Where is your parent's data stored? Canadian vs US-hosted senior monitoring

Does Canadian law require the data to stay in Canada?

For most families buying from a private company, no.

PIPEDA: allowed, with conditions

The federal Personal Information Protection and Electronic Documents Act (PIPEDA) applies to private companies across Canada, with one carve-out: "Unless the personal information crosses provincial or national borders, PIPEDA does not apply to organizations that operate entirely within: Alberta, British Columbia, Quebec", which have substantially similar laws of their own (OPC, current 2026).

PIPEDA does not prohibit sending personal information abroad. The Office of the Privacy Commissioner (OPC) treats a transfer for processing as a "use", not a disclosure, so no extra consent is needed if the purpose does not change. But the company stays accountable. It must "use contractual or other means to provide a comparable level of protection while the information is being processed by the third party", and tell you the data "may be accessed by the courts, law enforcement and national security authorities" there. Two caveats in the same guideline matter: "comparable" is not identical, only protection "that can be compared to" what the information would get at home, and no contract can override foreign law (OPC, 2009). In 2019 the OPC kept "the status quo until the law is changed" (OPC, 2019).

Provinces with their own rules

• Quebec. Section 17 of the private-sector Act (CQLR c. P-39.1) requires a privacy impact assessment before personal information is communicated outside Quebec, and a written agreement with the recipient (BLG, 7 May 2024). That is a law-firm summary; we could not load the statute itself.
• Alberta. A business using a service provider outside Canada must tell you how to get its policies, which must name the country and the purposes (Alberta.ca, current 2026; PIPA, SA 2003 c P-6.5, s. 13.1, added 2009 c50 s7).
• British Columbia. BC's own Personal Information Protection Act governs private companies operating entirely within the province (OPC, current 2026). BC's separate public-body law dropped its keep-it-in-Canada rule in November 2021; public bodies now need a privacy impact assessment before storing sensitive information outside Canada (Province of BC, 2021, updated 2025). That public-body rule does not bind a vendor selling to your family.

Ontario PHIPA: we found no geography rule, and the custodian stays responsible

You may see marketing that says Ontario's Personal Health Information Protection Act requires health data to stay in Canada. We found no such rule. PHIPA works through accountability: a long-term care home is a "health information custodian", a company it hires is an "agent", and the custodian "remains responsible for the personal health information collected, used, disclosed, retained or disposed of by an agent" (IPC Ontario presentation, 2016). That source is an IPC slide deck predating the 2020 PHIPA amendments, hosted on a third-party site, and the official e-Laws text is not machine-readable to us. Confirm before relying on it.

For operators: put PHIPA accountability for agents to privacy counsel before signing a US-hosted contract.

The federal government's own standard

Ottawa holds itself to a stricter rule than it sets for private companies: "Protected B, Protected C and classified Government of Canada electronic data must be stored on approved servers in Canada" or on government premises abroad (OPC Privacy Act bulletin, 27 June 2019).

Is "hosted in Canada" the same as "out of US reach"?

No, and this is the point most product pages skip. In March 2018 the United States passed the CLOUD Act. Covered providers must "preserve, backup, or disclose" records "within such provider's possession, custody, or control, regardless of whether such communication, record or other information is located within or outside of the United States" (18 U.S.C. s. 2713; Barry Appleton, "Whose Law Governs Canadian Data?", Balsillie Papers Special Report, 11 March 2026).

Two limits matter. Scope: the Act reaches providers of an electronic communication service (18 U.S.C. s. 2510(15)) or a remote computing service (18 U.S.C. s. 2711(2)), which the report describes as covering "cloud storage, data processing, and software-as-a-service providers". Whether a radar sensor vendor or a monitoring centre is either is not obvious; ask. Process: the Act "does not itself confer jurisdiction"; it works through US legal process once a US court finds jurisdiction.

Ottawa makes the same point. Its white paper defines residency as the "physical or geographical location" of data and sovereignty as the right to control access "subject only to Canadian laws", then warns: "As long as a CSP that operates in Canada is subject to the laws of a foreign country, Canada will not have full sovereignty over its data" (a CSP is a cloud service provider) (GC White Paper, 2018, updated 2026). In July 2025 CBC/Radio-Canada reported that millions of Canadians' medical records sit on US-owned cloud servers, reachable under the CLOUD Act even when stored here (Radio-Canada/CBC, 2025).

