The short version Canadian therapists have three overlapping privacy regimes to satisfy: PIPEDA federally, a provincial health privacy law where you practice (PHIPA in Ontario, HIA in Alberta, PIPA in BC, and equivalents elsewhere), and your regulatory college's standards of practice. Most therapy-first AI scribes are US-hosted, which is legal under PIPEDA with proper notice and safeguards — but many colleges expect you to *tell clients* when PHI leaves Canada.
**For solo and small-group Canadian practices we currently recommend Twofold as the default — HIPAA-aligned, does not train on customer data, deletes audio after note generation, and offers a defensible cross-border posture when combined with the client notice pattern below. Upheal** is the strongest alternative when you specifically need EU data residency or bilingual (English/French) sessions. If your college has a hard prohibition on US-hosted PHI, none of the ambient scribes fully clear that bar today and you'll need to dictate-after with an on-device tool.
What PIPEDA and provincial law actually require 1. Knowledge and consent for collection, use and disclosure of personal health information. 2. Comparable protection when PHI is processed by a third party, including outside Canada. 3. Notice that PHI may be stored or processed outside Canada, and by whom. 4. A written agreement (BAA-equivalent) with the processor. 5. Breach reporting to the Privacy Commissioner and affected individuals for real risk of significant harm.
Cross-border processing is *not* prohibited by PIPEDA, PHIPA, HIA or BC PIPA. It requires transparency and safeguards.
Vendor comparison for Canadian practices
| Tool | Data location | BAA / DPA | Training on PHI | Audio retention | Bilingual EN/FR |
|---|---|---|---|---|---|
| Twofold | US | Yes (all paid) | No | Deleted after note | English only |
| Upheal | US or EU (option) | Yes (all tiers) | No | Deleted by default | Yes (EN/FR/ES/DE) |
| Mentalyc | US | Yes (all paid) | No | Deleted by default | English only |
| Heidi | US / AU regions | Yes | No | Configurable | English only |
| Nabla | EU / US | Yes | No | Configurable | Multiple incl. FR |
None of the major vendors offer Canadian (in-country) data residency today. Practically, this makes cross-border notice unavoidable if you use ambient AI.
A defensible client-notice pattern Add to your intake/consent:
"I use an AI-assisted documentation tool that records our session audio, generates a draft clinical note, and then deletes the audio. The tool is provided by a US company under a signed data-processing agreement. Your personal health information will be processed in the United States. You can decline this at any time and I will document our sessions manually. Declining will not affect your care."
Then log the consent in the chart. This satisfies PIPEDA/PHIPA notice for most colleges; check your specific college's guidance for anything stricter.
Where colleges are stricter than the law - CRPO (Ontario) expects explicit informed consent for AI-assisted documentation and reasonable safeguards; cross-border is permitted with notice. - OPQ (Quebec) — Law 25 raises the bar on cross-border transfers. Get legal advice before deploying US-hosted ambient AI for Quebec residents. - College of Alberta Psychologists and BCACC follow the general PIPEDA-equivalent pattern; notice + BAA is the working standard.
Always defer to your regulator's current guidance over any vendor's marketing claim.
See also: HIPAA and 42 CFR Part 2 — the US-side controls that back the cross-border story you're telling clients.