Your Gmail.
Secure for Canadian mental health privacy law.

No, in most cases. When their mail server accepts an encrypted connection, the email arrives directly in their inbox, with nothing to install, just like a regular email. When it won't, the message goes to a secure portal instead of being sent in the clear.

No. Curio wraps encryption and a Canadian audit trail around your existing Google Workspace. You keep using Gmail exactly as you do now, with the same inbox, the same address, and the same contacts.

Curio encrypts every email you send and logs it in a Canadian audit trail. It's built around the law you actually answer to: PHIPA in Ontario, PIPA in Alberta and British Columbia, and PIPEDA federally. If a regulator asks what protected your client email, the record already exists: every send, logged in Canada.

Your audit trail and encrypted portal messages live on Canadian servers in Montreal, on Google Cloud (region northamerica-northeast1). The gateway that checks and routes your email runs on AWS in Montreal and handles mail in transit only. Amazon SES in Montreal delivers it, with TLS required. What we can't move: Gmail still stores your mail, sent copies included, on Google's servers outside Canada.

With Hushmail, secure messages live in a separate Hushmail inbox. That's true even if you keep Gmail for everything else. By default, you also click a toggle to encrypt each one. With Curio you stay in Gmail, and every message you send is encrypted and logged automatically. Hushmail says that data stays in Canada. We can't say that about message content, because Gmail stores your email on Google's servers outside Canada. What you get instead: your own address, your own inbox, and an audit trail in Montreal.

Paubox says it keeps your Gmail and sends a secure link when a recipient's server can't take TLS, much as we do. It's built for HIPAA, the US law. Its security documentation describes AWS hosting and doesn't mention Canadian data residency, a Canadian privacy law, or a Canadian region. What we add is the Canadian part: your provincial statute, and an audit trail in Montreal.

In Ontario, Alberta and British Columbia, the law puts a safeguards duty on you, and it covers email that carries client health information. The wording differs: PHIPA s.12(1) asks for steps that are reasonable in the circumstances, and PIPA in Alberta and BC asks for reasonable security arrangements. None of these laws names encryption. Each asks for appropriate safeguards, and the College of Registered Psychotherapists of Ontario (CRPO) names encryption among the safeguards for personal health information in Standard 5.6.

Enforcement has started. Ontario's Information and Privacy Commissioner (IPC) issued its first PHIPA administrative monetary penalties in August 2025. A PHIPA conviction can bring a fine of up to $200,000 for an individual or $1,000,000 for an organization (section 72(2)). In Alberta, PIPA requires you to notify the province's Information and Privacy Commissioner when a breach creates a real risk of significant harm. In BC, the province's own Information and Privacy Commissioner can order compliance and pass evidence of an offence to the Attorney General.

Yes, for the therapists. Each one signs up on their own and gets their own encryption and audit trail. In your Google Admin console, you route your therapists' organizational unit to Curio once, and everyone in it is covered. Mailboxes outside it, like reception or billing, stay as they are.

No setup fees and no minimum term. The Standard plan is $15 per month per therapist. Cancel anytime.

Curio currently serves therapists in every province and territory except Quebec. Quebec support is on the roadmap while we complete our Law 25 work.

Sign up at app.curio.health with the Google Workspace account you already use for client email. Then add the DNS records Curio lists with your domain provider. Once they verify, route your therapists' organizational unit to Curio and send a test email. If someone else manages your Workspace, they can do these steps for you. It's a one time setup. From your next send, every email you send is encrypted and logged in Canada.