What actually limits access

Three things do more work than a postal code. Who controls the company: a Canadian-owned company with no US operations is harder to compel directly than a US cloud provider's Canadian region, though treaties still allow requests through Canadian courts. Who holds the keys: among the mitigations for CLOUD Act risk, Osler lists encryption at rest, in transit and in use, with organizations managing "their own encryption keys (customer-managed keys)" where possible (Osler, October 2025). How little is collected: "no movement in the bedroom since 02:10" is a much smaller thing to protect than video, audio or GPS.

For balance, a 2020 essay by a public servant in government technology calls data residency "security theatre" that "gives the impression of making things secure" (Sean Boots, 2020; the views are the author's alone).

Five questions to ask any monitoring vendor

1. In which country is my data stored, and who owns the company that stores it? "Secure cloud servers" tells you nothing.
2. What exactly leaves the house? Video, audio, location, or activity signals? For a pendant, ask how long call recordings are kept.
3. Can staff outside Canada see it, and why? Many policies allow access from abroad for support.
4. Who holds the encryption keys? If the cloud provider holds them, it can be compelled to decrypt.
5. How long is it kept, and how do I have it deleted?

How do monitoring vendors answer today?

These are each vendor's own words, with the date checked. We assert none of them as fact.

Sold in Canada

• Lifeline Canada: "Personal Data may be collected, accessed or transferred outside of Canada ... including in the United States or the Philippines in some circumstances" (Lifeline, August 2025).
• TELUS Health: "Your Personal Information, including your Medical Record, is stored in Canada and may be accessed from outside Canada in limited circumstances." Service providers "may access or store Personal Information, including Personal Health Information, however, excluding your Medical Record, in the United States or other jurisdictions" — the examples given are a "marketing/communications platform provider and analytics platform provider" (TELUS Health, effective 13 October 2023). That page covers Care Centres, not the medical alert service.
• Holo Alert: the homepage says "Canadian-owned and operated," with "Canadian monitoring centres". The privacy policy says systems and service providers "store and process personal information in Canada and the United States", and that abroad it "may be accessible to that country's courts and authorities under its laws" (Holo Alert, updated 2 September 2026).
• Aqara Presence Sensor FP2: "Automations of FP2 are executed without sending to the cloud, and they will keep working even in case of no internet connection" (Aqara, checked September 2026). The policy at aqara.com/en/privacy-policy is a website-visitor policy for Lumi United Technology, not an FP2 or app policy; we could not locate the device policy or confirm Canadian retail availability.
• Nomo Smart Care: "No cameras 100% privacy" (Nomo). Its policy does not say where data is stored, only that information "may be sent electronically to servers outside of the country where you originally entered the information". It is written to US law: it sets out California CCPA rights and never mentions Canada or PIPEDA (policy, September 2026).
• WalledCare: we say "Sensing happens on the device; only activity signals and alerts leave the home — and they stay on Canadian infrastructure" (WalledCare, checked September 2026). Treat that as a claim, like the others: who owns that infrastructure and who holds the encryption keys is not published anywhere on our site. Put question 1 and question 4 above to us in writing, exactly as you would to any vendor on this page.

Not sold directly to Canadian families

• Xandar Kardian sells to hospitals, long-term care and home-health providers, not families. It is "headquartered in Toronto, Canada" with its radar lab in Seoul (About); its policy says servers "may be located anywhere in the world (including the United States)" (policy, 2018).
• Vayyar Care: the cited consumer page is headed "Vayyar Care: Fall Detection Exclusively with Alexa Together" and links only to amazon.com — no Canadian ordering path and no data-location statement (Vayyar, checked September 2026). We could not confirm the status of Alexa Together.
• envoyatHome is "sold directly to families across the United States", with no data-location statement (envoyatHome, checked September 2026).

None of this makes one vendor "safe" and another "unsafe". Lifeline offers two-way voice and a monitoring centre; a room sensor does not. For dementia wandering, or a parent who needs to talk to someone, a pendant may be the better fit wherever the data lives.