generated: '2026-07-19'
method: searched
source: https://www.klarify.ca/legal/privacy-policy
note: >-
  Klarify publishes no public developer API and no OpenAPI, so no spec-derived
  protocol conformance (oauth2, oidc, rfc9457, json:api, pagination, idempotency)
  can be asserted. The standards below are healthcare/privacy regimes the company
  states it complies with on its own public pages. These are self-asserted
  compliance claims, not third-party audited certifications; no SOC 2, ISO 27001,
  HITRUST, or FedRAMP attestation is published.
standards:
- id: hipaa
  name: Health Insurance Portability and Accountability Act (US)
  conforms: true
  attestation: self-asserted
  evidence: Compliance stated on klarify.ca homepage and privacy policy; product
    handles US protected health information.
- id: pipeda
  name: Personal Information Protection and Electronic Documents Act (Canada)
  conforms: true
  attestation: self-asserted
  evidence: Compliance stated on klarify.ca homepage and privacy policy; permanent
    records stored in AWS Canada (Montreal).
- id: phipa
  name: Personal Health Information Protection Act (Ontario)
  conforms: true
  attestation: self-asserted
  evidence: Compliance stated on klarify.ca homepage and privacy policy page metadata.
- id: uk-gdpr
  name: UK General Data Protection Regulation
  conforms: true
  attestation: self-asserted
  evidence: Privacy policy states UK GDPR compliance where applicable and names
    DataRep as UK representative (datarequest@datarep.com).
- id: soc2
  name: SOC 2
  conforms: false
  evidence: No SOC 2 report or trust center found; probe-security-programs.py
    returned trust=none.
- id: iso-27001
  name: ISO/IEC 27001
  conforms: false
  evidence: Not mentioned in privacy policy, help center, or any public page.
data_handling:
  audio_retention: Session audio automatically deleted after 14 days.
  data_residency: Permanent records (transcripts, notes, treatment plans) stored in
    Canada.
  model_training: Company states session data is never used to train AI models, never
    sold, and never licensed.
  ai_processing: AWS Bedrock (Canada/US/EU depending on user setting).
subprocessors_disclosed:
- AWS (Canada/Montreal) — storage
- AWS Bedrock — AI processing
- AssemblyAI — audio transcription
- Clerk — authentication
- Stripe — payments
- Vercel — hosting
- Datadog — observability
- Upstash — data infrastructure
- Google Analytics — analytics
dpa: Available on request via info@klarify.ca
privacy_contact: alexander@klarify.ca