10 articles in this category.
Two things get conflated constantly: a model holding context while it works, and a vendor training on your content. They are different, and only one of them persists. Here is the distinction, plus the part that matters most — the strongest de-identification happens on your own machine, before anything is sent anywhere.
Processing location and storage location are different questions, and most vendor pages only answer the second. Here are the five questions that get a specific answer about where your client information actually goes, and what a vague reply is telling you.
The answer is almost never under a heading that says 'training'. It sits in the terms of service under service improvement, product development, or aggregated and de-identified data. Here is exactly where to look, which four phrases to search for, and what each one actually permits.
PIPEDA is the federal privacy law covering private-sector organizations that handle personal information commercially. For most Canadian clinicians it sets the floor, with provincial health-privacy law often sitting on top. Here is what the law and the regulator actually say, quoted and linked, and the questions it should make you ask a software vendor.
Clinicians kept asking me the same question — are we even allowed to use this? So I read what Canadian psychology colleges actually publish on AI. No college bans these tools; none has a full rulebook. Ontario, Alberta, and Ontario's privacy commissioner all land in the same place: the psychologist stays the author who reviews and signs.
AI report writing can be used in a PHIPA-compliant way, but no software category is 'compliant' on its own. Compliance depends on the vendor's safeguards and how you, the custodian, configure and use the tool. Here is what PHIPA and PIPEDA actually require, and the questions to ask before you trust any AI report tool with client information.
Canadian data residency means your client files are stored and processed inside Canada, rather than on servers in another country. For clinicians, it matters because information held abroad can fall under foreign laws and be accessed by foreign courts or governments. Here is what data residency actually means, why it matters under PIPEDA, and what to ask a vendor.
Every psychologist I've spoken to draws the same line in almost the same words: the interpretation is what they trained for, and their signature has to mean something. We built to that line deliberately — here is what it means in the product, what it costs us, and why I think the trade is right.
Yes — because you keep your voice, your structure, your clinical reasoning, and your final sign-off. The software takes the mechanical assembly off your plate, not the thinking. You read every section and it's yours, or it doesn't go out.
Protecting client privacy is essential when clinical text or speech is processed by AI. Anonymization and de-identification strip the obvious identifiers — but on their own they aren't foolproof, since models can sometimes re-identify people. A layered approach — masking identifiers, distorting biometrics, and differential privacy — keeps data useful while the clinician stays in control of every record.