By
Adam Simmons
· Last checked
October 2026
Heidi says more than most scribes do about Canada. Its Canadian compliance page states that "for Canadian users, patient data is hosted on cloud infrastructure located in Quebec", and that "Heidi complies with PIPEDA as well as all relevant provincial privacy legislation across Canada" (Heidi, Canada compliance).
What a scribe cannot do is make the decision to record a therapy session for you. Under PHIPA you are the custodian, and the duty to "take steps that are reasonable in the circumstances" to protect personal health information is yours (PHIPA, s. 12(1)). With an AI scribe, the session itself becomes data that leaves the room.
The usual alternatives are another AI scribe, writing notes yourself, or notes written beside the session without recording, which is how Rivet works. Rivet is ours, so read this page with that in mind.
What does an AI scribe ask of you?
Consent. Heidi's own page: "Your knowledge and consent are essential for the collection, use, or disclosure of your personal information." In therapy, that is a conversation at the start of the relationship, and some clients say no.
A decision about the audio. Heidi describes capturing "telehealth audio straight from the call". Ask what happens to that audio after the note is made, and how long anything is kept.
Your College's view. Some Colleges publish guidance on AI and on recording sessions. Read yours before your first recorded session.
Reading every note. The note is still yours, and so is anything it gets wrong.
What does PHIPA expect of the scribe itself?
The vendor has duties too. A company that supplies services so a custodian can handle health information electronically, and isn't the custodian's agent, "shall not use any personal health information to which it has access in the course of providing the services ... except as necessary in the course of providing the services", and "shall not disclose any personal health information to which it has access" (O. Reg. 329/04, s. 6(1)). That is why the training question below matters: using session data to improve a model is a use beyond providing your notes.
What should I ask Heidi, or any scribe?
Where is the audio processed, and is any of it stored? For how long?
Is my clients' data used to train models?
What will you put in writing about how you handle client information?
Can a client's data be deleted on request?
What if I don't want a recording at all?
Then the choice is about where the note gets written, not which scribe. Rivet's notes are written beside the session, with your client's measure answers and scores carried into the right section. Nothing records or transcribes the hour. Rivet signs on as your agent under PHIPA in a data processing agreement, and records are kept in Canada.
Choose Heidi if you want an AI scribe, your clients consent to recording, and you've read its answers to the questions above.
About Rivet
Rivet is a Canadian practice line built for therapists — a separate number for calls, texts and voicemail, with video sessions and clinical tools in the same place. Your data stays in Canada, and transcription runs on Rivet's own hardware rather than a third-party AI service.
$29 CAD a month per practitioner for the practice line, or $65 with video sessions and clinical tools. Fourteen-day trial, no card.