ModelCharter

Is Canva Magic Studio HIPAA compliant?

Unverified

Canva Pty Ltd · Design

Not verified. Check directly with Canva Pty Ltd before using Canva Magic Studio with protected health information (PHI).

What we checked

This assessment separates the consumer product from any business plan. It uses the vendor documents linked below; an unverified item is not a pass.

Business Associate Agreement
Not verified
No public BAA was confirmed. Treat PHI use as blocked until Canva Pty Ltd provides written terms.
Enterprise route
Canva Enterprise (also Teams/Business)
For regulated use, validate the BAA, configured service and users under the Canva Enterprise (also Teams/Business) contract.
Default data training
Opt-out required
Disputed: Canva officially states training is opt-in (off by default) for Free/Pro, but multiple third-party reports describe AI-training toggles enabled by default that users must turn off; treat as opt-out and verify in current account privacy settings.
Business-tier training
No by default
For Teams, Business, Enterprise and Education accounts Canva states content is never used for AI training and cannot be opted in.
Practical risk: There is a genuine discrepancy between Canva's stated opt-in default and third-party reports of training toggles being on by default for Free/Pro accounts, so an at-work individual user should explicitly verify and disable both 'usage' and 'content' AI-training toggles in privacy settings.

How to make a decision

Check the precise account tier, written contract and intended data before approving Canva Magic Studio. A security certification, DPA or setting can apply to only part of a vendor's service. Keep the source links with your supplier review and revisit them when the vendor changes its terms.

More on Canva Magic Studio

See the full Canva Magic Studio risk profile, with every data-handling fact and its source, or browse all rated AI tools.