Here our answer includes a no — and you’re better off reading it before you sign

Tout renseignement détenu par un organisme est confidentiel et, sous réserve du consentement exprès de la personne qu'il concerne, il ne peut être utilisé ou communiqué que conformément à la présente loi. […] un renseignement est considéré détenu par un organisme même lorsque ce dernier en confie la conservation à un tiers.

What it means

The third paragraph is the one that matters for a vendor: you remain the holder of the information, and therefore responsible for protecting it, even when you entrust its storage to someone else. Outsourcing the hosting outsources none of your responsibility.

What we answer

The contract provides that you remain the owner of your data and that we process it only for an enumerated list of purposes: you remain the holder within the meaning of Law 5, and we act on your behalf. We give you the material to demonstrate it — the data flow, the regions, the sub-processors by role, the contractual commitments.

hard law·Assented to 4 April 2023; in force 1 July 2024; text read as up to date to 1 April 2026·Official source

Un tel mandat ou un tel contrat doit être, selon le cas, confié ou conclu par écrit et, lorsque la personne ou le groupement à qui il est confié ou avec qui il est conclu n'est pas un organisme, prévoir, sous peine de nullité:

What it means

“On pain of nullity” — the wording is rare and it is decisive. The contract must provide for: security measures that comply with the applicable rules, use strictly limited to the contract, a signed confidentiality undertaking, products authorized by the body, notice without delay of any breach OR ATTEMPTED breach, a right of audit, and the return of the information and its secure destruction at the end of the term.

What we answer

Our master agreement covers most of these requirements, and sometimes word for word: section 14.9 already covers “any breach or attempted breach”. But it was not drafted as a section 77 contract, and some elements are not expressly in it — the signed confidentiality undertaking, return at no cost, certified destruction. For a body covered by Law 5, an addendum is necessary, and we say so rather than leave a doubt hanging over a possible nullity.

hard law·In force; text read as up to date to 1 April 2026·Official source

Avant de confier un mandat ou de conclure un contrat de service ou d'entreprise impliquant une communication d'un renseignement à l'extérieur du Québec, l'organisme qui le détient doit s'assurer qu'une évaluation des facteurs relatifs à la vie privée a été réalisée. […] Il en est de même lorsque l'organisme confie […] à l'extérieur du Québec la tâche de […] conserver pour son compte un renseignement.

What it means

Same architecture as section 17 of Law 25: it is not a ban on leaving Quebec, it is a condition. Prior assessment, a conclusion of adequate protection, a contract. And the third paragraph expressly captures the mere fact of entrusting storage to a third party outside Quebec.

What we answer

Your instance is hosted in Canada, in the Canada Central (Toronto) region by default, so not inside the province of Quebec. For Law 5, any province other than Quebec is “outside Québec” exactly as Virginia is — the threshold is provincial. Microsoft's residency commitment is to Canada, not to the province of Quebec: it expressly reserves the right to copy customer data between Canadian regions, and provides that personnel located outside Canada may access it remotely. Hosting in a Quebec region, available only under private hosting (the shared cloud has only one Canadian region), therefore moves processing closer to Quebec without contractually guaranteeing it. Your privacy impact assessment therefore has to conclude on adequate protection, not on a location.

hard law·In force; text read as up to date to 1 April 2026·Official source

Un organisme doit procéder à une évaluation des facteurs relatifs à la vie privée de tout projet d'acquisition, de développement et de refonte de produits ou services technologiques ou de système de prestation électronique de services lorsque ce projet implique la collecte, la conservation, l'utilisation, la communication ou la destruction de renseignements qu'il détient.

What it means

The trigger is ACQUISITION, not leaving Quebec: any project to acquire, develop or redesign a technological product or service is caught as soon as it involves collecting, keeping, using, releasing or destroying information the body holds. The assessment bears on the “project”, so it precedes signature. The text provides no exception for a use outside the clinical record, and the Collège des médecins says the same thing on its side: a few lines from the sentence we quote below, in the requirement on the Collège des médecins, it writes that all AI tools in health must have been the subject of a PIA, generally carried out by the person responsible for the protection of personal information at the place where the tool will be used. That is a requirement distinct from the one in section 78, which is triggered by a communication outside Quebec.

What we answer

Guard against reading this too quickly: one might think that a use outside the clinical record — administrative work, correspondence, drafting — deploys with no formality. It does not — the acquisition itself triggers a PIA, and neither the dedicated instance nor Canadian hosting exempts you from it. What we provide: the path a request takes, the hosting regions, the list of model providers and their countries, the sub-processors by role, the commitments in the contract, the audit log and the model catalogue restricted by the administrator — enough to fill in the assessment. The assessment must also cover the calls the server makes on its own, which the catalogue restriction does not bind: extracting the text of a document added to a knowledge base or pulled from a connector, and the Law 25 detector if you enable it. What we cannot do: carry it out. It belongs to your privacy officer, and it happens before acquisition, not after deployment.

hard law·In force 1 July 2024; text read as up to date to 1 April 2026; Collège des médecins position published 26 February 2026·Official source

Un organisme doit inscrire dans un registre tout produit ou service technologique qu'il utilise. […] L'organisme doit publier ce registre sur son site Internet ou, à défaut, le rendre accessible au public par tout autre moyen approprié.

What it means

The most frequently ignored obligation in Law 5, and it reaches the private practice: Schedule II, paragraph 1, covers the “private professional’s office”, which section 481 of the Act respecting the governance of the health and social services system defines as the enterprise in which physicians, dentists or other professionals practise on their own account. A solo practitioner is therefore a body, and the register must be PUBLISHED, not merely kept.

What we answer

Our product has to appear in that register, and entering it there is on you. We give you what you need to describe it honestly: product name, vendor and its country, purpose, categories of information processed, hosting regions, sub-processors by role. Ask us for that sheet — it is written to be pasted straight into your register.

hard law·2023, c. 5; in force; text read as up to date to 1 April 2026·Official source

Un organisme doit analyser mensuellement les accès aux renseignements qu'il détient et toutes autres utilisations et communications de ceux-ci […]. Malgré le premier alinéa, un organisme visé à l'annexe II de la Loi sur les renseignements de santé et de services sociaux (chapitre R-22.1) a l'obligation d'effectuer une telle analyse au moins une fois par année.

What it means

A private practice falls under the second paragraph: the analysis of accesses is annual, not monthly. Added to it are irreversible destruction (s. 12), a written contract as soon as destruction is entrusted to a third party — it must set out the processes used, where applicable the third party’s obligation to report regularly, and the obligation to notify the body if it engages someone else to perform the contract (s. 13) —, proof of destruction to be retained (s. 14), and a reassessment of the technological product every two years (s. 17).

What we answer

The audit log gives you the material for the annual analysis: authentications, impersonations and administrative changes, time-stamped, with the authentication log sealed by cryptographic chaining. Two things we do not issue today: the certificate of destruction section 14 asks for, and the destruction clauses section 13 requires in the contract when you entrust destruction to us — processes, reporting, notice of subcontracting. Those are the two points to settle in the order form if Schedule II covers you.

hard law·M.O. 2024-010; in force 1 July 2024; text read as up to date to 1 April 2026·Official source

Si l'incident présente un risque qu'un préjudice sérieux soit causé, l'organisme doit, avec diligence, aviser le ministre et la Commission d'accès à l'information.

What it means

Two recipients, not one: the Minister AND the Commission, plus every individual concerned. And the trigger is broader than elsewhere — the obligation arises as soon as there are grounds to believe an incident has occurred OR IS LIKELY to occur. On destruction, the regulation requires it to be secure, suited to the medium and irreversible, with proof retained.

What we answer

The contract obliges us to notify you without delay, with the nature of the incident, the people affected, the period and the measures taken. The two regulatory notices — to the minister and to the Commission — remain yours, and we give you the material to draft them. On destruction, the deletions you request are propagated; the formal certificate of destruction is a deliverable we do not yet issue.

hard law·Act in force; regulation in force 1 July 2024·Official source

Pour la constitution, la tenue, la détention, le maintien et la conservation de tout dossier clinique, [...] le médecin utilise un produit technologique certifié conformément aux dispositions d'une loi dont l'application relève du ministre de la Santé et des Services sociaux.

