PIPEDA Compliance

Canadian clinics and clinicians use Quillentra to document patient visits. The clinic stays in control of its patients' personal health information, and remains accountable for it. Quillentra acts as the clinic's service provider. We process that information only to provide the service, and only as our agreement with the clinic allows.

The Personal Information Protection and Electronic Documents Act (PIPEDA) applies to personal information handled in the course of commercial activity. Depending on your province, a provincial law may apply to you alongside or instead of PIPEDA. Examples are Ontario's PHIPA, Alberta's Health Information Act and Nova Scotia's PHIA; in Quebec, the private-sector privacy act as amended by Law 25 applies. Under those laws we act as your agent, information manager or electronic service provider.

Some provinces require a written agreement with service providers, such as an information manager agreement under Alberta's HIA. Contact privacy@quillentra.com and we will work with you on it.

PIPEDA is built on ten principles. Here is how Quillentra meets each one.

1. Accountability

Our Privacy Officer is accountable for our compliance, and can be reached at privacy@quillentra.com. Every vendor that processes personal health information for us is bound by a contract requiring comparable protection. We maintain documented security, incident-response and vendor-management procedures.

2. Identifying purposes

We process personal health information for one purpose: to transcribe visits and draft, store and export clinical documentation for your clinic. Our Privacy Policy lists how we use account information.

3. Consent

Your clinic is responsible for telling patients about recording and obtaining their consent, as your provincial law requires. Quillentra helps by asking the clinician to confirm consent before every recording, and logging that confirmation. Clinicians agree to our Terms and Privacy Policy when they create an account.

4. Limiting collection

We collect only what a clinician chooses to record, upload or type. We use no advertising or analytics trackers. Visit audio is deleted as soon as the note is written, unless your clinic chooses to keep it for 7 or 30 days.

5. Limiting use, disclosure and retention

We never sell personal health information, use it for marketing, or use it to train AI models. Transcripts and notes are kept until you delete them, and deleted visits are purged from the trash after 3 days by default. See Data retention & deletion for every retention period.

6. Accuracy

AI drafts are reviewed, edited and signed by a clinician before they are used. Every change is kept in version history. Clinicians can amend a note at any time, and that action is recorded in the audit trail.

7. Safeguards

Data is encrypted in transit (TLS 1.2+) and at rest (AES-256), and patient details, transcripts and notes are also encrypted at the field level. Users sign in with single-use codes emailed to them, or with Google or Apple; optional password sign-ins require an authenticator app. Inactive sessions sign out after 15 minutes. Each practice's data is kept separate, and a tamper-evident audit trail records every access.

8. Openness

Our privacy, retention and security practices are public. That includes our list of subprocessors and where they process data.

9. Individual access

Patients ask their clinic for access to, or correction of, their information. Clinics can view, correct and export the records they hold in Quillentra themselves. When a clinic needs our help to respond, we provide it promptly, so the clinic can meet its legal deadline.

10. Challenging compliance

Questions or complaints about how we handle information can go to our Privacy Officer at privacy@quillentra.com. We will investigate and respond. You may also contact the Office of the Privacy Commissioner of Canada or your provincial privacy commissioner.

Quillentra stores and processes data in the United States (Amazon Web Services, us-east-1). PIPEDA allows organizations to use service providers outside Canada. The clinic remains accountable, and must make sure the information receives comparable protection, which we provide by contract and with the safeguards above. Clinics must also be open with patients that their information may be processed in another country. While the information is outside Canada, it may be accessible to that country's courts and authorities under its laws.

Some organizations have stricter rules. For example:

• some provincial public bodies and health authorities have data-residency requirements;
• Quebec's Law 25 requires a privacy impact assessment before personal information is communicated outside Quebec.

We will give you what you need for that assessment, including our safeguards, our subprocessors and the locations where they process data. If your organization needs data to remain in Canada, contact us before you start using Quillentra.

Under PIPEDA, an organization must report a breach of security safeguards to the Privacy Commissioner, and notify affected individuals, when the breach creates a real risk of significant harm. It must also keep a record of every breach for 24 months. Provincial health-privacy laws impose similar duties on custodians.

If a breach affects your clinic's information, we will notify you at the first reasonable opportunity, and in any case within 60 days of discovery. Our notice will describe what happened and the information involved. We will help you assess the risk and notify patients and regulators, and we keep records of every security incident for at least six years.

Privacy Officer: privacy@quillentra.com