Not a badge row. Everything here is checkable, and we would rather tell you where the edges are than have you find them.
We are not certified under any privacy standard, and we will not tell you we are “PHIPA-compliant” or “HIPAA-compliant”.
There is no PHIPA certification. Ontario’s health privacy law sets out duties; it does not create a certificate, an auditor or a registry. Any vendor showing you a PHIPA badge is showing you their own opinion of themselves.
What we can do is tell you exactly where your information goes, name every company that touches it, and sign an agreement about it. That is worth more in your file than a logo.
Our database is in Canada. Call records, summaries, bookings, contacts and your account live in the Canada Central region, and that is where they stay at rest.
Handling a live phone call is a different matter, and we are not going to pretend otherwise. Turning speech into text, deciding what to say and speaking it back involves specialist providers, and the ones capable of doing this well in real time are in the United States today. So your data is stored in Canada and processed partly in the United States.
Ontario law does not require health information to stay in Canada. What it requires is that you know where it goes and are satisfied the safeguards are reasonable — which is exactly why we publish the list rather than summarising it.
We will give you the complete list of the companies involved, what each one does and which country it works in — ask, and it comes back in writing as part of a vendor review. We give subscribers thirty days’ notice by email before moving a category of data to a new country.
| Who | What they can see |
|---|---|
| Your own staff | Only your business. Accounts are invited by you and can be removed by you. |
| Another ZoiVox customer | Nothing. Businesses are separated in the application, and no customer can query another’s records. |
| ZoiVox staff | Technically yes, for support and to fix faults. ZoiVox is a small Canadian company and that access is held by its operator, under the confidentiality terms in our agreement with you. |
| Our providers | Only the part each needs to do its job — the speech provider hears the call, the calendar provider sees the booking. None is permitted to use it for anything else. |
Under Ontario’s Personal Health Information Protection Act you remain the health information custodian. We would be acting for you, which means we may only use the information to do the job you have asked us to do, may not disclose it, and must work within the conditions you set.
Before you sign anything we will give you, in writing:
If your privacy officer has a questionnaire, send it. We would rather answer forty questions honestly than have you rely on a badge.
If you think you have found a security problem, write to hello@zoivox.ca with enough detail to reproduce it. We will reply. We do not run a bug bounty, and we will not threaten anybody who reports a problem in good faith.
For a vendor review, a due-diligence questionnaire or an insurer, write to hello@zoivox.ca. A real person answers, and if the answer is “not yet” you will be told that rather than given a paragraph that sounds like yes.
We would rather answer it properly than have you guess from a badge.