What it means

The clinical record must sit on a certified product — certification now belongs to Santé Québec. Section 10 carries a proviso that has to be read: it excepts the records covered by sections 7, 8 and 9, including expert-assessment records. Do not take it for a green light — the Collège still targets expert reports in its February 2026 position. The deadlines differ depending on where you start from: section 49 covers the physician already on an uncertified technological medium as of 11 July 2024; one still on paper falls under section 47, so 1 January 2027, or 2030 for a physician who has practised alone for thirty-five years. Section 11 of the same regulation adds requirements about the PRODUCT itself, and they bear on us directly: the physician must ensure that the technological product neither carries nor broadcasts advertising and promotes no product, service or supplier. A model catalogue presented as a commercial showcase would breach that; ours is a list of options the administrator restricts.

What we answer

The platform is built for the work around care — administrative writing, correspondence, monitoring, training, non-clinical documents — and not for keeping the clinical record itself, which must sit on a product certified by the Bureau de certification. We are not, and we will not let that be assumed in order to close a sale: this is precisely the kind of grey area that gets paid for at inspection.

hard law·In force 11 July 2024; compliance required no later than 31 December 2026·Official source

Il n'est donc pas adéquat de verser des rapports de consultation ou d'expertise, des dossiers cliniques ou des portions de ceux-ci […] dans un outil d'IA non certifié par le MSSS, comme c'est le cas pour les outils d'IA générative grand public (ex. : ChatGPT, Copilot, Gemini, etc.) ou même pour certaines solutions destinées aux professionnels de la santé (ex. : OpenEvidence, UpToDate, etc.)

What it means

The Collège’s criterion is certification, and it targets putting a clinical record into the tool. The end of the sentence counts as much as the start: the Collège also names tools designed for clinicians, not only consumer assistants. For a scribe, it requires a certified tool and the patient’s consent at first use, a reminder at subsequent visits, and fresh consent if the subject matter becomes more sensitive or if the tool changes. Worth noting too, because it is easily overlooked: section 20, paragraph 8 of the Code of ethics of physicians requires the physician to take reasonable means to ensure that professional secrecy is preserved “when he uses, or when persons collaborating with him use” information technologies. That is the baseline IT standard in a physician’s practice, and it reaches his collaborators as much as himself.

What we answer

We are not certified, so this position applies to us. For a while we wrote here that “for everything that is not the clinical record” the platform is used with no further formality: that was false, and the same CMQ section says so six lines further down — every AI tool in health must have been the subject of a privacy impact assessment, with no exception for uses outside the clinical record. What we deliver remains an instance dedicated to your practice, hosted in Canada, and we supply the material for that assessment; it is your privacy officer who carries it out. If certification is what you need to go further, tell us: that is the kind of request that moves a roadmap.

regulator expectation·Published 26 February 2026·Official source

Le médecin conserve tout dossier clinique pendant une période d'au moins 10 ans suivant la date de la dernière inscription au dossier ou suivant la date de la fin de l'intervention en santé publique, selon la plus éloignée des échéances.

What it means

Ten years, not five — the “five years” people repeat comes from the old regulation. The clock restarts at the last entry. Expert-assessment records are kept ten years from the end of the mandate or the final judgment, research records fifteen years, and registers ten years (s. 18).

What we answer

No configurable purge applies to what you save, but three of the product's clocks reach a record and know nothing of your ten years: transcriptions at 30 days, tool-produced files at 7 days, attachments never sent at 48 hours. But ten years is long for a working tool: the clinical record belongs in a certified product, and whatever you keep here has to be exported to your archive.

hard law·In force 11 July 2024; text read as up to date to 1 April 2026·Official source

5° obtient préalablement du client une autorisation écrite pour faire un enregistrement audio ou vidéo d'une entrevue ou d'une activité; cette autorisation spécifie l'usage ultérieur de cet enregistrement ainsi que les modalités de révocation de cette autorisation;

What it means

Two distinct rules. Paragraph 1 prohibits disclosing information about the client, except with formal written authorization — or verbal authorization in an emergency — or where the law so orders; section 18 adds the prevention of an act of violence. Paragraph 5 targets “an audio or video recording”: a scribe that captures the voice falls under it, assisted note-taking without capture does not. And the authorization must specify “the subsequent use” — so processing by the platform has to be named in it, not implied. Two companions from the same regime: section 11, paragraph 3 requires the psychologist to explain, BEFORE the service, “the rules on confidentiality and their limits as well as the modes of transmission” — recourse to a third-party platform is precisely a limit and a mode of transmission, so it is named at the consent stage. And the nurse has an exact equivalent: section 32.1 of her code requires prior written authorization before any audio or video recording of an interview, specifying the intended use.

What we answer

The platform can transcribe and summarize, but it does not ask for any authorization on your behalf and keeps no record of one as such. The written authorization, its scope and its revocation remain your file — and if the client revokes it, deleting the recording and everything derived from it is on you, which the platform allows but does not automate.

hard law·O.C. 439-2008; version read as up to date to 1 April 2026·Official source

Le psychologue peut utiliser l'informatique ou toute autre technique pour la constitution et la tenue de ses dossiers pourvu que la confidentialité des renseignements qui y sont contenus soit assurée. […] Le psychologue doit conserver chaque dossier pendant au moins 5 ans à compter de la date du dernier service professionnel dispensé.

What it means

Computerization is permitted, but not on its own: section 1 requires the record to be kept “at the place where he practises his profession” and section 7 requires it to be in a cabinet locked by key or otherwise. Five years is a floor, counted from the last service; destruction falls under section 9 and must preserve confidentiality. In an institution, sections 8 to 10 are set aside by section 12.

What we answer

No configurable purge applies to the content you save, and the record exports. Three timers are hardcoded and reach a record directly — transcriptions at 30 days, tool-produced files at 7 days, attachments staged but never sent at 48 hours: if one of them holds a piece of your record, that is where your five-year floor is decided, and you have to export it first. On the place of practice: hosting with a third party is not, on its own, keeping the record “at the place where you practise”. Those are the timers that reach a record; other clocks exist elsewhere in the product, and the Confidentiality and compliance page publishes the full inventory.

hard law·O.C. 448-92; sections 2 and 8 unchanged since 1992; text read as up to date to 1 April 2026·Official source

Sans restreindre la portée de l'article 3, un psychologue évite de verser dans un dossier toute donnée brute qui n'a pas fait l'objet d'un traitement ou toute information non vérifiée susceptible de porter préjudice au client.

What it means

Two things stay out: raw data that has not been processed, and unverified information liable to prejudice the client. It is a rule about what GOES INTO the record, and section 3, paragraph 10 completes it by requiring the psychologist’s signature on every entry: what goes in is therefore processed, reviewed and signed. The Code of ethics adds a rule on the way out — raw, uninterpreted data related to an assessment or inherent in a psychological consultation is released to no one other than a psychologist (C-26, r. 212, s. 49), and section 50 covers test protocols. The Ordre writes it itself in “Les notes au dossier”: a note is a summary of the professional services rendered, not a verbatim transcript.

What we answer

The platform transcribes an interview and summarizes a document, and neither is an entry in the record until the professional has written one. A transcription is raw data; an unreviewed summary is unverified information; nothing we produce carries your signature. We put no mark on generated content: once exported, nothing in the text will say it came from a model, and identifying it is on you. Section 49 also poses a question to settle BEFORE uploading: inference runs at foreign model providers, several of them in the United States, which are not psychologists — raw assessment data or a test protocol should not be sent there until you have concluded that the section permits it. Confidential mode and the model catalogue restricted by the administrator are there to frame that choice, not to make it for you. One caveat that counts here: this restriction binds the models the user picks, not the ones the server keeps — extracting the text of a document added to a knowledge base goes through a proprietary model fixed in the code — a scanned document reaches it whatever your restriction says, whereas a file attached to a conversation goes through the user's own model.

hard law·O.C. 448-92; text read as up to date to 1 April 2026; “Les notes au dossier”, Psychologie Québec, March 2020·Official source

1° sauvegarder les données ainsi recueillies et en conserver une copie; 2° utiliser une base de données distincte de toute autre pour la tenue des dossiers visés par la présente section; 3° protéger l'accès de ces données, notamment par l'utilisation d'un mot de passe.

