At eyre.ai, we take data privacy and compliance seriously—especially for our customers operating in Canada’s regulated environments. This article outlines how we meet the requirements of Canadian privacy legislation, including PIPEDA, provincial health privacy acts, and data residency expectations.
Compliance with Canadian Privacy Regulations
PIPEDA (Personal Information Protection and Electronic Documents Act)
Eyre.ai is fully aligned with the principles of PIPEDA, Canada’s federal private-sector privacy law. This includes:
Consent-first design for data capture and use
Clear purpose limitation and data minimization practices
Right to access and correct personal information
Strong breach notification and logging mechanisms
We also align with privacy frameworks from the Office of the Privacy Commissioner of Canada (OPC) and monitor for updates and case law impacting AI-based services.
Support for Health and Sector-Specific Regulations
Eyre.ai is used in healthcare, finance, and other regulated industries. Our Eyre Health (upcoming in September 2025) platform is HIPAA-compliant and, once adopted by specific provinces, will support compliance with regional regulations such as:
PHIPA (Ontario’s Personal Health Information Protection Act)
HIA (Alberta's Health Information Act)
BC’s FIPPA (Freedom of Information and Protection of Privacy Act)
QC Bill 64 and Law 25 for modernized privacy standards
Key features include:
Data classification tools for sensitive information
Audit trails and consent tracking
Customizable access controls by role or jurisdiction
Non-US Data Hosting and Infrastructure
We know Canadian clients often require non-US data residency and vendor independence. Here’s how we support that:
Hosting
All eyre.ai services for Canadian customers are hosted in Canada
No data is transferred to or processed in the United States by default
Data localization is enforced at the infrastructure level
No US Legal Dependencies
Eyre.ai does not rely on US-based subprocessors for core data storage, analytics, or model inference for Canadian clients
Our legal entity contracts are structured to shield data from U.S. CLOUD Act exposure
Security & Privacy-by-Design
End-to-end encryption in transit and at rest
Fine-grained access controls, with full role-based visibility
Anonymization and pseudonymization options for datasets
Data retention policies that comply with Canadian regulatory timeframes
We also perform regular privacy impact assessments (PIAs) and maintain SOC 2 Type II and ISO 27001-aligned controls.
Contracts, DPA, and Legal Protections
We offer:
Canadian Data Processing Agreements (DPAs)
Optional Business Associate Agreements (BAAs) for healthcare use
Model clauses and custom addenda to meet provincial or institutional requirements
Need Help?
If you're a Canadian business, clinic, or institution with compliance questions, contact us directly at [email protected] or reach out to your account manager.