Almost certainly some of it does, for almost every product on the market, and that on its own does not tell you whether the product is a problem.

The useful version of this question is narrower: which information goes where, how long it stays, and who can read it while it is there. A video platform whose session media never touches a server is in a different position from a note-taking tool whose entire database sits in Virginia, even though a one-word "yes" would cover both.

Three categories are worth separating when you go looking.

Records at rest — notes, message history, client details. This is the one most reviewers mean when they ask.

Operational transit — the phone network, email delivery, mobile push notifications. These cross borders routinely and hold very little for long.

Anything sent to a third-party AI service. Different in kind from the other two, because the information leaves the vendor's own systems entirely and lands with a company that has its own retention, its own purposes and its own terms. Ask about this one separately and by name.

What the rules say about sending it somewhere else

Ontario's regulation approaches this by constraining the service provider rather than the geography. A provider "shall not use any personal health information to which it has access in the course of providing the services for the health information custodian except as necessary in the course of providing the services," and "shall not disclose any personal health information to which it has access in the course of providing the services" (O. Reg. 329/04, s. 6(1)).

Quebec is explicit about the border itself: "Before communicating personal information outside Québec, a person carrying on an enterprise must conduct a privacy impact assessment," and the information "may be communicated if the assessment establishes that it would receive adequate protection." The section also requires that "the communication of the information must be the subject of a written agreement" (P-39.1, s. 17).

At the federal level, the Privacy Commissioner's own summary is that Alberta, British Columbia and Quebec "have their own private-sector privacy laws that have been deemed substantially similar to PIPEDA," and that "even in those provinces, PIPEDA still applies to transactions involving personal information transferred across borders" (OPC).

What your own College expects when you choose a cross-border tool is a separate question from what the statute permits, and it is the one more likely to come up. Four regulators publish something here, and they do not all say the same thing.

Ontario social work frames it as a test about the destination's law rather than about the border. Registrants providing virtual services shall "ensure that client information is stored in a jurisdiction where the privacy laws are consistent with Ontario laws or, where applicable, Canadian federal laws" (OCSWSSW 5.3.1).

Ontario psychology asks the same question of the cloud specifically: registrants "must ensure that the jurisdiction within which the cloud service is hosted has security features which would be consistent with privacy requirements under Ontario legislation" (CPBAO Standard 17.3(a)).

Nova Scotia counselling therapy draws the line at the border itself, and is the most explicit statement of Canadian data residency published by any regulator in this set. Registrants providing telecounselling are responsible for ensuring that any electronic communication platform they use is "secure and compliant with the Personal Information Protection and Electronic Documents Act (PIPEDA)" and is "hosted on servers housing data exclusively within Canadian jurisdiction" (NSCCT, Interjurisdictional Telecounselling).

Read the scope of that one before carrying it further than it goes. It sits in a telecounselling policy and its subject is platforms used for telecounselling, not every tool in a practice.

Nova Scotia psychology answers the question a cross-border transfer actually raises — who stays on the hook. The province's health privacy act "continues to apply where that information is transferred for processing outside Canada; Custodians remain accountable for personal health information after it has been transferred" (NSRP, Use of Technology by Psychologists).

Alberta adds the paperwork version. A psychologist who puts information into an electronic record not under their own direct custody and control "shall have a written information management agreement" and "a written information sharing agreement that addresses access, secondary use and disclosure of client information," or else "shall have confidence that the person or organization that has primary responsibility for the record has reasonable access and privacy protections in place" (CAP §7.7).

How to find out for a specific product

The answer is usually published; it is just not on the marketing pages.

Look for a sub-processor list. Most serious vendors publish one — a table of the other companies involved in delivering the service and where each operates. If there is no such list anywhere, that is the finding.

Read the privacy policy for the word "transfer." Cross-border language is almost always there, phrased blandly.

Check the telephony layer separately if the product handles calls or texts. Voice and SMS are usually delivered by a specialist carrier platform, and the recordings and message logs live there on that company's schedule, not the vendor's.

Ask directly, in writing, and keep the answer. A dated email from a vendor naming countries and retention windows is a better artifact for a College file than any certification badge.

Does it actually matter?

Sometimes a great deal and sometimes not at all, and the difference is worth being honest about rather than treating every border crossing as equivalent.

It matters most when the information is clinical content — session material, notes, transcripts — and when it is held rather than passed through. It matters much less for a push notification that says "you have a new message" and contains nothing else.

It matters for a specific practical reason too: your clients may ask, and the answer is part of what they are consenting to. A practitioner who can describe the arrangement in two sentences is in a much better position than one who has to find out.

Why comparison articles get this wrong

Nobody outside the vendor can tell you where a given product stores its data. Reviews, directories and comparison round-ups get it wrong constantly, because the answer changes when a vendor changes suppliers and nobody goes back to update the article.

Ask the vendor. Get it in writing. Re-ask when you renew.

About Rivet

Rivet is a Canadian practice line built for therapists — a separate number for calls, texts and voicemail, with video sessions and clinical tools in the same place. Your data stays in Canada, and transcription runs on Rivet's own hardware rather than a third-party AI service.

One plan, $65 CAD a month, everything included. Fourteen-day trial, no card.

See what's included · Start the trial