not yours, and your website is part of it. To call or text from a Spruce number your organization completes the carrier registration the industry calls 10DLC, with your EIN, legal name, address, a website URL that "must be active and cannot be set to private", and "Details on how patients opt into receiving SMS text messages from your organization". When you leave, the registration stays behind: "Business registration information does not transfer with your phone number when you change service providers." After cancellation "your registration will expire after one month". For a telehealth brand, the live site is the one described in your registration, and the opt-in language Spruce recommends lives "in your organization's standard agreements, such as your new-patient agreement."
The records, with three ways out. After cancellation "You will still be able to log into Spruce to access existing records, as needed." To hold a copy yourself: the API, which "provides the ability to manage contacts and conversations in an Organization", on the Communicator plan with access requested from support; the CSV Data Export, a paid add-on whose structure "can NOT be customized"; or Keragon, which needs "A Spruce account on the Communicator Plan". Read the export's file list first. The developer documentation says a periodic export's messages file "will only contain messages that have been exchanged in the time period", so a daily or weekly export is a running copy, not a one-time archive. Start it on day one, not on the day you decide to leave.
The patient's copy, which was never yours. The secure messaging article is unusually direct: "Patient access to this messaging history is not dependent on your organization remaining a customer or active user of Spruce, and any messages present in a patient account will persist past organizational cancellation or deletion, unless the patient also elects to delete their account." Messages you delete "may be retrievable via record request or legal proceedings". After you cancel, "patients will still be able to message your clinic in the Spruce app", so Spruce recommends an auto-reply telling them they can no longer reach you there.
The money, on one plan. "You must be on the Spruce Communicator plan to access the Stripe integration." A payment request travels inside a secure conversation, the patient pays in the Spruce app, and "Stripe then routes funds to the bank account of your choice." "Spruce does not charge any fees to send payment requests through the Spruce app", and payment requests cannot be sent by SMS. The same article summarises Stripe's rules: acceptable for "professional telemedicine or telehealth services", and "IS NOT acceptable for pharmaceuticals that are being sold directly (or supplements, nutraceuticals, etc.)". That is Spruce describing Stripe, and the processor's own rules are the source, but it is the same line LegitScript draws at add to cart then consult.
The consent and the law. You "will be exclusively responsible for compliance with all applicable Telephonic Communications Laws", and you "will maintain records of, and make available to Spruce within a reasonable time after demand" the consent behind every text and call. The TCPA consent is yours, and so is the proof.
Everything around it. Spruce's own integration guide describes the platform as the place you push contacts into from "an external system (EMR, CRM, PMS, scheduling, billing, etc.)", so the storefront, the intake, the checkout and the program are built elsewhere, and everything that feeds the conversation is yours.
Does their compliance cover you?
The BAA is automatic and conditional. It is Attachment A to the organization terms, agreed when you create the organization. The help center says "The BAA applies from day one, including during the free trial." The attachment itself says: "In the event that you are neither a Covered Entity nor a Business Associate under HIPAA, this Agreement will not apply." On termination Spruce "will either return or destroy all PHI received from Covered Entity", unless it determines that is not feasible.
The channels you use most are carved out. The terms define SMS, email, fax and voice as Unsecure Communications and say "You assume all responsibility for any unauthorized access to PHI" resulting from them. The BAA says that clause applies "without restriction to all matters contemplated in or otherwise within the scope of this Agreement, including without limitation PHI". The help center's position is that these channels can still be used compliantly when the patient has been told the limits and prefers them, and it publishes a consent template. For a GLP-1 program that texts refill reminders, that consent is part of your intake, not Spruce's.
SOC 2 Type II. The security article says Spruce "undergoes regular System and Organization Controls (SOC) 2 Type II audit examinations"; its FAQ says "annual". Customers get the report under NDA by messaging support.
LegitScript. None of the Spruce pages we read displays a LegitScript seal, an NCQA badge or any certification mark, in text or as an image; we grepped the raw HTML, because a footer badge is a claim too. Spruce is a communications vendor, not a pharmacy or a prescriber, and certification is granted to an applicant for the websites it controls, so your storefront is its own application.
Where do their own pages disagree?
Whether you get money back when you cancel. The cancellation article: "Your subscription will be canceled immediately, and any remaining balance or credit will be charged or refunded to the payment method on file." The plans page: "we'll prorate your final bill". The terms: termination "will be deemed to take effect on the last day of the current billing cycle for your account and Spruce will not provide you with a refund for any such termination." The help center is the friendlier document. The terms are the one you agreed to.
