A person approves every action
Allayr classifies, prioritizes and suggests. It does not send, file, reply or escalate on its own. There is no autonomous mode, and no setting that turns one on.
What we can prove, and what we’re still working on.
Allayr is pre-launch. Rather than a page of badges, here’s a plain account of how the system is built today and where the compliance work actually stands.
True today
Patient data stays in Canada
The application and its database run in AWS ca-central-1. Patient data is not replicated to regions outside Canada.
Every action is recorded
Access and decisions are written to an append-only audit trail. Records are corrected by adding entries, never by overwriting or hard-deleting history.
Clinics are isolated from each other
Access is enforced at the database level with row-level security, so a query can only ever return rows belonging to the clinic that asked.
Allayr makes no clinical judgements
It sorts and routes messages. It does not diagnose, advise on care, or perform clinical triage, and it is not a licensed medical device.
Where PHIPA and PIPEDA stand
We do not describe Allayr as PHIPA or PIPEDA compliant. Formal compliance review is an active track and it is not finished. Saying otherwise would be the kind of claim this page exists to avoid.
What that means in practice, honestly stated:
- The architecture was built around Canadian privacy expectations from the start — Canadian data residency, least-privilege access, and an audit trail — rather than being adapted from a US-first product.
- The formal review, documentation and any third-party assessment that would let us make a compliance statement are still ahead of us.
- Until that work is done and verified, we’ll describe the design and leave the certification language alone.
If your clinic needs specifics for a privacy assessment, ask us directly athello@allayr.com. We would rather answer a hard question than have you infer an answer from a marketing page.
Reporting a vulnerability
Found something? Email security@allayr.com with enough detail to reproduce it. We’ll confirm receipt and keep you posted on the fix. We won’t pursue legal action against good-faith research that avoids privacy violations and service disruption.
Questions we haven’t answered here?
Leave your email and tell us you’re evaluating Allayr. We’ll answer directly — including the parts that aren’t finished yet.