What data security and compliance measures does Colib offer?

Who is this article for?

This article is for clinic owners, privacy officers and anyone who needs to describe how client information is protected in Colib, for example for a professional order, an insurer or a client. Colib's security features protect your data at every level and help your practice meet its PHIPA, PIPEDA, LPRPSP, HIA, PIPA and Law 25 (Quebec) obligations.

Colib is compliant with PIPEDA (Personal Information Protection and Electronic Documents Act), specifically in regard to the protection of Personal Health Information (PHI). In other words, we have implemented a series of technical and human security protocols, described below. The complete, up-to-date list is on our Security page (www.colib.io/security).

Hosting and encryption

• All data hosted in Canada — databases, files and backups are stored exclusively in Canada, in the AWS Canada (Montréal) region.
• Encryption of our servers — data is encrypted at rest on our servers, and the most sensitive information is encrypted again, field by field, with AES-256.
• Website encryption — every exchange between your device and Colib is encrypted (TLS 1.2 or 1.3 only). Personal health information is protected by each user's own sign-in, and it is decrypted only when an authorized user opens a page.
• Encrypted documents — files added to a client record are encrypted before being stored in private storage, and every uploaded file is checked for malware before it is saved.
• Daily backups — your data is backed up every day, in Canada.
• No card numbers stored — card numbers go directly to our PCI DSS-certified payment partner. Colib keeps only a token, the last four digits, the expiry date and the card's country.

Access to your accounts

• Individual accounts and access rights — every administrator and practitioner signs in with their own account. Administrators decide, member by member, what each person can see and modify. See What are the different levels of rights/options for the members of my practice?
• Strong passwords — passwords must be 12 to 80 characters long and combine uppercase letters, lowercase letters, digits and a special character. Passwords known to have leaked are refused, and the last five passwords of an account cannot be reused.
• Two-factor authentication — practitioners, staff and clients can require a code sent by email or text message at each sign-in. It is mandatory for clinics located in Quebec. See How to configure the 2-factor authentication (2FA).
• Sign-in monitoring — an account is temporarily locked after repeated failed attempts, and the account holder receives an email when their account is used from an unknown device. Please see the article titled "My account is locked after several sign-in attempts: what should I do?" and the article titled "I received a "new sign-in from an unknown device" email: what should I do?".
• Known devices — to tell a familiar sign-in from an unusual one, Colib keeps the devices and the addresses used by each account. The address is stored encrypted, never in clear text. A device is forgotten after one year without use, and everything is erased when the account is deleted.
• IP restriction — on the Practice Pro plan, you can limit chosen team members to your clinic's internet connections. Please see the article titled "How to restrict access to Colib to specific IP addresses".
• Automatic sign-out — each clinic chooses after how long without activity its users are signed out. Please see the article titled "How to set automatic sign-out after a period of inactivity".
• Access review — in Settings > Team (www.colib.io/settings?show=team), you see the last sign-in of every member, accounts without a sign-in for 90 days are flagged so that you can revoke them, and the list can be exported to Excel.

Protection of the platform

• Attack protection — Colib has several layers of protection against common web attacks, and every connection to Colib is forced to use HTTPS.
• Secure development — the software components Colib relies on are checked against known vulnerabilities.

Traceability

• User access logs — every time a team member views, creates, modifies, deletes or downloads client information, an entry is recorded with the date, the user, the device and the IP address. A second log records what clients do in their client portal. The administrators of each clinic, and the members they authorize, can consult and export these logs at any time. See How to access the activity log.
• Colib's interventions are logged too — when our support team works in your clinic, its actions appear in your log under its own name.
• Security alerts — security events are reviewed every day by Colib's security officer, and the alerts concerning your clinic are listed in Settings > Security. Please see the article titled "What are my clinic's security alerts?".
• Transparency for your clients — in the client portal, each client sees their own access log and can download all their data in a single archive.
• Consent register — consents given by your clients are recorded with the exact text shown, its version and the date, and are visible in the client record. See How to record and track client consents in Colib.

Our organization

• Annual employee training — we conduct annual training sessions for all company employees.
• Clear incident handling procedures — we have clear procedures in place to handle and report any suspicious or doubtful situation to our Chief Privacy Officer.
• Independent penetration tests — certified external security firms test our platform at least once a year.
• Privacy Officer — Colib has a person in charge of the protection of personal information. Their contact details are in our privacy policy (www.colib.io/privacypolicy).

Artificial intelligence under control

The AI features (transcription of telehealth sessions, note drafts, rewriting assistant, form extraction, voice dictation) are turned on by the clinic and triggered by the practitioner, and every AI draft must be reviewed by the practitioner. Your information is always stored in Canada. Transcription runs in Canada, while the generation of note drafts, rewriting suggestions and form extractions may be processed in memory in Canada or in the United States, for the few seconds of the request, with nothing stored, logged or kept there and nothing used to train AI models. Details: www.colib.io/aipolicy.

