"Stored in Canada" describes where records sit. It doesn't describe where a phone call is processed. An AI voice agent has to hear the caller, turn speech into text, run an AI model and speak the reply, and those live steps often happen outside Canada for a few seconds at a time. That can be acceptable under PHIPA, but only if the vendor tells you exactly which steps run where, what is kept, and under what agreement.
Why vendors say one and not the other
"Your data stays in Canada" is the easiest privacy line to sell, and for the database it's often true. But the best speech recognition, voice and AI model providers mostly run their live services in the United States. A vendor that hosts its database in Toronto or Montréal and quietly sends every word of every call to a US model for processing isn't lying about storage. It's just leaving out the part your privacy impact assessment needs.
If a voice AI vendor tells you nothing ever leaves Canada, ask which company does its speech recognition, which runs its AI model, and in which country each one runs. If they can't answer in writing, assume the claim covers storage only.
The four places a call goes
| Step | What happens | What to ask |
|---|---|---|
| Phone network | The call is carried from the patient's phone to the AI | Is the call encrypted? Is it recorded? How long are text messages kept? |
| Speech recognition and voice | The caller's words become text; the reply becomes speech | Where does this run? Is audio retained? Is it used to improve models? |
| AI model | Decides what to say next | Where does it run? Is any prompt kept, and for how long? Any training? |
| Storage | The transcript, messages and requests your team reads later | Which region? Encrypted with whose key? Deleted after how many days? |
Why it matters for your clinic
Under PHIPA your clinic is the custodian. You're expected to be open with patients about your information practices, and to make sure anyone handling information for you protects it. If your privacy statement says "your information stays in Canada" and part of every call is processed in the US, the statement is wrong, and it's your clinic's statement. Accurate disclosure is easy; correcting an inaccurate one after a complaint is not.
ZeroMiss's answer, in full
This is what our PHIPA Compliance Package says, and what we suggest clinics put in their privacy statement:
- Stored: conversations, transcripts, requests, logs and encryption keys are kept in our cloud provider's Montréal region. Identity details and call transcripts are also encrypted with a key created for your clinic alone.
- Exception 1: our telephony provider keeps text messages for up to 10 days, in Canada and the US. Our texts carry only a link, never health details.
- Exception 2: the provider of the AI model for written replies may keep a prompt its automated safety systems flag as possible misuse, for up to 90 days, possibly outside Canada, only to check for abuse and never for training. We've asked for an enterprise agreement that switches this off.
- Processed live: call audio is routed through our voice provider's Canadian servers. Speech recognition, speech synthesis and the AI's spoken replies are processed in the moment by contracted providers, some in the United States, under zero data retention.
- Never stored: call audio. Calls aren't recorded.
Every provider is named in the package your clinic signs, with its location, what it handles, how long it keeps it, and its data processing agreement attached.
Frequently Asked Questions
Is processing outside Canada allowed under PHIPA?
PHIPA doesn't ban it. The clinic must make sure its agent protects the information with reasonable safeguards and must be open with patients about its practices. That means providers bound by agreements that limit use, forbid training and require breach notice, and a privacy statement that mentions processing outside Canada.
Can a voice AI run entirely in Canada?
It's becoming more possible as providers open Canadian regions, but today the fastest, most natural-sounding voice pipelines usually include at least one live step outside Canada. A vendor that runs fully in Canada should be able to name every provider and region to prove it.
What should my clinic's privacy statement say?
Say that you use an AI reception service as your agent, how long it keeps conversation records, that it doesn't use information for training or marketing, and that some live processing of calls happens outside Canada through contracted providers. ZeroMiss supplies suggested wording with the compliance package.
Bottom Line
Ask every AI receptionist vendor two questions, not one: where is it stored, and where is it processed? The vendor worth trusting answers both in writing, lists its exceptions, and gives you wording for your privacy statement that is true.