Security & compliance

Trust, held
quietly in place.

Counselling records are among the most sensitive data a person will ever share. Nimbli treats them that way — Canadian hosting, encryption everywhere, least-privilege access, and AI that never acts without a clinician's approval.

Residency

Data stays in Canada

Client records are hosted on Canadian infrastructure and never leave the country as part of normal operation.

Encryption

Protected in transit & at rest

TLS on every connection and strong encryption at rest. Telehealth sessions are encrypted end to end.

Access

Least-privilege by default

Role-based permissions, per-clinic isolation in our multi-tenant architecture, and full audit trails.

Compliance

Aligned with the
rules that matter.

Nimbli is built to Canadian privacy expectations for health information, and we support your clinic's own obligations to its clients and regulators.

  • PIPEDAAligned with federal private-sector privacy law.
  • PHIPABuilt for provincial personal-health-information standards.
  • ConsentTelehealth consent verified and recorded before every session.
  • RetentionConfigurable retention and clean data export on request.
Responsible AI

The Scribe drafts. The clinician decides.

AI Scribe never writes to a chart on its own. Every note is a draft until a clinician reads, edits, and approves it. Client data is not used to train third-party models.

  • Human-approvedNo note is saved without clinician sign-off.
  • No trainingYour clients' data is never used to train external models.
  • TransparentEvery AI-assisted action is logged and reviewable.

Operational discipline.

Security is a practice, not a badge. Here's how we keep it steady.

Backups

Encrypted, automated, and regularly tested for restore.

Monitoring

Continuous monitoring and alerting across the platform.

Access reviews

Regular reviews of who can reach what, and why.

Incident response

A defined plan and clear client notification commitments.

Due diligence welcome

Bring your security questionnaire.

We're glad to walk your team, your privacy officer, or your regulator through how Nimbli protects clinical data.