What it means

Three technical obligations as soon as a computerized medium serves the record: a backup with a copy kept, a database separate FROM ANY OTHER, and protected access. Retention is at least five years from the CLOSING of the record (s. 9, para. 1), and section 8 wants the record in the office premises or in an appropriate archiving location.

What we answer

Every client gets a dedicated instance with its own database: that settles separation between clients. Watch the exact reach of section 4, paragraph 2 — “separate from any other” also covers your own other uses, so do not mix your client records with a general-purpose workspace in the same instance. Backups run as continuous archiving, access goes through your identity provider, with per-object rights and an audit log.

hard law·Decision of 19 December 1996; version read as up to date to 1 April 2026·Official source

Un logiciel de traitement de texte qui n'a pas été conçu expressément pour produire des notes au dossier (p. ex. : Word) ne permet pas d'assurer une inaltérabilité de la note. Ainsi, les notes produites à l'aide de ces outils doivent être imprimées, signées et considérées au même titre que des notes manuscrites.

What it means

The standard does not condemn the tool: it finds that software not expressly designed to produce entries in a record cannot ensure their unalterability, and it draws a procedural consequence — a note produced with such a tool must be printed, signed and treated in the same way as a handwritten note. Rule 3.2.2 further expects the nurse to authenticate so that her entries are tied to her, and rule 4.2 that a trace of earlier versions remains available. The 2023 standard applies to all members, in institutions as in private practice.

What we answer

Let us say it without hedging: our platform is a conversation and drafting tool, not a clinical documentation system, and it was not designed to produce entries in a record. A note written here therefore falls exactly into the case described by rule 3.2.2: printed, signed, treated as a handwritten note. What we can show goes in the right direction without being enough — named accounts, per-user and per-group access, an audit log, and message editing that leaves an entry in the log. But that trace documents a conversation on our side, not the successive versions of an entry in your record: the unalterability the standard requires is decided in the system that holds the record, and that system is not ours.

regulator expectation·2023 (ISBN 978-2-89229-755-3); replaces the 2002 Énoncé de principes; PDF read in full text on 11 August 2026·Official source

Le psychologue permet, avec diligence et au plus tard dans les 30 jours de la réception d'une demande écrite à ce sujet, à son client ou à toute personne qui dispose de l'autorisation de ce dernier, de prendre connaissance ou d'obtenir copie des documents qui le concernent dans tout dossier constitué à son sujet.

What it means

The period runs from RECEIPT of the written request, it is 30 days at most, and it bears on “the documents concerning him in any record made in his respect” — so on items, not only on the entry in the record. Section 21 grants the same period for correction. The same thirty days appear at the OIIQ (I-8, r. 9: s. 61 for access, s. 64 to correct, delete or file comments) and at the Collège des médecins (M-9, r. 17, s. 99 to correct or delete, and s. 94, shorter: twenty days to give access). One proviso not to be glossed over: the periods in the nurses’ code apply to practice outside the public sector; in an institution, section 59 refers to the Act respecting Access.

What we answer

Conversations, documents and attachments export, and editing a message leaves an entry in the audit log — enough to produce a copy and correct within the period. But there is a collision here you had better know about before you sign: our transcriptions are purged at 30 days, the timer cannot be disabled and there is no configurable retention. A request received on day 25 can therefore see the item asked for disappear DURING your response period, and for a physician, whose access is given in twenty days, the margin is thinner still. The practical rule fits in one sentence: the moment a request arrives, export the transcription and the files concerned that same day, before you even draft the reply. We cannot lengthen the timer for you, and we would rather write it here than let you find out on day 30.

hard law·O.C. 439-2008; for the OIIQ, O.C. 1513-2002 and O.C. 836-2015; for the Collège des médecins, O.C. 1213-2002; texts read as up to date to 1 April 2026·Official source

Le membre doit conserver tous ses dossiers dans le local de son cabinet de consultation réservé à l'exercice de sa profession ou dans un lieu d'archivage approprié.

What it means

Two places are allowed, and it is the second that concerns us: the consulting-room premises reserved for practice, or an “appropriate archiving location”. The regulation does not say what makes a location appropriate, names neither cloud computing nor any country, and therefore does not prohibit custody by a third party — but it is a rule about PLACE, and “your data stays in Canada” is not an answer to it. The other orders have their own, sometimes narrower: the psychologist keeps the record “at the place where he practises his profession” (C-26, r. 221, s. 1), the pharmacist likewise (P-10, r. 23, s. 2.01), and the dentist must keep his records, or ensure that they are kept, in premises or a cabinet to which the public has no access or that can be locked (D-3, r. 16, s. 21). That “ensure that they are kept” is aimed precisely at custody by a third party: the responsibility follows the record all the way to us. One provision makes computerization possible and states its condition: section 1 of the same regulation specifies that nothing in the division is to be interpreted as excluding a computerized medium, provided the process compromises neither professional secrecy (s. 60.4 of the Professional Code), nor the client’s right to consult and obtain a copy (60.5), nor his right to have it corrected (60.6).

What we answer

Your instance is dedicated and hosted on Azure, in the Canada Central (Toronto) region by default and a Quebec region only under private hosting, with encryption in transit and at rest, per-user and per-group access lists, and an audit log. That is enough to document a place, not enough to stand in for one: hosting with us is not, on its own, keeping your record at the place where you practise. For the texts that allow only the place of practice, the prudent reading remains the one we hold elsewhere on this page — the platform is a working tool, and the record lives where you practise. For the OIIQ the question is more open, and it is you who must conclude that a Canadian data centre constitutes an “appropriate archiving location”: we supply the material — region, sub-processors by role, access controls, contractual commitments — and not the conclusion.

hard law·Decision 96-12-19, s. 8; the texts of the three other orders date from 1992, 2004 and 1981 respectively; all read as up to date to 1 April 2026·Official source

Toutefois, il ne peut détruire un original qui appartient à un client sans avoir obtenu l'autorisation de celui-ci ou sans lui avoir donné la possibilité de le reprendre.

What it means

The rule is not about a duration but about OWNERSHIP of the item: an original belonging to the client may not be destroyed either without his authorization or without his having been given the opportunity to take it back. A deletion that happens by itself offers neither. The Collège des médecins draws the opposite conclusion for a different item: its fact sheet on the AI scribe requires the recording and the verbatim transcript to be destroyed as soon as the physician has reviewed and signed the note, because they remain seizable by an access request for as long as they exist. The two requirements do not contradict each other — they cover different items — but they pull a platform in two opposite directions.

What we answer

Three of the product's timers are hardcoded and cannot be disabled: transcriptions at 30 days, tool-produced files at 7 days, attachments staged but never sent at 48 hours; no retention is configurable. In the OIIQ’s direction, that is a defect and we say so: if the only copy of an original belonging to your client passes through one of those three routes, its deletion will happen without authorization and with no opportunity to take it back, which section 9 prohibits — so never let an original live there, export it the same day. In the Collège’s direction it is an advantage, and a fortuitous one: a transcription will not survive thirty days with us, which goes in the direction the scribe sheet asks for, without exempting you from destroying it as soon as you sign. The same timer is therefore a risk in one case and a rescue in the other, depending on the item it carries off. And in both cases, we issue no certificate of destruction. Those are the timers that reach a record; other clocks exist elsewhere in the product, and the Confidentiality and compliance page publishes the full inventory.

hard law·Decision 96-12-19, s. 9; text read as up to date to 1 April 2026; Collège des médecins fact sheet “Utilisation d’un scribe IA”, 28 January 2025·Official source

Si toutefois l'optométriste opte pour un fournisseur à l'extérieur du Québec, il doit alors s'assurer que des protections similaires à celles du Québec sont offertes en vertu des lois susceptibles de s'appliquer aux données.

