About Curio Health

What Curio does

Curio sits behind your existing Gmail and does three things:

• Encrypts every outbound message automatically, with no manual step and no toggle to remember. When your client's mail server accepts an encrypted connection, they get an ordinary email. When it doesn't, the message goes to a secure portal instead of being sent in the clear.
• Logs every send in an audit trail held in Canada.
• Leaves your inbox alone. No migration, no second inbox, no new address to give clients.

We encrypt outbound email to support the safeguards obligations you carry under PHIPA in Ontario, PIPA in Alberta and British Columbia, and PIPEDA federally. Each words its safeguards duty differently: PHIPA s.12(1) asks for steps that are reasonable in the circumstances, both PIPAs ask for reasonable security arrangements, and PIPEDA Principle 7 asks for safeguards appropriate to the sensitivity of the information. None of them lists encryption as a requirement: PHIPA and both PIPAs don't mention it, and PIPEDA names it only as an example of a technological safeguard. Some privacy commissioners go further in their guidance. Ontario's, in its fact sheet on emailing health information, says you should encrypt email with clients where you can.

Who Curio is for

Mental health therapists in private practice in Canada who keep client communication in Gmail. Most are solo or in small group practice: registered psychotherapists, psychologists, counselling therapists and social workers.

Curio isn't a practice management system, an electronic medical record, or a clinical documentation tool. It handles email, and once it's on, it's built to be invisible to you.

Where your information is held

Your audit trail, our database and encrypted portal messages are stored on Google Cloud in Montreal, in the northamerica-northeast1 region. The gateway that checks and routes each send runs on AWS in Montreal, and Amazon SES in Montreal delivers it. Cloudflare sits in front of our app and handles each request at whichever of its locations is closest to you. That's normally a Canadian location, but we can't promise it always is.

Your Gmail mailbox is a separate matter. It stays with Google under your own Google Workspace agreement. Google stores that content on its own servers, and they aren't all in Canada. We'd rather say so plainly than call the whole arrangement Canadian.

Every provider that can touch information you entrust to Curio is listed on our subprocessors page, along with what each one does and where it operates.

Curio Health is Canadian

Other organizations use the Curio name in other markets and in other parts of health technology. We're not affiliated with any of them, and none of them runs this service.

If you're looking for the Curio Health that encrypts Gmail for Canadian therapists and logs every send in Montreal, you're in the right place.

Who operates Curio

Curio is operated by Gabriel Borges, a sole proprietor, and the full operator details are set out in our terms of service. We research every compliance piece on this site against the published statutes, regulations and college standards it names, and each piece cites its sources.

More detail

• Privacy policy: what personal information we handle, and why
• Subprocessors: every provider we rely on and what it can access
• Contact: reach the person who answers