Start with who is responsible

Most guides to AI therapy note takers are written for American clinicians and centre on HIPAA. If you practise in Canada, your starting questions differ. This article is general information, not legal advice; your provincial privacy law and your regulatory college are the authorities.

Provincial rules differ. In Ontario, the Personal Health Information Protection Act (PHIPA) sets duties for health information custodians, and the Information and Privacy Commissioner (IPC) says those duties continue to apply when a custodian uses an AI scribe. In Alberta, the Health Information Act (HIA) governs custodians, and the Commissioner's office expects a privacy impact assessment before a new system that handles identifying health information. In British Columbia, the Personal Information Protection Act (PIPA) covers many health providers running their own practices, and the Commissioner's office has issued AI scribe guidance for them. Whether you are a custodian or a PIPA organization depends on your profession and setting, so confirm it for yourself.

A common thread in this guidance is that the clinician stays responsible for the information even when a vendor handles it. BC's guidance says an organization cannot avoid its PIPA obligations by contracting with another organization to store or use personal information on its behalf.

Questions to ask any cloud vendor

  • Where are the servers, and is session data processed outside Canada?
  • Which other companies receive the audio or transcript (transcription or language-model providers)?
  • What is kept after the note is approved: audio, transcript, de-identified copies?
  • Is session data used to improve the product, by default or by opt-in?
  • What happens if a court, regulator or client requests the record, and will you be told?
  • How do you delete data, and can you show it was deleted?
  • What is the breach notification process?

Some vendors publish answers. Mentalyc's privacy policy, for example, lists PHIPA among the privacy laws it says it complies with; that is the vendor's own statement and not independent verification. Read such answers against your own situation and keep a copy.

What local processing changes

Astralcyte Notes transcribes and drafts on your own computer. No vendor receives the session. In practice:

  • Several questions above do not arise, because no vendor holds the audio, transcript or draft: no sub-processors, no cross-border transfer by the app, and no vendor-side retention setting.
  • The temporary audio is destroyed once the transcript is saved, and the transcript and notes sit in an encrypted vault on your device.
  • Requests for the record go to you, because you hold it.

What it does not change

  • You are still responsible for the record. Client consent, the content and retention of the clinical record, access and correction requests, and your college's documentation standards remain yours. Ontario's IPC and the BC and Alberta Commissioners' offices all expect consent or notice considerations for recording with AI scribes, and Alberta's guidance treats recording as something to justify, so check your own rules.
  • Security of the computer is now your responsibility: a strong passphrase, a stored recovery key, device encryption and backups. If you lose both the passphrase and the recovery key, the vault cannot be opened.
  • Astralcyte Notes is designed for PHIPA and other provincial privacy rules: nothing from the session leaves your device, and you control consent and the final record. Check your profession on our practice page.
  • A draft is not a note until you have read, corrected and approved it.

Practical checklist

  1. Read your college's guidance on AI and recording of sessions.
  2. Obtain and record the client's informed consent to recording, or use dictation after the session if you prefer not to record.
  3. Decide how long you keep transcripts. Many clinicians keep the approved note only.
  4. Turn on full-disk encryption and store the recovery key away from the computer.
  5. Write one paragraph in your privacy policy describing the tool and where data stays.

Price in context

Prices checked on 2026-10-16, in US dollars. Mentalyc's solo plans run from $14.99 a month billed annually ($19.99 monthly) for 40 notes up to $99.99 a month for 330 notes. Upheal lists AI Notes at $39 a month with unlimited notes. Astralcyte is $20 CAD a month per device, or a $600 CAD one-device perpetual licence that includes updates published in its first year. It has no EHR integration, so you paste the approved note into your own record, and it needs a reasonably capable computer.

Sources