What it means

Let us be exact about the force of this text, because the nuance is the whole point: hosting in Quebec is “preferable”, not mandatory — it is a preference. What does become mandatory is the VERIFICATION, the moment you go outside Quebec. The optometrist must then establish that the laws applicable to the data offer protections similar to Quebec’s, which presupposes knowing which country the data resides in and which regime it falls under. The obligation rests on the professional, not on the provider.

What we answer

Our default region is Canada Central (Toronto): outside Quebec, so you are in the case that triggers the verification, and our job is to give you the material for it rather than a conclusion. We document the Canadian hosting region and its paired region, the list of model providers and their countries, what is sent to them and what is not, and what the contract commits to. Three points we do not hide. First, the host’s residency commitment is to CANADA, not the province, and it reserves the copying of data between Canadian regions. Second, that same section 1.5 states two other preferences we do not meet: it favours a method in which the provider and the intermediaries can “never” access the informational content of the data — a “zero knowledge” service — and that is not our architecture; encryption is in transit and at rest, but processing requires access in the clear. Third, it favours secure services intended specifically for health professionals, and we are a general-purpose AI platform. The equivalence analysis remains yours, and those two gaps are part of it.

regulator expectation·Decision of the board of directors of 18 October 2019·Official source

Les informations contenues dans les requêtes pourraient être retransmises lors d'interactions avec d'autres personnes, au risque de communiquer des renseignements personnels et des informations de santé, sans avoir obtenu de consentement préalable.

What it means

This is the Quebec order that goes furthest against CONSUMER generative AI: it holds that the risks of those systems “far outweigh the benefits”. The mechanism it describes is precise — what is typed into a prompt can resurface in other users’ interactions, which would amount to disclosing health information without consent. So the question to put to a vendor is not “are you secure?” but “what do you do with what is typed in?”.

What we answer

Let us start with the mechanism the Ordre describes, because that is the question: consumer systems use interactions to improve their algorithms, so an input can resurface for someone else. That reuse happens at the MODEL PROVIDER, not in the partitioning between clients — a dedicated instance does not neutralise it, since the computation runs at third-party providers, several of them in the United States. What we can show: the console displays, provider by provider, the published training and retention policy, the model catalogue is restricted by the administrator, and our contract prohibits using your content to train a public model without your written authorization. What we cannot claim: that those policies bind us rather than their authors — our contract binds us to you, it does not bind OpenAI, Anthropic or Google. The partitioning, for its part, is real and worth stating: your database is yours, access is per user and per group, nothing is pooled with another organization. The Ordre finally raises hosting outside Quebec: our default region is Toronto, and a Quebec region exists only under private hosting. Choosing the model provider therefore remains a decision to be taken with your eyes open, not a risk cancelled by the dedicated instance.

regulator expectation·20 December 2023·Official source

L'ergothérapeute doit s'assurer de la sécurité des données sauvegardées dans l'infonuagique, comme indiqué selon l'indicateur 3.22 du Cadre de référence sur les aspects clinico-administratifs liés à l'exercice de la profession d'ergothérapeute dans le secteur privé (juin 2015).

What it means

The obligation is personal: it is the occupational therapist who must ensure the security of data placed in the cloud. It does not delegate to the provider, and it is not presumed from the provider announcing it. The guideline sets the benchmark by cross-reference to indicator 3.22 of another of the Ordre’s documents, the Cadre de référence of June 2015 — that is where you have to go and read what is actually expected.

What we answer

We supply what is needed to make that demonstration: encryption in transit and at rest, a dedicated instance, per-user and per-group access, an audit log, a documented hosting region, and security clauses in the contract with an annual audit right. What we will not do is claim to satisfy indicator 3.22: we have not read the 2015 Cadre de référence, and compliance announced with a document one has not opened is worth nothing. If your inspection relies on it, send it to us and we will answer point by point.

regulator expectation·April 2025·Official source

Il doit conserver ce dossier à l'endroit où il exerce sa profession. […] Le travailleur social peut utiliser l'informatique ou toute autre technique comme moyen additionnel pour la tenue de ses dossiers pourvu que la confidentialité des renseignements qui y sont contenus soit assurée.

What it means

The most constraining provision in this whole body of rules, and it turns on two words. Computerization is an “additional” means — a supplement, not the medium of the record — and the record is kept at the place where you practise, in premises or a lockable cabinet (s. 5). The retention floor is five years from the last service (s. 6), set aside in an institution (s. 8).

What we answer

Let us put it plainly: in independent practice, our platform cannot be your only record system. This 1988 text does not allow it, and no quality of hosting changes that in the slightest. Use it as a working tool, keep the record where you practise, and export whatever has to go back there.

hard law·O.C. 929-88; a 1988 text never modernized; read as up to date to 1 April 2026·Official source

Le membre qui désire enregistrer une entrevue obtient préalablement l'autorisation écrite de son client, de son représentant légal ou, s'il s'agit d'un mineur de moins de 14 ans, du titulaire de l'autorité parentale ou du tuteur. Cette autorisation doit spécifier l'usage projeté de cet enregistrement ainsi que les modalités de sa révocation.

What it means

The same rule as for psychologists, and it is often presented as theirs alone: it applies identically to the social worker. Any transcription of an interview by a tool triggers section 27, and the Ordre’s opinion on AI confirms it — consent becomes mandatory as soon as the system records, locates or profiles the client. Section 2 of the same code closes a frequent escape hatch: the duties arising from the Professional Code “are in no way modified by the fact that the member carries on his professional activities within a partnership or company”. Section 22 further prohibits him from limiting his civil liability — no clause of our contract can stand in for that.

What we answer

The platform can transcribe, but it asks for nothing on your behalf and keeps no trace of the authorization. The written authorization, the statement of the intended use — therefore of our processing — and the revocation terms remain your file. If the client revokes, deletion is possible, but you are the one who triggers it.

hard law·O.C. 97-2020; in force since 1 November 2020; read as up to date to 1 April 2026·Official source

Le membre donne suite, avec diligence et au plus tard dans les 30 jours de sa réception, à toute demande écrite d'un client souhaitant prendre connaissance ou obtenir copie des documents qui le concernent dans tout dossier constitué à son sujet.

What it means

Thirty days, and access is free — only transcription, reproduction or transmission charges are allowed. Section 71 adds correction or deletion within the same period, then, WITH THE CLIENT’S CONSENT, transmission at no charge of a copy of the corrected information to any person FROM WHOM the member had received that information — with no time limit for that one — as well as to any person to whom it was disclosed in the preceding six months.

What we answer

Conversations, documents and attachments export, and a message can be corrected in place with an entry in the audit log — enough to hold the thirty days. What the platform does not do: find out from whom you obtained a piece of information, or to whom it was disclosed over the past six months. That chain stays yours, and passing the correction on remains conditional on the client’s consent — it is not a broadcast the member triggers of his own accord.

hard law·O.C. 97-2020; in force since 1 November 2020; read as up to date to 1 April 2026·Official source

Où sont stockées les données ? Sont-elles susceptibles d'être utilisées pour entraîner le SIA ou par une entreprise tierce ?

What it means

The Ordre asks, word for word, the questions every buyer will put to us, and ties them to sections 39, 42 and 43 of the Code — so a failure is actionable before the disciplinary committee. Note 8 goes further: it makes the 2016 telepractice standards applicable, “except as otherwise provided”, every time a member uses an AI system, not only in videoconferencing. Standard 5.03 draws from that the most concrete requirement for a buyer: informing the client of the mechanisms used to secure and back up the records — the text expressly names the “third-party server” — and of how long they will be archived before destruction. The member therefore has to be able to repeat to the client what we tell him.

