What Is PIPEDA?
The Personal Information Protection and Electronic Documents Act (PIPEDA) is Canada's federal private-sector privacy law. It governs how businesses collect, use, and disclose personal information in the course of commercial activities.
PIPEDA came into force on January 1, 2001 and applies to most private-sector organisations operating in Canada. It is administered and enforced by the Office of the Privacy Commissioner of Canada (OPC).
PIPEDA is built around 10 Fair Information Principles drawn from the Canadian Standards Association (CSA) Model Code for the Protection of Personal Information. These principles set the standard for how organisations must handle personal information responsibly.
PIPEDA means that if your business collects information about your customers — names, phone numbers, addresses, health details — you have legal obligations about how you use it, protect it, and who you share it with. AI Solutions Canada is designed from the ground up to help you meet those obligations.
Who PIPEDA Applies To
PIPEDA applies to private-sector organisations in Canada that collect, use, or disclose personal information in the course of commercial activity. This includes:
- All businesses using the Smart Receptionist — when you use our service to handle calls, you are collecting personal information from your callers (names, phone numbers, addresses, health or service details)
- AI Solutions Canada Inc. — as the provider of the Smart Receptionist, we process personal information on behalf of our Subscribers and directly from visitors to our website
- Businesses in regulated industries — healthcare clinics, accounting firms, legal professionals, and financial advisors are subject to PIPEDA as well as any additional sector-specific privacy requirements
PIPEDA applies to personal information collected, used, or disclosed in the course of commercial activities. Personal information means any information about an identifiable individual — which includes names, phone numbers, email addresses, home addresses, health information, and financial details.
Quebec has its own provincial privacy legislation — Law 25 (Bill 64), which modernises and strengthens Quebec's private sector privacy law. AI Solutions Canada's practices are designed to be compatible with both PIPEDA and Quebec's Law 25. If you serve Quebec customers, contact us to discuss your specific compliance requirements.
The 10 PIPEDA Fair Information Principles
PIPEDA's requirements are organised around 10 Fair Information Principles. Here is each principle and exactly how AI Solutions Canada addresses it:
How AI Solutions Canada Maintains PIPEDA Compliance
PIPEDA compliance isn't a checkbox we tick — it's built into the architecture of our product and our operational practices. Here is a summary of the specific measures we maintain:
Data Storage — Canada Only
All personal information processed by the Smart Receptionist — including call recordings, transcripts, caller names, contact details, and booking information — is stored exclusively on servers located in Canada. We do not transfer personal information to foreign jurisdictions for storage or primary processing.
Encryption Standards
All data is encrypted in transit using TLS (Transport Layer Security) and at rest using AES-256 encryption. This applies to call recordings, transcripts, customer contact information, and all other personal data in our systems.
Retention Limits
We enforce automatic data deletion timelines:
| Data Type | Retention Period | Deletion Method |
|---|---|---|
| Call recordings | 30 days from call date | Automatic — system-enforced |
| Call transcripts & summaries | Up to 12 months | Automatic at account closure; on request at any time |
| Caller intake data (names, contact, booking details) | Duration of active Subscriber account | Deleted within 30 days of account closure |
| Subscriber account data | Duration of subscription + legal minimum | Deleted after required retention period |
| Website analytics | Up to 26 months (aggregated) | Automatic rolling deletion |
No Data Selling or Third-Party Sharing
AI Solutions Canada does not sell, rent, trade, or otherwise disclose personal information to third parties for commercial purposes. Personal information is shared only with the Subscriber whose number was called (as the core function of the service) and with essential service providers under strict contractual obligations.
Access Controls
Access to personal information within our systems is restricted to authorised staff on a strict need-to-know basis. We maintain access logs and conduct regular reviews to ensure appropriate access levels are maintained.
Privacy Officer Designation
We have designated a Privacy Officer responsible for overseeing PIPEDA compliance, handling access requests, and responding to privacy complaints. Contact information is provided in the final section of this page.
