By
Adam Simmons
· Last checked
October 2026
No email service is compliant on your behalf, Gmail included. Google's own PHIPA page says that "Google Cloud customers are responsible for their own due diligence" (Google Cloud, PHIPA (Canada)). The practical question is what your email holds, where it is stored, and whether you've decided that is acceptable.
Two facts settle most of it. A free Gmail account is a consumer account, not a business service with an agreement behind it. And a paid Google Workspace account cannot keep your mail in Canada.
The usual alternatives are an encrypted email service, keeping clinical content out of email altogether, or a practice line like Rivet for client messages. Rivet is ours, so read this page with that in mind.
Can Google Workspace keep my data in Canada?
No. Google's data region setting offers "the United States, European Union (labeled Europe in the Google Admin console), or No preference", and only on certain paid editions (Google Workspace, data regions). There is no Canadian option.
PHIPA does not, by itself, forbid storage outside Canada, but your College may set expectations about it, and many practitioners tell clients their records stay in Canada. If yours does either, Gmail is a poor fit for anything clinical.
What does PHIPA expect of you?
The duty is the custodian's: to "take steps that are reasonable in the circumstances" to protect personal health information (PHIPA, s. 12(1)). For email, that usually comes down to:
keeping clinical detail out of ordinary email, and using it for logistics
a business account rather than a personal one, with multi-factor sign-in
telling clients in your consent form how you use email
encryption where you do need to send something sensitive
The Ontario commissioner's position on encrypted email, and the documented way to use ordinary email when encryption isn't feasible, are in the guide to email for therapists in Canada.
Does my College care where email is stored?
It may. Ontario's social work College, for example, tells registrants to "ensure that client information is stored in a jurisdiction where the privacy laws are consistent with Ontario laws or, where applicable, Canadian federal laws" (OCSWSSW, Interpretation 5.3.1). Read your own College's standards on electronic records before deciding what goes into an inbox stored in the United States.
What do most practices end up doing?
They keep Gmail or Workspace for scheduling and admin, and move anything about a client's care somewhere built for it: a secure portal, encrypted email, or a practice line where messages stay with the client's record.
Rivet is the last of those. Calls, texts and voicemail sit in one thread per client, records are kept in Canada, and Rivet signs on as your agent under PHIPA in a data processing agreement you accept when you sign up. It is $29 CAD a month for the practice line.
About Rivet
Rivet is a Canadian practice line built for therapists — a separate number for calls, texts and voicemail, with video sessions and clinical tools in the same place. Your data stays in Canada, and transcription runs on Rivet's own hardware rather than a third-party AI service.
$29 CAD a month per practitioner for the practice line, or $65 with video sessions and clinical tools. Fourteen-day trial, no card.