What we answer

The question contains two, and they do not have the same answer. Where the data is stored: hosting in Canada by default, Toronto by default, Quebec only under private hosting, region and paired region documented, sub-processors published by role. Whether it is liable to be used to train the AI system or by a third-party company: our contract prohibits using your content to train a public model without your written authorization, but the prompts travel through third-party model providers, and it is their published policies — which the console displays provider by provider — that govern what they do with them. We give you the material to answer that second half honestly, not the material to answer “no” on the provider’s behalf. Standard 5.03 additionally requires you to tell your client about the backup mechanisms and the archiving period — ask us for that sheet for your deployment; we produce it.

regulator expectation·26 March 2026, revised 9 April 2026·Official source

Le dossier-patient doit être tenu à jour aussi longtemps que la personne visée par le dossier demeure un patient du pharmacien. Un dossier-patient ne peut être fermé définitivement qu'après une période d'inactivité d'au moins 2 ans, sauf en cas de décès. Dès qu'un dossier-patient est fermé définitivement, le pharmacien peut le détruire.

What it means

There is no retention period for the pharmacist, and the first sentence is what says so: as long as the person remains a patient, the record is kept up to date with no horizon. The two years are not a retention period but the precondition for an optional closing, and destruction is never mandatory. Two sections frame the medium: section 2.01 requires the record to be kept “at the place where he practises his profession”, but section 2.06 specifies that nothing in that division is to be interpreted as excluding “the use of computers or any other means” for the making and keeping of the patient record.

What we answer

No purge on our side will close a record, which is the right answer here: an automatic two-year retention would breach the section. On the medium, section 2.06 removes the ambiguity — computerizing the patient record is expressly permitted, unlike the “additional means” restriction imposed by the social workers’ regulation. What remains open is the place of practice in section 2.01: hosting with a third party is not, on its own, keeping the record at the pharmacy, and that question is not settled by our architecture.

hard law·R.R.Q., 1981, c. P-10, r. 19; consolidated text up to date to 1 April 2026·Official source

Le pharmacien ne doit divulguer à quiconque aucun code ou marque spécifique pouvant permettre l'utilisation de sa signature numérique ou, plus généralement, aucun autre moyen équivalent permettant de l'identifier et d'agir en son nom.

What it means

A rare section in Quebec codes, and cut to fit our subject: what it prohibits is DISCLOSING to anyone a code, a mark or “any other equivalent means of identifying him and acting in his name”. Nothing confines that wording to a password: an API key or the credentials of a shared service account fall naturally into the category. On our reading, an automation acting under a pharmacist’s identity raises the same question, even though the section does not expressly settle it — it targets disclosure of the means of identification, not automation as such. Section 15 adds that it is up to the pharmacist to put the security measures in place “in his pharmacy”, and section 63 that professional secrecy is lifted only by the patient or by law.

What we answer

Accounts are personal and attribution is per user. Two practical consequences for you: do not share an account in the dispensary — that is the heart of section 56 — and know that a service key hides no one. We wrote here that it was enough not to name it after a pharmacist; that was useless advice. The preamble sent to the provider carries the full record of the administrator who created the key — name, email, job title, department. The name of the key serves only to group reports together. The control therefore bears on WHO creates the key, not on how it is named. Name your keys by function. And ask yourself the question before automating: a task that runs “in your name” under an identity that designates you deserves to be examined in the light of this section, even though the text targets disclosure of the means of identification first.

hard law·O.C. 467-2008, s. 56; consolidated text up to date to 1 April 2026·Official source

Les codes d'accès et mot de passe génériques ne devraient pas être utilisés. […] Assigner un code d'identification à une seule personne […] La période de conservation minimale des journaux est de deux ans.

What it means

Two requirements, and they do not carry the same force: generic access codes and passwords “should not” be used — a conditional — whereas the minimum retention of logs “is two years”, in the indicative. Between the two, a clear rule: an identification code assigned to a single person. Section 5.2.5 adds what must appear in the contract when an external provider accesses the information: a WRITTEN mandate or contract, the measures ensuring the information is neither disclosed to third parties nor used for other purposes, an undertaking not to keep it after expiry, the possibility for the pharmacist to carry out any verification relating to that confidentiality, and notice without delay of any breach or attempt. It is the only IT reference document the Ordre has published, and it serves as the grid for the professional inspection committee.

What we answer

What we can demonstrate: named accounts, no need for a shared account, per-user and per-group access lists, a time-stamped audit log, and a written contract whose section 14 covers confidentiality, purposes, sub-processors, incidents and an annual audit right — that is, most of the clauses in § 5.2.5. Two reservations. Retaining logs for two years is not a setting we expose: there is no configurable retention on our side, and that duration is to be agreed in the order form rather than presumed. Non-retention after expiry, for its part, runs into what we concede elsewhere on this page: we do not issue a certificate of destruction. The rest remains yours — section 15 of the Code of ethics makes putting the measures in place a personal obligation of the pharmacist, and nothing technically stops us from opening an account that two people will share at the counter: that prohibition is one you hold.

regulator expectation·Legal deposit 3rd quarter 2011; the PDF carries no day date; no later edition, and URL verified live on 11 August 2026·Official source

Le dentiste doit signer, parapher ou identifier toute information ou inscription notée dans le dossier par lui-même ou toute autre personne. Il doit assurer l'intégrité et l'inaltérabilité des renseignements qui sont contenus au dossier.

What it means

The provision that bites hardest on a generative AI. “Any other person” means that a note drafted or summarized elsewhere and then filed into the record must stay attributable and be identified by the dentist. Retention is five years following the last entry “of any kind, or insertion” (s. 22) — so a new radiograph restarts the clock for the whole record.

What we answer

The platform keeps the full history of every exchange, which makes it possible to trace what was produced with AI. What it does not do: mark an output as AI-generated, or guarantee the unalterability of content once it has been exported to you. Pasting a generated note into the record without identifying and signing it puts you in breach, and no setting on our side makes up for that.

hard law·Decision 2004-11-24; text read as up to date to 1 April 2026·Official source

Lorsqu'un dentiste demande à un patient de lui révéler des renseignements de nature confidentielle ou lorsque de tels renseignements lui sont confiés, il doit s'assurer que le patient est pleinement au courant des utilisations diverses qui peuvent être faites de ces renseignements.

What it means

The best “AI” hook in the dental code, and it is hard law. Putting a record — including radiographs and photographs, which are part of it — into an AI platform is a “use” the patient must be fully aware of. That means actively informing them, not a notice posted in the waiting room.

What we answer

We give you what you need to inform them: the path a request takes, the hosting regions, the retention policies of each model provider. Informing the patient, and keeping a trace of it, stays yours. Note that leaving Quebec goes through section 78 of Law 5 here, not through Law 25: a dental practice is a body within the meaning of that Act.

hard law·R.R.Q., 1981, c. D-3, r. 4; O.C. 580-2005, s. 1; text read as up to date to 1 April 2026·Official source

Le présent règlement ne doit pas être interprété comme excluant l'utilisation de l'informatique ou de toute autre technologie pour la constitution, la tenue, la détention et la conservation des dossiers et registres d'un ergothérapeute, pourvu que la confidentialité et l'intégrité des renseignements qui y sont contenus de même que l'exercice des droits d'accès et de rectification soient assurés. […] L'ergothérapeute doit assurer la confidentialité et l'intégrité de ses dossiers. […] L'ergothérapeute doit conserver chaque dossier pendant au moins 5 ans à compter de la date du dernier service rendu.

What it means

This is the hard law behind the order's guideline on cloud computing. Three things to retain. The regulation contains NO rule on physical place — no “premises or cabinet kept locked” as with the optometrists or the psychoeducators: the standard is functional, and it adds INTEGRITY to confidentiality and to the rights of access and correction, which bears on the unalterability of the note as much as on its secrecy. The period is 5 years from the last service rendered, and section 18 requires that destruction preserve confidentiality. Finally, section 1 is drafted in the negative — it does not “exclude” computerization — so the permission holds only for as long as the three conditions hold: it is for the occupational therapist to establish that, not for the vendor to assert it.

