Personal Information Protection Policy
Centre dentaire Vadeboncoeur holds personal information, including health information, about its patients, its employees, its job applicants and its suppliers. This policy describes how that information is collected, used, disclosed, retained and protected, and how each person can exercise their rights.
1. Purpose, scope and legal framework
The policy applies to all personal information the clinic holds, whatever its medium (paper, digital, imaging, recording), and to everyone who has access to it: dentists, hygienists, dental assistants, administrative staff, locums, students on placement and suppliers.
It complements the Privacy Policy of the monsourire.com website, which covers only browsing and web forms.
Legal framework
The clinic is subject in particular to:
- the Act respecting the protection of personal information in the private sector, as amended by Law 25;
- the Professional Code and the regulations of the Ordre des dentistes du Québec applicable to the keeping of records and of dental offices;
- the professional secrecy to which dentists are bound.
Definitions
Personal information is information that concerns a natural person and allows that person to be identified, directly or indirectly.
Sensitive information is information that, by its nature or because of the context of its use, gives rise to a high reasonable expectation of privacy. The health information contained in a dental record is sensitive.
A confidentiality incident is unauthorized access to, use of or disclosure of personal information, the loss of such information, or any other breach of its protection.
2. Person responsible for the protection of personal information
The clinic has designated a person responsible for the protection of personal information, whose role is to oversee the application of this policy.
Dr. Hugo Vadeboncoeur
Centre dentaire Vadeboncoeur
195 rue de l’Atmosphère, Suite 200
Gatineau, Quebec J9A 0A3
Telephone: 819 770-9000
Email: [email protected]
Their duties include:
- handling requests for access, correction and withdrawal of consent;
- approving the policies and practices governing the management of personal information;
- maintaining the register of confidentiality incidents and coordinating the response to an incident;
- taking part in privacy impact assessments;
- receiving complaints and responding to them;
- overseeing staff training and awareness.
3. Information held and purposes
The clinic collects only the information necessary for the purposes determined below, and determines those purposes before collection.
| Person concerned | Information held | Purposes |
|---|---|---|
| Patients | Identification and contact information; date of birth; health insurance number; dental insurance information; medical and medication history; dental record, clinical notes, treatment plans; X-rays and clinical photographs; consents to care; billing and payment information | Providing dental care; keeping the record required by professional regulations; scheduling appointments and sending reminders; billing and collection; processing insurance claims; meeting legal and ethical obligations |
| Parents or tutors of a minor patient | Identification, contact information, relationship to the patient, consent to care | Obtaining the required consents and communicating about care |
| Job applicants | First name, last name, contact information, résumé, education, experience, professional licence number, references | Assessing the application and communicating with the person |
| Employees and contractors | Identification and contact information; social insurance number; banking information for payroll; employment file; professional certifications; required vaccination and training | Managing the employment relationship, payroll and benefits; meeting legal and tax obligations |
| Suppliers and partners | Business contact information, contractual and billing information | Managing the business relationship |
No information is used for a new purpose without the person concerned being informed and, where the law requires it, consenting to it.
The clinic does not sell, rent or trade any personal information.
4. Consent
Consent must be clear, free and informed, and must be given for specific purposes. It is valid for the time necessary to achieve those purposes.
At the time of collection, the clinic informs the person of the purposes pursued, the means of collection, the rights of access and correction, and their right to withdraw consent.
Sensitive information
Because health information is sensitive, its collection, use or disclosure requires express consent, given separately from any other consent.
Minors
Information concerning a minor under 14 years of age is collected only with the consent of the person having parental authority or of the tutor, except where the collection is clearly for the minor’s benefit. A minor 14 years of age or over may consent alone to the care required by their condition and to the information relating to it, within the limits provided by law.
Exceptions
In certain cases, the law permits information to be collected or disclosed without consent: an emergency threatening a person’s life or health, a court order, a request from a body with the power to compel, or an investigation by the Ordre des dentistes du Québec.
Withdrawal
A person may withdraw their consent at any time, free of charge, by writing to the person responsible. The withdrawal applies going forward. Certain information must nonetheless be kept where the law or professional obligations require it, in particular the dental record.
5. Internal access and disclosure to third parties
Internally
Access is granted on a need-to-know basis: only those whose duties require it have access to information, and only to the part that is necessary. Every member of staff signs a confidentiality undertaking that survives the end of their employment.
Disclosure to third parties
| Recipient | Information disclosed | Basis |
|---|---|---|
| Dental laboratories | Prescriptions, impressions, data needed for fabrication | Delivery of care |
| Dental specialists and other health professionals | Clinical information relevant to the referral | Patient consent |
| Insurers and plan administrators, including the Canadian Dental Care Plan | Information needed to process the claim | Patient consent |
| RAMQ | Information required for covered services | Legal obligation |
| Service providers (practice management software, cloud services, IT support, document destruction) | Access limited to the mandate entrusted | Written agreement containing confidentiality and security clauses |
| Ordre des dentistes du Québec, courts, competent authorities | As requested | Legal obligation |
Disclosure outside Quebec
Before disclosing personal information outside Quebec, the clinic carries out a privacy impact assessment in order to determine whether the information will receive adequate protection there. The disclosure is governed by a written agreement. The assessment is documented and retained.