• Models used — the transcription of telehealth sessions runs on a model hosted inside Colib's own AWS infrastructure in Canada. Note drafts are produced through the Amazon Bedrock managed service, with the Claude Sonnet 4.6 model for every clinic.
• The model is named on each draft — every draft carries the name of the model that wrote it.
• Consent in Quebec — in Quebec, when an AI-assisted note is planned, the client must tick a consent box before joining the telehealth session: without that consent, the session cannot be joined. Please see the article titled "How client consent to AI note-taking is collected and what happens if it is withdrawn".
• Each feature can be turned on or off — each clinic can turn the AI features on or off in its settings, for example the rewriting assistant, form extraction and voice dictation. Please see the article titled "How to turn artificial intelligence features on or off for your clinic".
• Central suspension — Colib can suspend any AI feature centrally.

Note about HIPAA compliance

While Colib is a Canadian-based platform and not directly subject to HIPAA (the U.S. Health Insurance Portability and Accountability Act), we have implemented technical and organizational safeguards that align with key HIPAA requirements. These include:

• Breach notification procedures — we have internal protocols in place for detecting, documenting and reporting any unauthorized access to personal data, following processes similar to HIPAA breach notification requirements.
• User access logs — Colib maintains detailed access logs for practitioner accounts, ensuring traceability of data access and activity within the platform. These logs are accessible at any time by the administrators of each clinic.
• Contingency and incident response plans — we have well-defined incident response and business continuity plans, including clear escalation protocols and the involvement of our Chief Privacy Officer.
• Data security by design — encryption, secure authentication and privacy controls are implemented at every level of the platform, from data hosting in Canada to practitioner access.

While HIPAA certification is not formally issued by any governing body, Colib follows best practices consistent with HIPAA standards and remains committed to supporting U.S.-based practitioners who require HIPAA-aligned safeguards.

Breach notification procedures

Colib has established internal protocols to detect, assess and respond to any unauthorized access to Personal Health Information (PHI) or other sensitive data. These procedures include:

Accessibility

Colib aims for level AA of the WCAG 2.2 accessibility guidelines. Read our accessibility statement: www.colib.io/accessibility.

Service availability and status page

• Status page — the current state of the Colib service is shown on our public status page: app.pulsetic.com/status/Sfv76lJ5. It is also linked as Status Page at the bottom of every page of our website. Check it first if Colib seems slow or unavailable. To be informed by email in case of an outage, click Manage subscription on the status page and subscribe.
• Availability — as stated in our terms of use (www.colib.io/terms), Colib takes commercially reasonable measures to keep the platform available (cloud hosting in Canada, daily backups) and carries out maintenance so as to minimize its impact.
• Incidents involving personal information — they follow the breach notification procedure described above: when an incident presents a risk of serious injury, the clinics and the people concerned are notified.

Your data when you stop using Colib

As described in the Retention and destruction section of our privacy policy (www.colib.io/privacypolicy):

• A clinic that has held a paid subscription and stops using Colib keeps its data until it asks us to delete its account. The account and all its data are then permanently deleted.
• A clinic that has never subscribed to a paid plan, and in which nobody has signed in for 18 months, receives a warning email; its account and all its data are then permanently deleted.
• Clinical notes, invoices, documents and completed forms are never purged automatically: they stay in the record as long as the clinic keeps it.

Before you leave, export what you need to keep: please see the article titled "How do I cancel my subscription or close my Colib account?" and How to export my client data. These exports are self-serve: you run them yourself, at any time, directly in Colib, without having to ask our team.

How client portal access is protected

• Each client sees only their own information — their appointments, the forms sent to them, their invoices, and only the notes and documents you choose to share with them. See Who can access the client portal?
• Confirmed email address — the invoices of a client are shown in the portal only once their email address is confirmed.
• Two-factor authentication — clients can also be asked for a code sent by email or text message at each sign-in (mandatory in Quebec).
• Withhold access — you can temporarily withhold a client's access to their record, with a documented reason and an end date. Please see the article titled "How to temporarily withhold a client's access to their record".
• Traceability — what clients do in the portal is recorded in the client portal log of your audit log, and each client can see their own access log.

Safeguards against scheduling and billing errors

• Online booking — your booking page only offers the time slots that are free according to your availability, and with the two-way calendar sync, your personal events block the matching slots. See How to sync your Colib scheduler with Google Calendar or Outlook (two-way sync).
• Appointments without an invoice — Colib can notify you when an appointment still has no invoice. See How to get notified when an appointment has no invoice attached.
• Rights of each team member — each person only sees and changes what their access levels allow (appointments, client information, notes, documents, financial information). See What are the different levels of rights/options for the members of my practice?
• Every change is traced — the changes and deletions of appointments and invoices are recorded in the activity log. See How to access the activity log (audit log).

Need a confidentiality agreement?

If your organization needs a confidentiality agreement or a data processing agreement with Colib, or must complete a security questionnaire, write to us at support@colib.io with your clinic's name and the document you need. Our public Security page, privacy policy and artificial intelligence policy (www.colib.io/security, www.colib.io/privacypolicy, www.colib.io/aipolicy) already answer most questions.

Good to know

• Compliance is shared — Colib gives you the tools, but compliance also depends on your own policies and practices.
• Laws and documents — see Are you compliant with Canadian privacy laws?
• More about compliance — you will find more information here: Privacy: PIPEDA Compliance for Clinics in Canada.

Still have a question?

Write to us at support@colib.io, we will be happy to help.