What we answer

On confidentiality, what we can show: a dedicated instance, Microsoft Azure hosting in the Canada Central region (Toronto) by default, per-user and per-group access, an audit log of changes, shares, administrator access and knowledge-base retrieval, a model catalogue that can be restricted all the way to a global kill switch that binds administrators too, confidentiality in the contract (s. 14), incident notice without delay (s. 14.9), an annual right of audit (s. 14.10) and no training on your content without written authorization (ss. 14.2 and 14.7). On integrity, let us be precise: the audit log traces accesses and changes, but we offer neither a zero-knowledge architecture nor a certified clinical-record product — content generated by a model is not an unalterable note, and inference leaves Canada, to providers established in the United States and in France. The catalogue kill switch, moreover, binds only the models a user picks, not the calls the server makes on its own: the extraction of the text of a document added to a knowledge base, conversation titles, the agent's screenshot, the Law 25 detector if you enable it. On the 5 years: retention is not configurable, there is no certificate of destruction, and three of the product's timers that cannot be turned off — 30 days for transcriptions, 7 days for tool-produced files, 48 hours for attachments never sent — can carry off a piece of the record before your deadline. The record stays in your record system; the full export in open formats feeds it.

droit dur·Décision 2013-11-15, 2013 G.O. 2, 5148 ; modifié par L.Q. 2023, c. 34, a. 1293 et 1634 ; texte lu à jour au 1er avril 2026·Official source

Le présent règlement permet l'utilisation de l'informatique ou de toute autre technologie de l'information pour la constitution, la tenue, la détention et la conservation des dossiers d'un membre pourvu que la confidentialité et l'intégrité des renseignements qui y sont contenus de même que l'exercice des droits d'accès et de rectification soient assurés. […] Le membre doit assurer la confidentialité et l'intégrité de ses dossiers et en restreindre l'accès aux seules personnes autorisées. […] Le membre doit conserver chaque dossier et tout relevé d'honoraires ou autre montant facturé pour chaque client pendant au moins 5 ans à compter de la date du dernier service professionnel rendu.

What it means

Mind the number: the regulation in force is C-26, r. 200.2, and its section 39 expressly replaces the former C-26, r. 207, which LégisQuébec still serves under a banner reading “Replaced on 1 January 2016” — to cite r. 207 today is to cite a replaced text. The current regulation permits computerization on three cumulative conditions — confidentiality, integrity, exercise of the rights of access and correction — and section 10 adds the text's only access rule: restrict access to authorized persons only. The period is 5 years from the last professional service rendered (s. 11), destruction must preserve confidentiality (s. 12), and s. 22, para. 2 provides that only a member may act as assignee of another member's records. Worth noting, because it is a step backwards: the former r. 207 itemized precise security measures — identification and authentication, access profiles, access logging, backups, security of the premises — which r. 200.2 does not reproduce.

What we answer

The three conditions in section 2 have to be handled separately, and we do not meet three out of three. Access restriction (s. 10): a dedicated instance, per-user and per-group access, a model catalogue that can be restricted all the way to a global kill switch that binds administrators too, an audit log of changes, shares, administrator access and knowledge-base retrieval — that condition, we support with evidence. Confidentiality: Microsoft Azure hosting in the Canada Central region (Toronto) by default, confidentiality in the contract (s. 14), incident notice without delay (s. 14.9), an annual right of audit (s. 14.10), no training on your content without written authorization (ss. 14.2 and 14.7) — but inference leaves Canada, to providers established in the United States and in France, and the kill switch does not bind the calls the server makes on its own. Integrity: no zero-knowledge architecture and no certified clinical-record product; the platform is not where your record lives. On the 5 years in section 11, retention is not configurable, there is no certificate of destruction, and three of the product's timers that cannot be turned off — 30 days, 7 days, 48 hours — can carry off a piece before your deadline; export beforehand. And s. 22, para. 2 settles the question of assignment without us: only a member of the order can be an assignee.

droit dur·Décision 2015-11-06, 2015 G.O. 2, 4566 ; remplace le C-26, r. 207 ; modifié par L.Q. 2020, c. 15, a. 74 et L.Q. 2023, c. 34, a. 1293 et 1634 ; texte lu à jour au 1er avril 2026·Official source

Rien dans le présent règlement ne doit être interprété comme excluant l'utilisation de l'informatique ou de toute autre technique pour la constitution et la tenue du dossier optométrique. […] Un optométriste doit conserver chaque dossier pendant au moins 5 ans à compter de la date du dernier service rendu. […] Un optométriste doit conserver ses dossiers dans un local ou un meuble auquel le public n'a pas librement accès et pouvant être fermé à clef ou autrement.

What it means

A warning about numbering before the substance, because the order itself got it wrong. The record-keeping regulation in force is O-7, r. 20 — the former R.R.Q., 1981, c. O-7, r. 9, renumbered. Yet the reference list of the order's Guidelines of 18 October 2019 designates that same regulation as “RLRQ, c. O-7, r. 5”: that number is not its own, it is the number of the Code of ethics of optometrists, which had moreover already been REPLACED on 17 May 2018 by O-7, r. 5.1 (which the same list cites correctly elsewhere). The living ethical provision is therefore section 55, para. 6 of r. 5.1, which requires the optometrist to “take reasonable means to ensure that professional secrecy is preserved when using information technology”. On the substance: r. 20 dates from 1981 and it shows its age. Section 1.02 permits computerization WITHOUT attaching any condition to it — no confidentiality, no integrity, no rights of access — unlike the more recent regulations of the other orders. Safekeeping is described as a piece of furniture kept under lock and key (s. 2.05), the period is 5 years from the last service rendered (s. 2.04), and the regulation provides nothing on the cessation of practice.

What we answer

For optometry, the operative obligation comes not from the record-keeping regulation but from the Code of ethics: section 55, para. 6 of O-7, r. 5.1 asks you to take reasonable means to preserve professional secrecy when you use information technology. You are the one who carries that duty, and reading it presupposes knowing what the tool does. What we provide: a dedicated instance, Microsoft Azure hosting in the Canada Central region (Toronto) by default, per-user and per-group access, an audit log of changes, shares, administrator access and knowledge-base retrieval, a model catalogue that can be restricted all the way to a global kill switch that binds administrators too, confidentiality in the contract (s. 14), incident notice without delay (s. 14.9) and an annual right of audit (s. 14.10). What you must write into your analysis: inference leaves Canada — providers established in the United States and in France — which is exactly the case the order's guideline asks you to check; and the catalogue kill switch binds only the models a user picks, not the calls the server makes on its own. On section 2.04, retention is not configurable and we issue no certificate of destruction; three of the product's timers that cannot be turned off — transcriptions at 30 days, tool-produced files at 7 days, attachments never sent at 48 hours — can carry off a piece before your 5 years. The optometric record stays in your system; the full export in open formats feeds it.

droit dur·R.R.Q., 1981, c. O-7, r. 9 ; modifié par L.Q. 2023, c. 34, a. 1293 et 1634 ; texte lu à jour au 1er avril 2026·Official source

Par conséquent, il est essentiel de vérifier à quelles réglementations les entreprises sont soumises, en fonction du lieu où elles opèrent et du lieu où entreposés les serveurs. […] À travers les mécanismes de protection du public, des recommandations pourraient être émises et des ajustements pourraient être exigés en fonction des éléments jugés questionnables ou problématiques, à la lumière du présent outil.

What it means

The order itself writes that the tool “creates no formal enforceable rules”, but the sentence we quote second closes the door again: the public-protection mechanisms — professional inspection, the syndic — will use it as a reference, and adjustments may be required. To be treated as an expectation of the inspection, not as optional reading. Two operational requirements follow from it directly: check which regulations the provider is subject to according to its place of operation AND the location of its servers, and provide “a method for extracting, backing up and keeping personal and sensitive data outside the AI tool”, the order recalling that the record must be kept for at least 5 years (C-26, r. 222.1.4, s. 10). The document also recalls that de-identification, pseudonymization and anonymization do not prevent re-identification.