What Personal Information We Collect and Why
The table below summarises the personal information AI Solutions Canada collects, the lawful purpose for each, and how it is handled:
| Information | Source | Purpose | Shared With |
|---|---|---|---|
| Caller name, phone, email | Provided by caller during AI-handled call | Booking confirmation, appointment reminders, Subscriber notification | Subscriber only |
| Caller address / location | Provided by caller during call | Service intake, emergency dispatch, scheduling | Subscriber only |
| Reason for call / service details | Captured by AI during conversation | Booking intake, job summary for Subscriber | Subscriber only |
| Call recording & transcript | Automatically generated during call | Subscriber dashboard access, quality review, AI training (de-identified) | Subscriber only; deleted at 30 days |
| Subscriber business info | Provided at signup | Account setup, service configuration, billing | Not shared |
| Website visitor data | Automatically collected via cookies/analytics | Website improvement, analytics | Not shared; aggregated only |
Your Rights Under PIPEDA
PIPEDA gives you meaningful rights with respect to your personal information. Here is what you can do and how to exercise each right:
-
Right of Access
You may request access to personal information we hold about you. We will respond within 30 days of receiving a verified request. Contact our Privacy Officer using the details below. -
Right to Correction
If information we hold about you is inaccurate or incomplete, you may request a correction. We will update the information or note your disagreement in our records. -
Right to Withdraw Consent
Where we rely on consent to process your information, you may withdraw it at any time. Withdrawal may affect our ability to provide certain services. -
Right to Request Deletion
You may request deletion of your personal information where it is no longer needed for the original purpose. We process verified deletion requests within 10 business days. -
Right to Challenge Compliance
If you believe we have not handled your personal information in accordance with PIPEDA, you may contact our Privacy Officer to raise a complaint. If unresolved, you may escalate to the Office of the Privacy Commissioner of Canada.
If you are not satisfied with our response to a privacy concern, you have the right to file a complaint with the OPC at priv.gc.ca or by calling 1-800-282-1376 (toll-free in Canada). The OPC provides free, impartial complaint resolution services.
Breach of Security Safeguards — Our Obligations
Under PIPEDA's breach notification requirements (in force since November 1, 2018), organisations must:
- Report breaches that create a real risk of significant harm to the Office of the Privacy Commissioner of Canada as soon as feasible
- Notify affected individuals of such breaches directly
- Keep records of all breaches of security safeguards for a minimum of 24 months
AI Solutions Canada maintains a documented incident response process. In the event of a breach involving personal information:
- We assess the breach and determine whether it creates a real risk of significant harm
- If so, we notify the OPC and affected individuals without unreasonable delay
- We notify affected Subscribers promptly so they can take appropriate action with their customers
- We document all breaches regardless of severity, as required by law
- We take immediate steps to contain, investigate, and remediate the breach
If you believe you have identified a security vulnerability or potential breach involving AI Solutions Canada systems, please contact our Privacy Officer immediately at the contact details below.
PIPEDA Obligations for Subscribers
When you use the Smart Receptionist, you are the data controller for the personal information collected from your callers. AI Solutions Canada processes that information on your behalf as a data processor.
This means you have independent PIPEDA obligations with respect to your callers' information. As a Subscriber, you are responsible for:
- Identifying your purposes for collecting caller information and ensuring those purposes are reasonable
- Caller consent — ensuring you have a lawful basis to collect caller information, and informing callers where required that their call is being handled by an AI service
- Responding to caller requests — if a caller requests access to, correction of, or deletion of their personal information, you are responsible for handling that request
- Limiting use — using the call data, recordings, and transcripts you receive only for lawful business purposes
- Protecting downloaded data — any call recordings or data you download from your dashboard become your responsibility to protect in accordance with PIPEDA
- Industry-specific requirements — healthcare, legal, and financial businesses may have additional obligations under sector-specific legislation beyond PIPEDA
AI Solutions Canada's infrastructure is designed to reduce your compliance burden — Canadian data storage, automatic deletion timelines, end-to-end encryption, and no data selling. But your own obligations as a business collecting personal information remain. If you have questions about your specific compliance situation, we recommend consulting a Canadian privacy lawyer.
Contact Our Privacy Officer
For any questions about this PIPEDA Compliance page, our privacy practices, or to exercise any of your rights under PIPEDA, please contact our designated Privacy Officer:
Greater Toronto Area, Ontario, Canada
We acknowledge privacy requests within 5 business days and provide a full response within 30 calendar days as required by PIPEDA.
If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada:
- Website: www.priv.gc.ca
- Toll-free: 1-800-282-1376
- Address: 30 Victoria Street, Gatineau, Quebec K1A 1H3