PHIPA-Ready
Agent agreement on request
Distronode Corporation • Last Updated: September 22, 2026
On this page
01. Who Is the Custodian
Ontario's Personal Health Information Protection Act, 2004 (PHIPA) places its core duties on the health information custodian: the clinic, practitioner, or health-care organization that has custody or control of personal health information. If you are a dental office, medical clinic, physiotherapy practice, or similar provider, you are almost certainly the custodian.
When your practice uses District AI to answer calls and handle patient information, District AI acts as your agent and electronic service provider under PHIPA. That means we act on your behalf and on your instructions. We do not become the custodian, and we do not use the information for our own purposes.
02. What "PHIPA-Ready" Means
We describe District AI as PHIPA-ready, not "PHIPA compliant." That distinction is deliberate. Under PHIPA, it is the custodian who complies with the Act. A software vendor cannot be "PHIPA compliant" on your behalf, because the obligations to obtain consent, limit collection, and answer to patients rest with the custodian.
"PHIPA-ready" means we provide the safeguards, contractual commitments, and controls you need so that using District AI fits within your own compliance program. We support your obligations. We do not replace them.
03. How We Support Your Obligations
| Commitment | What it means in practice |
|---|---|
| A written agent agreement | Our written agent agreement names District AI as your agent and electronic service provider for the personal health information it handles on your behalf. It sets out the permitted purposes, our safeguards, our confidentiality obligations, retention and secure disposal, and our duty to notify you of a suspected privacy breach. Ask for it at legal@distronode.com. It has to be signed before any personal health information is routed through the platform, and our Terms of Service say so. |
| Technical and administrative safeguards | Personal health information is encrypted in transit (TLS 1.2 or higher), and the database storage holding it is encrypted at rest by the provider hosting your region. Each clinic's workspace is isolated at the database with PostgreSQL row-level security, so no other tenant can read your records. Access to production is scoped and least-privilege, and secrets are held in a managed secret store. |
| Notice at the point of contact | You author your receptionist's greeting, and a workspace setting has the assistant say at the start of every call that it is an automated assistant. The setting is on by default for Canadian workspaces, and the assistant confirms plainly that it is automated if a caller asks. This helps you meet your obligation to be transparent with patients about how their information is collected before they share it. |
| Use limited to your instructions | We process personal health information only to provide the receptionist service you configure. We do not sell it, and we do not use your content to train public or foundational AI models. Enrichment features that pull external data are opt-in and are not intended for personal health information. |
| Retention and secure disposal | A call leaves a call record, a transcript, and an AI summary rather than an audio recording. Deleting an account removes contacts, call records, transcripts, and messages from the database immediately, and workspace data is deleted or returned to you on request when your agreement ends. You control what your receptionist collects. |
| Breach support | We maintain security incident logs and will notify you without unreasonable delay if we become aware of a suspected breach affecting your workspace, so that you can meet your own notification duties to affected individuals and, where required, to the Information and Privacy Commissioner of Ontario. |
04. What We Ask of You as Custodian
Because you remain the custodian, some responsibilities stay with your practice. To use District AI within PHIPA, you should:
- Collect and use patient information for purposes you are permitted to under PHIPA, and give patients the notice and, where required, the consent your circumstances call for.
- Configure your receptionist so it collects only what your practice needs, and choose the retention posture that fits your policies.
- Limit who on your team can access the workspace, and keep those accounts secure.
- Treat call transcripts that contain personal health information according to your own records-management and security policies.
- Sign an agent agreement with us before routing personal health information through the platform.
District AI is a general-purpose AI receptionist, not a certified electronic health record system. It is your responsibility as custodian to decide whether and how to use it for personal health information, and to keep clinical records in the systems your regulatory College requires.
05. Request an Agent Agreement
Our agent agreement is available on request to health information custodians, and we sign it with you before any personal health information is routed through the platform. To request it, or to ask how District AI fits your PHIPA program, contact us:
- Related documents