What we answer

What we can document: the platform is operated by Hilo Tech, a Quebec company, on a dedicated instance hosted on Microsoft Azure in the Canada Central region (Toronto) by default — a Quebec region exists only under private hosting. Inference, for its part, leaves Canada: model providers in the United States and in France, and a Singapore entity for video. The contract bars any training without your written authorization (ss. 14.2 and 14.7), imposes confidentiality (s. 14), incident notice without delay (s. 14.9) and gives you an annual right of audit (s. 14.10). On the “method for extracting and keeping the data outside the tool”, the full export exists and it is what answers. What we cannot say: that restricting the model catalogue covers everything — it binds administrators as well as users, but not the calls the server makes on its own — the extraction of the text of a document added to a knowledge base, the indexing of that base, web search, the Law 25 detector if you enable it, conversation titles, agent screenshots, Learning-module audio, mail triage, and more. The Confidentiality and compliance page enumerates them all, with what leaves and to which model. For a clientele whose information touches on sexual health, that list must appear as it stands in your ethical deliberation.

attente du régulateur·2026-01-29·Official source

La présente section permet l'utilisation des technologies de l'information pour la tenue, la détention ainsi que le maintien des dossiers des clients d'un sexologue pourvu que la confidentialité des renseignements qui y sont contenus ainsi que l'exercice des droits d'accès et de rectification soient assurés. […] Le sexologue doit conserver chaque dossier pendant au moins 5 ans à compter de la date du dernier service professionnel rendu.

What it means

The authorization of digital is conditional and the condition has two limbs, not one: confidentiality, AND the concrete exercise of the rights of access and correction. A tool that protects well but from which a client's record can be neither extracted nor corrected does not comply with section 1. Added to that are section 2 — the record is kept “at the place where he practises his profession” — and the 5-year floor in section 10. Consolidated version read as up to date to 1 April 2026.

What we answer

On the second limb, the platform answers: conversations, documents and attachments export in full, a message can be corrected in place and the change leaves an entry in the audit log. On retention, the warning is the same as for every professional order: retention is not configurable and three of the product's timers cannot be turned off — transcriptions at 30 days, tool-produced files at 7 days, attachments staged but never sent at 48 hours. If one of those items belongs to the record, it will disappear before your 5 years: export it to your record system. We are not a certified clinical-record product and we do not claim to be one; the platform is a working tool alongside the record, not the record.

droit dur·2026-04-01·Official source

Ils doivent être détruits dès que la sage-femme a révisé et signé la note produite par le scribe IA. Il est fortement recommandé que ces 2 actions aient lieu à la fin de la consultation ou immédiatement après celle-ci. […] Un rappel verbal de l'utilisation du scribe IA est requis à chaque rencontre, en étant claire que le consentement peut être retiré à tout moment. […] L'utilisation et le nom du scribe IA utilisé doivent être mentionnés dans la note. […] Éviter les solutions qui conservent les données à l'extérieur du Canada.

What it means

This is the most precise Quebec opinion in existence on the automated transcription of a clinical encounter, and it sets four operational obligations: the recording and the verbatim are a draft, to be destroyed AS SOON AS the note is signed; the initial consent must be recalled verbally at EVERY encounter, with a fresh consent if the subject is particularly sensitive or if the software changes in a major way (the opinion gives as an example a transfer of data abroad); the name of the scribe used must appear in the note; and the order recommends avoiding solutions that keep data outside Canada. The opinion adds two legal consequences that few vendors mention: the recording and the transcription may be the object of a request for access to the record for as long as they have not been erased, and a PIA as well as a vendor contract — including a confidentiality undertaking signed by its staff — are required before use.

What we answer

We do transcribe, so we have to be exact about the gap. Transcriptions are deleted after 30 days by a timer that cannot be turned off: that is a floor, not destruction “as soon as the note is signed”. Nothing in the platform detects that a note has been reviewed and signed, and we issue no certificate of destruction. For as long as a transcription exists, it is reachable by a request for access, exactly as the opinion says. Three things are yours and the platform will not do them for you: the verbal recall of consent at each encounter, entering the name of the scribe in the note, and suspending the recording on a sensitive subject. On the recommendation to avoid solutions that keep data outside Canada: your instance and your data at rest are in Canada, in the Canada Central region (Toronto) by default, but inference leaves the country — the United States and France, plus a Singapore entity for video. The transcribed content therefore passes through a model outside Canada. We say so rather than let the opposite be believed.

attente du régulateur·2025-09-30·Official source

La sage-femme qui utilise un support faisant appel aux technologies de l'information pour le traitement et la conservation de tout ou partie des renseignements et documents relatifs à un dossier doit: 1° sauvegarder les données ainsi recueillies et en conserver une copie; 2° utiliser une base de données distincte de toute autre pour la tenue des dossiers visés par la présente section; 3° protéger l'accès à ces données, notamment par l'utilisation d'un mot de passe.

What it means

Paragraph 2 is the surprising one: the database must be SEPARATE FROM ANY OTHER for the keeping of records. This is not an encryption requirement or an access-control requirement, it is a compartmentalization requirement — the record does not share its store with anything else. Added to that are backup with a copy (para. 1), protection of access (para. 3), the 5-year floor in section 6 — the birth-summary note being excluded from the right of destruction at the expiry of the period — and section 7 on the confidentiality of retention. Section 1 recalls that digital is admitted only if sections 60.4 to 60.6 of the Professional Code are not thereby compromised. Consolidated version read as up to date to 1 April 2026.

What we answer

Your instance is dedicated: the database is shared with no other customer. But if you put clinical content into a conversation, it lives in the same store as all your other work — correspondence, management notes, research. That is not “a database separate from any other for the keeping of records” within the meaning of paragraph 2, and we will not claim the contrary: the platform is not a midwifery record system and is not certified as a clinical-record product. What we provide: per-user and per-group access, an audit log, a restrictable model catalogue — over what a user picks, not what the server keeps, full export. What we do not provide: guaranteed 5-year retention — retention is not configurable and timers that cannot be turned off delete transcriptions at 30 days, tool files at 7 days and attachments never sent at 48 hours — nor a certificate of destruction.

droit dur·2026-04-01·Official source

L'utilisation d'un SIA doit être expliquée de façon claire et accessible, en précisant ses avantages, ses limites et la manière dont les renseignements personnels ou de santé sont utilisés et stockés. Le consentement libre et éclairé de la clientèle est essentiel, et un refus ne doit jamais compromettre la qualité des soins ou des services offerts.

What it means

The statement expressly targets administrative use and record-keeping as much as clinical use — “Whether AI is used for administrative assistance, record-keeping, drafting or directly for clinical purposes”. The requirement quoted is the one that falls back on the vendor: you must be able to explain to the person how their information is USED and STORED, which presupposes knowing it. The statement also asks that you know how to “provide quality care and services if the person refuses the use of an AI system” — so a path without AI must exist. The order publishes no precise day: the page carries the mention “January 2026”.

What we answer

We give you what you need to make that explanation without approximation: the hosting region (Canada Central, Toronto, by default; a Quebec region only under private hosting), the list of model providers and their countries — the United States and France, plus a Singapore entity for video —, what is sent to them and what is not, retention periods, sub-processors by role, and the contract clauses: confidentiality (s. 14), incident notice without delay (14.9), annual audit (14.10), no training without your written authorization (14.2 and 14.7). Two clarifications that the transparency requirement makes mandatory rather than optional: retention is not configurable and some timers cannot be turned off; and restricting the model catalogue does not bind the calls the server makes on its own. On the right of refusal, the answer is simple and it is yours: nothing in the platform forces its use, but it is your organization that must provide the path without AI.

attente du régulateur·Janvier 2026·Official source

À l'expiration du délai prévu à l'article 10, le membre peut procéder à la destruction d'un dossier à la condition que celle-ci soit faite de manière à ce que la confidentialité des renseignements qui y sont contenus soit assurée. […] La présente section ne doit pas être interprétée de manière à exclure l'utilisation de l'informatique ou de toute autre technique pour la constitution et la tenue des dossiers, pourvu que la confidentialité des renseignements soit respectée.