Whether you can port after you cancel. The ownership article's FAQ says numbers "can be ported to another provider if you cancel your subscription." The cancellation article says the transfer must happen first, or the number is "irretrievably lost shortly after cancellation." Follow the cancellation article.
How the data export arrives. The help center says it is "available for download to admins only in your Spruce settings, under 'Data Exports'", on any plan. The developer documentation says the files are "delivered to you via an SFTP endpoint" you host, and that "The Data Export tool is only available on a case by case basis."
What happens to data after cancellation. The cancellation article says to "Review the data retention policies in Spruce's terms for details on what happens to data after cancellation." The terms contain no retention schedule. They say Spruce "reserves the right to maintain, delete, or destroy all communications and materials posted or uploaded to the Platform in its sole discretion", and the BAA says PHI is returned or destroyed on termination. Three statements, no dates.
What to settle before you sign
- Which number is the practice's number of record, whether it is being ported in, and who holds the EIN, legal name and live website the carrier registration requires.
- The exit order, written down: request the port out, confirm voice and SMS on the new carrier, then cancel.
- How you will hold your own copy of the conversations, since the export is incremental and the API is one plan up. Decide this before the first patient message.
- Whether SMS is in scope for a program that texts about a prescription drug, or whether the secure app is the primary channel.
- Where the intake, the checkout and the program logic live, since Spruce Visits cannot be edited and payment requests only travel inside secure conversations on one plan.
Spruce is the cleanest ownership question on this track. The number is yours, the inbox and the link are theirs, and the exit sequence is printed on their own cancellation page. For a clinic that already has an intake and a checkout and wants one compliant line to its patients, that is a good trade. For a brand hoping the communication layer would also be the intake, the program and the storefront, it is not.
If you want the whole stack mapped before you choose it, that is what a telehealth program fit review is for, and it is the same work behind our telehealth and GLP-1 website builds.
Common questions
Do I own my Spruce phone number, and can I take it with me if I leave?
Yes, with one condition that Spruce's own help center spells out. Its ownership article says Spruce phone numbers are owned by your practice and can be ported out if you ever leave, and an admin can start the port from the number's settings. Its cancellation article adds the order of operations: numbers that are not transferred out of Spruce will be irretrievably lost shortly after cancellation, so the port has to be requested and completed before you cancel. Spruce does not support split porting, which means voice and SMS move together. The carrier registration behind the number does not move with it; Spruce says business registration information does not transfer when you change service providers, and that it expires a month after cancellation.
What happens to my patient messages and call history if I cancel Spruce?
Spruce's cancellation article says you will still be able to log into Spruce to access existing records after cancelling, but you can no longer make calls or send messages and incoming calls go straight to voicemail. The patient keeps their side: the secure messaging article says a patient's access to the messaging history is not dependent on your organization remaining a customer and persists past organizational cancellation or deletion unless the patient deletes their own account. For a copy you control, Spruce offers a CSV data export as a paid add-on and an API on the Communicator plan. The developer documentation says a periodic export only contains messages exchanged in that period, so it is not a one-time archive of everything; start it while you are still a customer. The organization terms say Spruce reserves the right to maintain, delete, or destroy all communications in its sole discretion, and give no retention schedule.
Does Spruce sign a BAA, and does it cover SMS and fax?
Spruce does not sign a separate BAA. Its Business Associate Agreement is Attachment A to the Terms of Service for Organizations, and you agree to it when you create the organization, including during the trial. It applies only if you are a Covered Entity or Business Associate under HIPAA; the attachment says that if you are neither, the agreement will not apply. SMS, fax, email and voice are defined in the terms as Unsecure Communications, and the terms say you assume all responsibility for any unauthorized access to PHI resulting from them. The BAA incorporates that clause without restriction. So the BAA is real and automatic, and the channels a telehealth program leans on hardest are the ones it carves out. Spruce's help center says standard channels can still be used in a HIPAA compliant way when the patient has been told the limits and prefers them, and it publishes a consent template. Nothing here is legal advice.
Can I build my GLP-1 intake or good faith exam questionnaire in Spruce Visits?
No. Spruce Visits are prebuilt questionnaires developed by the Spruce Health medical team, including the PHQ-9 and GAD-7. The help center says Spruce does not offer custom questionnaires and that the visits are not customizable at this time. Patients complete them in the Spruce mobile app, and the article says they are not available on patient web. A GLP-1 intake with its own branching, contraindication hard stops and state logic has to be built somewhere else, and Spruce's own integration guide positions the platform as the thing you sync contacts into from an external system such as an EMR, CRM, scheduling or billing tool. Spruce also does not prescribe, dispense or fulfil anything; its terms open by stating that Spruce does not provide medical services or advice. Compounded drugs are not FDA approved, and nothing in Spruce changes what your program may say about them.
