By
Adam Simmons
· Last checked
October 2026
No AI scribe can be compliant on your behalf. Canada has no certification for one, and under PHIPA the duty to "take steps that are reasonable in the circumstances" to protect client information stays with you, the custodian (PHIPA, s. 12(1)).
What separates scribes is what they disclose: where the session audio goes, where the note is generated, and what is kept. Two vendors selling to Canadian practitioners publish enough to compare.
The options are a scribe like Heidi, a scribe built into your practice software like Colib's, or notes written beside the session without recording, which is how Rivet works. Rivet is ours, so read this page with that in mind.
What do the vendors actually disclose?
Heidi. "For Canadian users, patient data is hosted on cloud infrastructure located in Quebec," and "Heidi complies with PIPEDA as well as all relevant provincial privacy legislation across Canada" (Heidi, Canada compliance).
Colib's AI notes. Colib's security page is unusually specific: transcription "runs on a model hosted inside Colib's own AWS infrastructure in Canada", note drafts are produced through a managed AI service, and "the request may transit through, and be processed in, the United States, with nothing kept there" (Colib security).
Both are being straightforward. The second shows why the question isn't only where data is stored: a note can be stored in Canada and still have been processed somewhere else on the way.
What does PHIPA expect of the vendor?
A company that supplies services so a custodian can handle health information electronically, and isn't the custodian's agent, "shall not use any personal health information to which it has access in the course of providing the services ... except as necessary in the course of providing the services" (O. Reg. 329/04, s. 6(1)). For a scribe, that puts weight on two questions: whether session data is used for anything beyond your note, and who on the vendor's side can reach it.
What should I ask any AI scribe?
Where is the audio processed, and is any of it stored? For how long?
Where is the note generated, and does the request leave Canada?
Is my clients' data used to train models?
What will you put in writing about how you handle client information?
What does my consent form need to say?
What if I'd rather not record sessions at all?
Then you don't need a scribe, you need a faster way to write the note. Rivet's notes are written beside the session in SOAP or DAP format, with your client's measure answers and scores carried into the right section. Nothing records or transcribes the hour, so there is no audio to send, process or keep. Rivet signs on as your agent under PHIPA in a data processing agreement, and records are kept in Canada.
Choose a scribe if the time it saves matters more to you than the recording, your clients consent, and the vendor's answers to the questions above satisfy you and your College.
About Rivet
Rivet is a Canadian practice line built for therapists — a separate number for calls, texts and voicemail, with video sessions and clinical tools in the same place. Your data stays in Canada, and transcription runs on Rivet's own hardware rather than a third-party AI service.
$29 CAD a month per practitioner for the practice line, or $65 with video sessions and clinical tools. Fourteen-day trial, no card.