Skip to main content
You’re accountable for the personal health information of the people who contact your practice. Knowing exactly what Rivet stores — and for how long — is the foundation of that accountability.

​
What Rivet collects from your clients

Rivet handles client information on your behalf as your agent. Every category below is treated as personal health information (PHI) and protected accordingly. What Rivet does not collect:
  • Diagnoses, treatment plans, and therapeutic formulations — those remain in your EHR. Rivet holds the session record (notes, measures, risk); interpretation, formulation, and the longitudinal chart stay where they belong. See how Rivet and your EHR fit together.
  • Health-card numbers, OHIP numbers, or government identifiers.
  • Payment card numbers — Stripe handles payments end to end.
  • Recordings of video sessions. The architecture has no recording path.
  • Anything from third-party AI services. Voicemail audio and transcripts never leave Rivet’s infrastructure for cloud AI processing.

​
Retention defaults

Anonymous metadata about activity volume and timing — counts, not content — may be retained for service-performance analysis.

​
Your client’s right to deletion

A client can ask you, at any time, to delete information you hold about them. Under PHIPA, that request comes to you as the custodian. To act on it:
  1. Confirm the request with the client (a text or email reply is fine).
  2. Email hello@getrivet.ca from your Rivet-signed-in email address. Include the client’s phone number and the scope (“everything,” “the October 14 voicemail,” “just the message history,” etc.).
  3. Rivet acts on your authorization and deletes the requested information within seven business days.
  4. Rivet confirms the deletion back to you so you can close the loop with the client.
You stay in the audit trail — the audit log records that the deletion was authorized by your account.

​
Your client’s right to access

If a client asks for a copy of what you hold about them (PHIPA s.52), you respond as the custodian. The data is exportable from your inbox — voicemail transcripts, SMS history, and session metadata can be copied or printed. Progress notes, assessment responses, and client record fields are exportable from the client record as a structured document. If you need help compiling a complete response, email hello@getrivet.ca.

​
Imported phone contacts

If you import contacts from your phone (to display names alongside incoming calls and to suppress auto-replies on personal contacts), those contact records are held only for that purpose. They aren’t used for any other purpose, aren’t shared with any third party, and are deleted when you remove them or close your account. Imported contacts are non-client personal information — the people in your contacts haven’t consented to anything by being in your phone. Rivet limits use to display and auto-reply suppression for that reason.

​
When you cancel

When you cancel your account, Rivet — at your option — either returns your account and communication data to you or securely deletes it within 30 days. This covers voicemail recordings, transcripts, SMS conversation history, call records, and imported contacts. Clinical records are handled separately. Because they go with you — into your own record system — Rivet gives you a 90-day window after cancellation to export them before they are deleted. A full export is available on or before your account closure date. Your clinical records are deleted on your instruction, or automatically at the end of the 90-day wind-down, whichever comes first. The ongoing obligation to keep clinical records for the period your College requires — commonly at least 10 years from the last clinical interaction — is yours as custodian, met through your own record system after export from Rivet. Three additional carve-outs apply regardless:
  • Billing records are retained for seven years to meet Canada Revenue Agency requirements.
  • Operational audit logs (sign-in events, security events) are retained for 90 days.
  • Deletion ledger — a timestamped record of what was deleted and when, used as compliance evidence, not the data itself.
You can elect a return-and-delete (we send you an export, then delete) or delete-only (no export) for your account and communication data. Email hello@getrivet.ca to invoke the cancellation path you want.

​
Where the data physically lives

  • Voicemail audio + transcription: processed locally in Canada on Rivet’s hardware. See voicemail processing in Canada.
  • Database (Supabase): hosted in Canada (ca-central-1, Montreal).
  • WebRTC TURN relay for video (when used): Metered.ca in Canada.
The full sub-processor list and their processing locations are in the Data Processing Agreement.

Voicemail processing in Canada

What runs in Canada, and why that matters for your most sensitive audio.

Encryption

What’s protected, where, and how.

Your role as custodian

Access, correction, and deletion as your obligation under PHIPA.