PHIPA COMPLIANCE — ONTARIO
Personal health information, handled in Canada
What is PHIPA?
The Personal Health Information Protection Act (PHIPA, 2004) governs the collection, use, and disclosure of personal health information in Ontario. It applies to health information custodians (clinics, hospitals, physicians, pharmacists, etc.) and their agents.
How Callara aligns with PHIPA
Callara is not a custodian — we're a service provider acting as your agent. Our job is to follow the Office of the Information and Privacy Commissioner of Ontario (IPC) guidance for agents: data residency in Canada, encryption in transit (TLS 1.3) and at rest (AES-256), full audit logs, deletion on request.
What we offer
Agent Agreement on request, full access logs, deletion on request, and breach notification to your Privacy Officer if a breach affecting your data is identified — so your clinic can meet its own reporting obligations. Our specific timelines and terms are set out in our Data Processing Addendum, available on request. Hosting on Supabase ca-central-1 (Toronto) — your data never leaves Canada.
For Ontario clinics
If you're an Ontario clinic, ask us for our PHIPA Data Processing Addendum (DPA) and Privacy Impact Assessment (PIA). For Quebec clinics, see our Loi 25 page.
→ PHIPA compliance checklist for clinics
Ten concrete items for evaluating an answering service, with how Callara supports each.
FAQ
Is Callara "PHIPA certified"?
PHIPA has no certification. Your clinic remains the custodian; Callara is a service provider (agent) offering concrete safeguards — Canadian data residency, encryption, audit logs, and an Agent Agreement/DPA on request.
Where is data hosted?
In Canada (Supabase, Toronto region), encrypted in transit (TLS 1.3) and at rest (AES-256), with full audit logs.
How do we get the Agent Agreement and DPA?
Email privacy@callara.ca and mention you're an Ontario clinic. See also our PHIPA checklist.
Official source: Information and Privacy Commissioner of Ontario ↗
