Privacy and Law 25

Quebec’s Law 25, and the rest of Canada

Law 25 is Quebec’s privacy law, and Allô Clinique was built in Montreal with it in mind. What follows is what we actually do, for every clinic, wherever it is in Canada: the database is in Canada, our subcontractors and the countries they operate in are named in our privacy policy, and a data processing agreement is accepted by each clinic in its dashboard.

Privacy rules vary from one province to the next. If your clinic is outside Quebec, ask us about your province’s requirements before you sign up, and we will tell you plainly what we can and cannot answer.

What we keep

We keep what the service needs: appointments, text messages sent and received, and the transcript of calls. Not the audio.

Health information does not have to go through the agent. It books appointments; it does not collect a medical file, and it never asks for a credit card number.

For how long

An automatic purge runs every day. Call transcripts and the content of text messages are erased after twelve months. Traces tied to the public website — chat, callback requests, email log — are erased after ninety days.

Erasure replaces the content with a purge notice rather than deleting the row: you keep the trace that a message existed, without keeping its text.

Right to erasure

A patient can ask for their information to be erased. Write to us and we do it; we confirm to you what was erased.

A patient can also opt out of text messages at any time by replying STOP. The opt-out is recorded and honoured on every following message, with no action on your part.

If an incident occurs

If you suspect a confidentiality incident on your side, such as access you do not recognise or a text message sent to the wrong person, write to support@allo-clinique.com. Describe what you saw without copying any health information into the email.

If an incident affects your patients’ information on our side, we notify your clinic no later than 72 hours after becoming aware of it, by email, to the person you register as incident contact in your security settings or, failing that, to the account owner. An incomplete first notice is completed as soon as we know more.

We give you a written report, the log extracts needed for your own declaration to the privacy regulator (in Quebec, the Commission d’accès à l’information) and a template notice for patients. These commitments are written in the data processing agreement, which your clinic accepts in its dashboard.