AI receptionists and privacy: what a Canadian business should ask before it signs

Why these questions are yours to ask

When a clinic's AI receptionist takes a call, it hears a name, a phone number and the reason for the visit. That information belongs to the clinic's patients, and the clinic stays responsible for it when a vendor handles it. Canada's federal privacy regulator expects that protection to be set out mainly in the contract, and its September 2026 guidance on third-party service providers says to assess a provider before signing and to confirm in the contract its responsibilities and how a breach will be managed.^[1][2]

PIPEDA is the federal private-sector privacy law. Alberta, British Columbia and Quebec have their own private-sector laws, which generally apply instead within those provinces ^[3], and Quebec's, updated by Law 25, is the most specific about service providers and automated decisions ^[4]. In Ontario, clinics and other health information custodians follow PHIPA for patients' health information, which has its own rules for the agents and service providers that handle it ^[14]. Federally, Bill C-27 and its proposed AI act ended when Parliament was prorogued in January 2025 ^[6]; Bill C-36, introduced in June 2026, was a proposal, not law, at the time of writing (November 6, 2026) ^[5]. This article is general information, not legal advice.

What information does it collect, and why?

Ask for a plain list of what the receptionist collects on each channel: names, phone numbers, messages, booking details, recordings and transcripts, and why each is needed. Privacy law expects you to collect only what you need for purposes you have identified ^[1]. If the receptionist mainly books appointments, ask whether fields you do not need can be switched off, and whether sensitive details are left for a person on your team.

Where are conversations stored, and for how long?

Ask which countries conversations are stored and processed in, including by the vendor's own technology providers. The federal regulator expects businesses to tell customers plainly when their information may be processed outside Canada ^[7], and Quebec requires an assessment before information leaves the province ^[4]. Then ask how long each type of record is kept and whether you can shorten it; information should be kept only as long as it is needed ^[1].

Who can access the conversations?

Ask who at the vendor can open your customers' conversations, for what reasons, and whether that access is logged. Ask for the list of subcontractors that touch the data, such as hosting, telephone and AI model providers, and how you will hear about changes. In Quebec, a service provider needs a written contract that protects confidentiality and limits use to the work entrusted ^[4].

Is customer data used to train AI models?

Ask directly whether your customers' conversations are used to train or improve AI models, the vendor's or anyone else's, including the AI providers it relies on. The principles for generative AI issued by Canada's federal, provincial and territorial privacy regulators call for using personal information only for appropriate, identified purposes, and not for secondary purposes unless that is required ^[8]. If any training is involved, ask what is used, whether it is de-identified first, and whether you can opt out.

How are callers told it is an AI, and that the call may be recorded?

A caller should know at the start that they are speaking with an AI and can ask for a person ^[8]. If calls are recorded, the federal regulator's guidance says to tell callers at the start and why, and, where possible, to offer another way to deal with the business if they object ^[9]. That guidance was updated in October 2026, and businesses that outsource calls must make sure their providers follow the same rules ^[10].

Ask to hear the exact opening message on each channel. In Quebec, a person must be told when a decision about them is made only by automated processing, and can present their views to someone able to review it ^[4]. A receptionist that hands sensitive questions to a person keeps those decisions with your team.

How can a person get their information, or have it deleted?

Customers can ask to see the information you hold about them and to have it corrected ^[1]. Picture a patient asking the clinic for everything recorded from their calls last month. Ask the vendor how you would find, export and delete one person's conversations, recordings and transcripts, including copies held by subcontractors.

How are breaches reported?

Under PIPEDA, a breach that creates a real risk of significant harm must be reported to the Privacy Commissioner of Canada and the people affected must be told, and every breach must be recorded and the record kept for 24 months ^[11][12][13]. Quebec also requires a register of confidentiality incidents ^[4]. Because these duties usually sit with your business, ask how quickly the vendor will tell you about an incident, what it will share, and who your contact is.

What happens to the data when the contract ends?

Ask whether you can export your conversations, contacts and bookings in a usable format, how long the vendor keeps the data afterwards, and whether it will confirm deletion in writing, including copies held by subcontractors.

How is one client's data kept separate from another's?

A vendor serving many businesses holds many sets of customer conversations. Ask how your data is kept apart from other clients', whether your receptionist answers only from the information you approved, and how vendor staff access is limited to the accounts they support.

Questions to ask before you sign

• What does the receptionist collect on each channel, and why?
• Where are conversations stored and processed, including by subcontractors?
• How long is each type of record kept, and can we shorten it?
• Who can access our data, and is that access logged?
• Are our conversations used to train AI models, yours or anyone else's?
• What does the receptionist say at the start about being an AI and about recording?
• How do we find, export and delete one person's information?
• How quickly will you tell us about a security incident?
• What happens to our data when the contract ends?
• How is our data kept separate from other clients' data?

Get the answers in writing and keep them with the contract. Junra answers these questions in writing as part of its proposal, before any commitment.