Clear answers on PIPEDA-aligned practices, Canadian data residency, retention controls, and what VOOQIO does — and does not — claim for health or US healthcare buyers.
Procurement-ready without overclaiming
Use this page when buyers ask about PIPEDA, Ontario health privacy, encryption, subprocessors, or US HIPAA. We separate what VOOQIO provides from what your business must configure.
24/7
Always-on AI answering
30+
Languages · chat & voice
Same day
Go live
PIPEDA
Aligned practices · Canada
Honest boundaries for Canadian privacy, Ontario health-adjacent use cases, and US healthcare buyers.
VOOQIO is designed for Canadian service businesses under PIPEDA-aligned practices: documented Privacy Policy and DPA, controller/processor roles, Canadian workspace residency, encryption, tenant isolation, retention controls, and breach notification commitments.
Ontario clinics and other health-adjacent teams may process personal health information. Your organization is typically the custodian/controller. VOOQIO processes data on your instructions — configure retention, consents, and what Sarah collects. We do not offer a separate PHIPA certification or health-trustee attestation.
VOOQIO is not positioned as a HIPAA-covered platform for US healthcare providers. We do not offer a Business Associate Agreement (BAA) or a US healthcare compliance pack. US buyers requiring HIPAA should treat VOOQIO as out of scope unless a custom enterprise agreement is negotiated separately.
Documentation topics we cover for security and privacy reviews.
Roles: controller vs processor
When you use VOOQIO for your business, you are typically the controller of your staff and customer data. VOOQIO acts as a processor for that data when we handle it strictly on your configuration and contract. Account, billing, and website analytics may be controlled by VOOQIO as described in our Privacy Policy.
Data residency & cross-border processing
Workspace data for Canadian customers is processed and stored in Canada (Central). Some subprocessors — for example telecommunications, AI inference, or payment partners — may process limited data in other jurisdictions under contractual safeguards described in our Privacy Policy and DPA.
Retention & minimization
You can configure rolling deletion windows or metadata-only storage so transcripts and chat bodies are not kept longer than your policy requires. Lead contact details, billing usage, and audit metadata may be retained separately for operations and invoicing.
Subprocessors
We use vetted providers for hosting, voice, messaging, email, analytics, and payments. Subprocessors are bound by written terms requiring an equivalent level of protection. Request an updated subprocessor summary through your account team or support channel.
Security incidents
We maintain an incident process and will notify affected business customers without undue delay after becoming aware of a breach of security leading to unauthorized access to personal information processed on their behalf, consistent with applicable law and our DPA.
Export, deletion & wind-down
Customers can export workspace data and request deletion according to in-product capabilities and contract terms. At termination, we delete or return personal information as described in the DPA, subject to legal retention requirements.
The safeguards procurement and IT reviewers ask about most often.
Production workspace data for customers is processed and stored in Canada (Central). Infrastructure choices are documented for procurement reviews.
Calls, messages, and workspace records are protected with TLS in transit and encryption at rest for sensitive production data.
Each customer workspace is scoped with row-level security in production so one tenant cannot read another tenant’s leads, calls, or messages.
Eligible plans support rolling deletion (30 / 90 / 180 days) or metadata-only mode that avoids storing transcript and chat message bodies.
Scheduled retention jobs redact or remove aged call and message content according to the policy configured for the workspace.
Sensitive platform and tenant actions are logged for security review. Every workspace sign-in requires multi-factor authentication in production.
VOOQIO describes privacy and security controls as “PIPEDA-aligned practices.” That is not a government certification, SOC 2 attestation, or legal guarantee. Formal compliance depends on your use case, configuration, and applicable law. Contact us for procurement questionnaires or a DPA review.
Book a live demo and hear how Sarah can support your business from the first call to the final follow-up.