How do STOP and opt-outs work on Spruce SMS?
Spruce adds sender identification and opt-out instructions automatically to any SMS conversation your organization starts, in a fixed message it says cannot be edited or turned off. Its telecom partner processes STOP, STOPALL, OPTOUT, CANCEL, END, QUIT, UNSUBSCRIBE and REVOKE when the keyword is the only word in the message. After a STOP, texts from all of your organization's Spruce numbers to that contact stop delivering; START re-subscribes only the number the contact texted. Spruce says it does not keep a separate opt-out list and recommends tagging contacts who reply STOP. One STOP therefore ends every SMS from your practice, which is a stricter reading than the FCC rule taking effect on November 25, 2026 requires, and it is not a setting you can change. The terms make you exclusively responsible for TCPA compliance and require you to keep consent records and produce them to Spruce on demand.
Does Spruce handle payments, prescribing or pharmacy for a telehealth program?
Payments, partly; prescribing and pharmacy, no. On the Communicator plan Spruce connects to your own Stripe account and lets you send a payment request inside a secure conversation; the patient pays in the Spruce app and Stripe routes the funds to your bank account. Spruce adds no fee of its own. Its help article summarises Stripe's rules as acceptable for professional telemedicine services and not acceptable for pharmaceuticals that are being sold directly, and says your business website should clearly describe what is for sale and what is not. That is Spruce's summary, not Stripe's text, and your checkout is still yours to build. Spruce has no prescribing, e-prescribing or pharmacy function. Nothing on the pages we read mentions a GLP-1 program or compounding, and the only pharmacy references are Stripe's example of a prescription sent to an outside pharmacy and a sample Preferred Pharmacy field in the integration guide.
Sources
- Spruce Health, llms.txt index, with the one line description, the plan gating and the help center links checked 2026-11-07
- Spruce Help Center, Ownership and Management of Spruce Phone Numbers and Spruce Links, updated July 6, 2026 checked 2026-11-07
- Spruce Help Center, How to Create or Transfer (Port) Phone and Fax Numbers on Spruce, updated September 8, 2026 checked 2026-11-07
- Spruce Help Center, How to Cancel or Update a Spruce Subscription, updated November 5, 2026 checked 2026-11-07
- Spruce Help Center, How to Register Your Spruce Business Phone Number, updated October 19, 2026 checked 2026-11-07
- Spruce Help Center, Spruce SMS Messaging, Standard Texting and HIPAA-Compliance, updated October 26, 2026 checked 2026-11-07
- Spruce Help Center, Spruce Secure Messaging with Patients, updated May 20, 2026, with the Data in Patient Accounts section checked 2026-11-07
- Spruce Help Center, Spruce Video Calls and Spruce Visits, updated August 12, 2026 checked 2026-11-07
- Spruce Help Center, Spruce HIPAA Compliance and Business Associate Agreement (BAA) Overview, updated August 14, 2026 checked 2026-11-07
- Spruce Help Center, Spruce Safety, Security, and HIPAA Compliance Overview, updated August 11, 2026, with the SOC 2 Type II section checked 2026-11-07
- Spruce Help Center, Spruce Mobile Payments via Stripe, updated July 27, 2026 checked 2026-11-07
- Spruce Help Center, Spruce CSV Data Export, updated October 1, 2026 checked 2026-11-07
- Spruce Help Center, Spruce Account Deletion, updated May 26, 2026 checked 2026-11-07
- Spruce Help Center, Spruce Keragon Integration, updated October 1, 2026 checked 2026-11-07
- Spruce, Terms of Service for Organizations, last modified May 14, 2026, including Attachment A, the Business Associate Agreement checked 2026-11-07
- Spruce, Plans and Pricing, with the plan comparison table and the billing FAQ checked 2026-11-07
- Spruce, Spruce for patients, with the patient FAQ checked 2026-11-07
- Spruce developer documentation, Spruce API Overview checked 2026-11-07
- Spruce developer documentation, Spruce Webhooks Overview, updated July 31, 2026 checked 2026-11-07
- Spruce developer documentation, Spruce Integration Guide, updated September 9, 2026 checked 2026-11-07
- Spruce developer documentation, Spruce CSV Data Export, updated September 15, 2026, with the file structure and the SFTP requirement checked 2026-11-07
Want this costed for your build?
Tell us what you already have and what is not working, and we will come back with the shape of the work and what drives the number.