6. Retention and destruction
Information is kept for as long as necessary for the purposes for which it was collected, then destroyed or anonymized.
| Category | Retention period |
|---|---|
| Patient dental record | Five years from the last entry in the record, in accordance with the regulations applicable to dentists in Quebec; the clinic applies a longer period where the circumstances warrant it, in particular for a minor patient or a treatment that could give rise to a claim |
| X-rays and imaging | The same period as the record to which they belong |
| Billing documents and accounting records | Six years after the end of the fiscal year concerned |
| Employee file | Five years after the end of employment; payroll records follow the applicable tax deadlines |
| Unsuccessful application | 12 months, unless immediate destruction is requested |
| Administrative correspondence with no follow-up | 12 months |
| Register of confidentiality incidents | Five years after the date of the incident |
Destruction is carried out securely: shredding of paper documents, secure erasure or physical destruction of digital media. The destruction provider is bound by a confidentiality agreement and provides a certificate.
The person responsible maintains a retention schedule and reviews its application annually.
7. Security measures
The measures are proportionate to the sensitivity of the information, its quantity, its distribution and the medium used.
Physical measures
- Paper records kept under lock and key, in rooms with controlled access.
- Workstations and screens positioned so as to prevent viewing by third parties.
- Access to the premises restricted outside opening hours.
Technical measures
- Individual accounts and separate passwords for each user, with multi-factor authentication where the system allows it.
- Access rights configured by role and revoked when an employee leaves.
- Encryption of data in transit and of mobile media.
- Regular backup copies, stored securely and tested.
- Antivirus software, firewalls and security updates applied without delay.
- Logging of access to the practice management software.
Administrative measures
- A confidentiality undertaking signed by every member of staff.
- Training at hiring and an annual refresher.
- Confidentiality and security clauses in supplier contracts.
- Incident management procedure (section 8).
8. Confidentiality incidents
Anyone who observes or suspects an incident must notify the person responsible without delay, even where there is only a doubt.
The procedure is as follows:
- Report the incident to the person responsible immediately.
- Contain the incident: suspend the compromised access, recover or isolate the information, correct the vulnerability.
- Assess the risk that serious injury will be caused to the persons concerned, taking into account the sensitivity of the information, the anticipated consequences and the likelihood that it will be used for a harmful purpose.
- Notify, if a risk of serious injury exists, the Commission d’accès à l’information and each person concerned, with diligence. The clinic may also notify any person able to reduce the risk.
- Record the incident in the register of confidentiality incidents, which must be provided to the Commission on request.
- Correct: review the security measures and practices in order to prevent the incident from recurring.
For each incident, the register records: a description of the information concerned, the date or period when it occurred, the date on which it came to the clinic’s attention, the number of persons concerned, a description of the elements of risk, the notices given and the measures taken.
9. Privacy impact assessments
The clinic carries out a privacy impact assessment before:
- acquiring, developing or overhauling an information system or electronic service delivery system involving personal information, for example new practice management software, an imaging solution or an online booking tool;
- disclosing personal information outside Quebec;
- disclosing information without consent for study or research purposes or for the production of statistics.
The assessment is proportionate to the sensitivity of the information, its purpose, its quantity, its distribution and its medium. It is documented, retained and reviewed when the nature of the project changes.
The person responsible is consulted at the outset of any project concerned.
10. Individual rights and handling of requests
Your rights
- Access: obtain communication of the information held about you, including your dental record.
- Correction: have inaccurate, incomplete or ambiguous information corrected, or have information that is outdated or not justified by the purpose of the record deleted.
- Withdrawal of consent: end a use or disclosure based on your consent.
- Portability: receive, in a structured, commonly used technological format, the computerized information you have provided to us, or request that it be transmitted to a third party.
- Cessation of dissemination and de-indexing: have the dissemination of information stopped or a hyperlink de-indexed, under the conditions provided by law.
- Automated decision-making: be informed if a decision concerning you is based exclusively on automated processing, and submit your observations. The clinic uses no process of this kind.
How to make a request
The request is made in writing to the person responsible (section 2). The identity of the requester is verified before any information is communicated. A request concerning a third party’s record must be accompanied by written authorization or by a document establishing the requester’s capacity to act.
Time limit and fees
The clinic responds within 30 days of receiving the request. Access and correction are free of charge; reasonable fees may be charged for transcription, reproduction or transmission, and the requester is informed of them beforehand.
Refusal
Any refusal is given in writing with reasons, states the provision of the law on which it is based, and sets out the available remedies and the time limit for exercising them. The law permits access to be refused in particular where the communication would be likely to cause serious harm to the health of the person concerned, or would reveal information about a third party.
11. Complaints, training and review
Complaints
Any complaint relating to the protection of personal information is addressed to the person responsible (section 2). It is recorded, examined and answered in writing within 30 days.
A person dissatisfied with the handling of their complaint or with a decision of the clinic may contact the Commission d’accès à l’information du Québec. A complaint concerning the professional conduct of a dentist may also be brought to the syndic of the Ordre des dentistes du Québec.
Training and awareness
Every member of staff receives training on this policy at hiring, followed by an annual refresher. The training covers, among other things, confidentiality at the front desk and on the telephone, the handling of emails and documents, the reporting of an incident and the rules governing access to records.
Review
The policy is reviewed at least every two years, and whenever there is a significant legislative, technological or organizational change. The person responsible approves each version.
Distribution
The policy is published on monsourire.com in clear and simple language, posted at the clinic and provided on request.
Effective date
Version of October 15, 2026, approved by Dr. Hugo Vadeboncoeur.