Both lists prioritized vendors headquartered in Canada. Whilst we understand the intent to support local innovation, Heidi is an Australian-founded company and therefore does not meet these particular criteria, regardless of clinical quality, usage, or compliance.

While we are disappointed international AI scribes were not included for the time being, we want to be clear: Heidi is safe, legal, secure, and already supports over 1.5 million Canadian consults every month.

We are and always have been a compliance-first company and few vendors can match our global track record on security and privacy. We’ll continue to lead and proactively work with OntarioMD and Canada Health Infoway to support inclusion as these programs evolve.

Yes. OntarioMD has confirmed that the Vendor of Record (VOR) list is optional:

“Purchasing an AI scribe using the VOR list is optional. You can still purchase solutions that are not on the VOR list.”

Source: Ontario MD Practice Hub

Thousands of clinicians across Canada continue to use Heidi with confidence. From OHTs and PCNs in Ontario, to emergency departments in Montreal, to rural teams in the Yukon, Heidi is there wherever care is delivered.

No. Heidi Health does not use any patient data, including de-identified data, for model training, secondary use, or improving its AI.

Yes. Heidi Health ensures that all data is stored and processed within Canada for our Canadian users.

If you ever decide to stop using Heidi or if we were to discontinue the product, you won’t be left stranded.

Clinicians can export their data at any time, and we’ll work with you to make sure there’s a smooth transition to another tool if needed. Your data stays accessible and under your control throughout. We also have a full Business Continuity and Disaster Recovery Plan in place to cover any unexpected disruptions, whether it's a service outage or a broader issue.

There’s no lock-in, and no impact on your clinical workflow if you move on from Heidi.

Yes. Data retention periods are determined by clinicians, with options for automatic deletion if preferred over manual deletion. When data is deleted, it is securely destroyed using secure erasure methods and is unrecoverable from our servers.

Heidi is built with security at its core. We use a range of modern tools and practices to keep your data safe, including:

We also follow a "security by design" approach, meaning security isn’t something we bolt on later. It’s built into the way we design, develop and run Heidi every day.

Yes. We run regular security and privacy assessments to make sure everything’s working the way it should and that we’re keeping your data safe.

That includes annual penetration tests conducted by independent security firms, as well as ongoing internal reviews of our infrastructure and processes. We also complete Privacy Impact Assessments and Threat Risk Assessments, especially when anything significant changes in the system.

Our compliance and security team uses real-time monitoring tools and runs regular audits to catch issues early and reduce risk. It’s all part of how we stay proactive and make sure Heidi remains safe to use in clinical settings.

These certifications aren’t just for show, they reflect how we actually run the platform from product development to data handling and incident response.

We’ve also been approved for use by major hospitals and health networks across the country, including in Ontario, British Columbia, Quebec and the Yukon.

Absolutely. Heidi’s infrastructure is built with resilience and data integrity in mind. All clinical data is automatically and continuously backed up to secure, encrypted storage within Canadian data centres. Our Disaster Recovery and Business Continuity Plan, covers everything from hardware failures to broader service disruptions as well as:

Yes. Heidi has built-in safeguards that notify users if any part of the conversation is not fully processed or transcribed, ensuring clinicians are aware of missing or incomplete data before relying on the output.