Built for Canadian Healthcare. Protected by PIPEDA & SOC 2 Type II

Kickcall powers AI voice receptionists for healthcare organizations across Canada. Every call, booking, and patient interaction runs on secure infrastructure designed for Canadian healthcare, with PIPEDA compliance, Canadian data residency, and SOC 2 Type II controls built into the platform.

Book Free Demo

Your Healthcare Data, Hosted in Canada

For Canadian deployments, Kickcall hosts customer data on AWS Canada infrastructure, supporting data-residency expectations where they apply.

Canadian Infrastructure

Customer data for Canadian deployments is hosted on Canadian infrastructure, supporting organizations with Canadian data-residency requirements.

Secure Data Handling

Data protection controls are applied across storage, access, transmission, and other stages of the data lifecycle.

Built for Canadian Healthcare

Kickcall's security program is designed to support the privacy and security requirements relevant to Canadian healthcare organizations.

PIPEDA + SOC 2, Supporting Provincial Healthcare Law

Healthcare organizations in Canada don't operate under a single privacy law — they navigate a federal framework, provincial legislation, and, for many, US requirements too. Kickcall's compliance program is built on one audited control set that holds up across all of them.

PIPEDA Compliant

Kickcall has completed a full security audit and is compliant with the Personal Information Protection and Electronic Documents Act (PIPEDA) — Canada's federal framework governing how private-sector organizations handle personal information, including health information.

SOC 2 Type II Compliant

Kickcall is SOC 2 Type II compliant. Regardless of jurisdiction, our infrastructure and operational practices are independently audited against the SOC 2 Trust Services Criteria, giving Canadian healthcare organizations the same third-party assurance available to our US customers.

Aligned With Provincial & Territorial Health Privacy Laws

The same security controls that underpin our PIPEDA and SOC 2 compliance — encryption, access management, audit logging, and breach response — map directly onto the safeguard requirements found in provincial health privacy legislation. So when your organization asks how Kickcall supports its specific provincial requirements, the answer is the same rigorous, audited control set already in place. This means our controls are aligned with:

Alberta —

HIA & PIPA

Ontario —

PHIPA

British Columbia —

PIPA

Quebec —

Law 25

Other Provinces & Territories —

Applicable legislation

Supporting Cross-Border & US Requirements

For organizations that also serve patients in the United States or operate cross-border, Kickcall's controls are designed to be compatible with relevant US state-level health privacy laws in addition to Canadian federal and provincial requirements — so multi-jurisdictional healthcare organizations aren't forced into a fragmented compliance posture.

What Our Compliance Program Covers

From protecting sensitive information to managing access and responding to security events — here's what's included.

Encryption & Healthcare Data Protection

Voice recordings, AI conversations, account information, customer databases, backups, and stored files are all protected using:

AES-256 encryption for data at rest
TLS 1.3 encryption for data in transit
Encrypted databases, object storage, and backups

Access Controls

Only authorized personnel with an approved business reason can reach production systems.

Role-Based Access Control (RBAC)
Least-privilege access model
Multi-Factor Authentication (MFA)
Secure authentication practices
Administrative audit logging
Controlled, monitored production access

Backup, Monitoring & Incident Response

Continuous monitoring and security event logging
Encrypted backups with documented disaster recovery planning
Documented, tested security incident response procedures
Ongoing infrastructure monitoring and vulnerability management

AI Security & Customer Privacy

Customer data is used only to deliver contracted services
Your healthcare information is never used to train our AI models without your explicit authorization
Customer environments are logically separated from one another
Voice conversations are protected through encryption and access controls
Privacy-by-design principles are built into the platform from the ground up

Three Principles Behind Every Security Control

We know healthcare software moves fast. That's why our partners get speed and a team that actually answers.

Confidentiality

Sensitive information should only be accessible to authorized people and systems.

Integrity

Controls help protect information from unauthorized modification or improper access.

Availability

Security and recovery practices help support reliable access to the systems healthcare teams depend on.

Here's Why These Controls Matter to You.

Strong security goes beyond meeting requirements. It helps protect sensitive information, manage privacy risk, and give Canadian healthcare organizations confidence in the technology they rely on.