PHIPA-Ready
Agent agreements available
Distronode Corporation • Last Updated: September 8, 2026
On this page
01. Who Is the Custodian
Ontario's Personal Health Information Protection Act, 2004 (PHIPA) places its core duties on the health information custodian: the clinic, practitioner, or health-care organization that has custody or control of personal health information. If you are a dental office, medical clinic, physiotherapy practice, or similar provider, you are almost certainly the custodian.
When your practice uses District AI to answer calls and handle patient information, District AI acts as your agent and electronic service provider under PHIPA. That means we act on your behalf and on your instructions. We do not become the custodian, and we do not use the information for our own purposes.
02. What "PHIPA-Ready" Means
We describe District AI as PHIPA-ready, not "PHIPA compliant." That distinction is deliberate. Under PHIPA, it is the custodian who complies with the Act. A software vendor cannot be "PHIPA compliant" on your behalf, because the obligations to obtain consent, limit collection, and answer to patients rest with the custodian.
"PHIPA-ready" means we provide the safeguards, contractual commitments, and controls you need so that using District AI fits within your own compliance program. We support your obligations. We do not replace them.
03. How We Support Your Obligations
| Commitment | What it means in practice |
|---|---|
| A written agent agreement | We will sign a written agreement that names District AI as your agent and electronic service provider for the personal health information it handles on your behalf. The agreement sets out the permitted purposes, our safeguards, our confidentiality obligations, retention and secure disposal, and our duty to notify you of a suspected privacy breach. |
| Technical and administrative safeguards | Personal health information is encrypted in transit (TLS 1.2 or higher), and the database storage holding it is encrypted at rest by the provider hosting your region. Each clinic's workspace is isolated at the database with PostgreSQL row-level security, so no other tenant can read your records. Access to production is scoped and least-privilege, and secrets are held in a managed secret store. |
| Notice at the point of contact | You author your receptionist's greeting, and we recommend and support configuring it to identify the assistant as automated when it answers. This helps you meet your obligation to be transparent with patients about how their information is collected before they share it. |
| Use limited to your instructions | We process personal health information only to provide the receptionist service you configure. We do not sell it, and we do not use your content to train public or foundational AI models. Enrichment features that pull external data are opt-in and are not intended for personal health information. |
| Retention and secure disposal | A call leaves a call record, a transcript, and an AI summary rather than an audio recording. Deleting an account removes contacts, call records, transcripts, and messages from the database immediately, and workspace data is deleted or returned to you on request when your agreement ends. You control what your receptionist collects. |
| Breach support | We maintain security incident logs and will notify you without unreasonable delay if we become aware of a suspected breach affecting your workspace, so that you can meet your own notification duties to affected individuals and, where required, to the Information and Privacy Commissioner of Ontario. |
04. What We Ask of You as Custodian
Because you remain the custodian, some responsibilities stay with your practice. To use District AI within PHIPA, you should:
- Collect and use patient information for purposes you are permitted to under PHIPA, and give patients the notice and, where required, the consent your circumstances call for.
- Configure your receptionist so it collects only what your practice needs, and choose the retention posture that fits your policies.
- Limit who on your team can access the workspace, and keep those accounts secure.
- Treat call transcripts that contain personal health information according to your own records-management and security policies.
- Sign an agent agreement with us before routing personal health information through the platform.
District AI is a general-purpose AI receptionist, not a certified electronic health record system. It is your responsibility as custodian to decide whether and how to use it for personal health information, and to keep clinical records in the systems your regulatory College requires.
05. Request an Agent Agreement
We sign agent agreements with health information custodians. To request one, or to ask how District AI fits your PHIPA program, contact us:
- Related documents