What it means

The regulation frames both ends of a record's life: section 10 sets the 5-year floor from the last professional service rendered, section 11 makes destruction conditional on confidentiality, and section 9 requires premises or a cabinet kept locked “or otherwise” — the formula that covers logical access control. Section 12 authorizes computerization on the same condition. One particular clause for audiologists: section 15 requires that the calibration data of assessment instruments be kept for 5 years. Consolidated version read as up to date to 1 April 2026.

What we answer

The access control required by section 9 is in place: per-user and per-group access, an audit log, a restrictable model catalogue with a kill switch that binds administrators too — but not the calls the server makes on its own. On section 11, we have to be precise: the platform deletes, but it does not ATTEST — we issue no certificate of destruction, and if your order or a client asks you for proof of it, the audit log is the closest thing we have. On the 5-year period, the platform does not hold it for you: retention is not configurable, and timers that cannot be turned off destroy, before term, transcriptions (30 days), tool-produced files (7 days) and attachments never sent (48 hours). Keep the master copy of the record elsewhere and use the full export.

droit dur·2026-04-01·Official source

Les SIA reposent sur l'analyse de grandes quantités de données cliniques de nature délicate, ce qui accroît les risques liés à la confidentialité, à la sécurité des données et aux usages secondaires non consentis. […] La clientèle doit être informée de manière claire et compréhensible de l'utilisation de SIA dans sa prise en charge, du rôle réel de ces outils (offrir du soutien, et non prendre des décisions), des types de données utilisés et des limites de ces technologies

What it means

To classify honestly: this is neither a position statement nor a guideline, it is the thematic feature of the order's professional magazine — but the main article is signed by the Direction de l'exercice de l'hygiène dentaire, and therefore by the order itself, and its conclusion sets the expectation: “the integration of AI in dental hygiene must be considered in a prudent, gradual and supervised manner”. The passage quoted names the three risks that concern a vendor — confidentiality, data security, non-consented secondary uses — and then the duty to inform the clientele. The order signed the Montréal Declaration for a Responsible Development of Artificial Intelligence in 2018, and the issue publishes a summary of it. Published in April 2026 (the article's page put online on 24 April 2026); the feature runs from pages 15 to 32.

What we answer

“Non-consented secondary uses” is the phrase that calls for a contractual answer, and we have it: no training on your content without your written authorization (ss. 14.2 and 14.7), confidentiality (s. 14), incident notice without delay (14.9), an annual right of audit (14.10). For informing the clientele, we supply the material: the path a request takes, the hosting regions — Canada Central (Toronto) by default, a Quebec region only under private hosting —, the model providers and their countries (the United States, France, and a Singapore entity for video), retention periods, sub-processors by role. Two things to say out loud rather than in a footnote: the Law 25 detector is a paid option, disabled by default, and it is itself an outbound call to a model; and the model-catalogue kill switch does not bind the calls made by the server (the extraction of the text of a document added to a knowledge base, conversation titles, agent screenshots, Learning-module audio, mail triage). Finally, we are not a diagnostic-aid device and we do not analyse radiographs: the L'Explorateur feature talks a great deal about assisted diagnosis, and that is not what we do.

commentaire·Avril 2026·Official source

Rien dans la présente section ne doit être interprété comme excluant l'utilisation de l'informatique ou de toute autre technique pour la constitution ou la tenue des dossiers, livres et registres d'un hygiéniste dentaire, pourvu que l'exactitude et la confidentialité des renseignements soient respectés, ainsi que pour le maintien de ses équipements. […] Un hygiéniste dentaire doit conserver ou s'assurer que soit conservé chaque dossier pendant au moins 5 ans à compter de la date du dernier service rendu.

What it means

Two words not to skim over. First “accuracy”: section 9 admits computerization on condition that ACCURACY and confidentiality are respected — in a 1996 regulation, that is the integrity of the content, and it bears directly on a tool that drafts. Then “or ensure that they are kept” in section 13: the dental hygienist most often practises in a dentist's office, and the regulation nonetheless makes them answerable for the retention of the record, even when they do not hold it. Section 2 requires an office laid out so as to ensure that confidentiality is respected, and section 14 premises or a cabinet kept locked “or otherwise”. Consolidated version read as up to date to 1 April 2026.

What we answer

On accuracy, the honest answer is that no vendor can guarantee it: a model can produce a false statement with confidence, and the re-reading remains yours. What we provide to support it: the audit log time-stamps changes, a corrected message leaves a trace, and the model catalogue can be restricted. On confidentiality and access: per-user and per-group access, a contract providing for confidentiality (s. 14), incident notice without delay (14.9) and an annual right of audit (14.10). On retention, the gap is the same everywhere: retention not configurable, timers that cannot be turned off (transcriptions 30 days, tool files 7 days, attachments never sent 48 hours), no certificate of destruction, full export available. If you practise in a dentist's office, note that section 13 makes you responsible for the retention even of the record you do not hold: the platform does not relieve you of that.

droit dur·2026-04-01·Official source

Le présent chapitre ne doit pas être interprété de manière à exclure l'utilisation de l'informatique ou de toute autre technique pour la constitution, la tenue, la détention, le maintien et la conservation des dossiers et registres d'un technologue en imagerie médicale, d'un technologue en radio-oncologie ou d'un technologue en électrophysiologie médicale, pourvu que la sécurité, la confidentialité et l'intégrité des renseignements et des documents de ces dossiers ou registres soient respectées. […] Le technologue doit s'assurer de la confidentialité et l'intégrité de ses dossiers.

What it means

The striking fact here is an absence, and it deserves to be stated: as at 12 August 2026, the order has published NO position, no opinion and no guideline on artificial intelligence. Its “Avis et positions de l'Ordre” page contains none, and a site search for “intelligence artificielle” returns only training courses, a podcast and member profiles. That is notable for a profession where AI is already present in the room — assisted detection, image reconstruction, radiation-oncology planning. The applicable floor is therefore the general law: the Act respecting health and social services information, the Professional Code and the Code of ethics (T-5, r. 5), plus this regulation — a triple condition of security, confidentiality and INTEGRITY (ss. 1 and 8), retention of at least 5 years (s. 10) and holding in a place kept locked “or otherwise” (s. 11). Section 2 is worth knowing: where the workplace stands in the way of compliance with the regulation, the technologist must inform their employer in writing and then notify the order. Consolidated version read as up to date to 1 April 2026.

What we answer

Do not look for an attestation from an order that has not pronounced itself: it is your institution, through its person in charge of the protection of personal information, that will have to decide, and the privacy impact assessment under section 106 of Law 5 is triggered by the acquisition itself. What we put on the table: a dedicated instance hosted in the Canada Central region (Toronto) by default — a Quebec region exists only under private hosting —, inference outside Canada (the United States, France, and a Singapore entity for video), an audit log, per-user and per-group access, a restrictable model catalogue — over what a user picks, not what the server keeps, full export, and a contract that provides for confidentiality (s. 14), incident notice without delay (14.9), an annual audit (14.10) and a prohibition on training without written authorization (14.2 and 14.7). Two blunt limits on the integrity that section 8 requires: we are not a certified clinical-record product, and the platform neither processes nor interprets medical images. On retention: retention not configurable, timers that cannot be turned off, no certificate of destruction.

droit dur·2026-04-01·Official source

L'utilisation de l'intelligence artificielle (IA) est permise, mais comme pour tout autre outil utilisé dans le cadre de la pratique professionnelle, son usage doit être conforme aux lois et aux règlements qui encadrent la profession. […] Quelle que soit la technologie employée, les diététistes-nutritionnistes demeurent pleinement responsables et imputables du contenu produit. L'IA peut être un outil d'aide à la rédaction, mais elle ne peut en aucun cas se substituer au raisonnement clinique.

What it means

The question asked is exactly ours — can AI write the note in the record — and the answer is yes, subject to conditions. The order poses four preliminary questions, two of which bear on the vendor: are confidentiality and the protection of personal information ensured, and does the tool make it possible to comply with all the laws and regulations that govern the profession. It refers by name to the Code of ethics of dietitians, the Professional Code, the Regulation respecting the keeping of records by dietitians, the Regulation respecting the keeping of consulting rooms, Law 25, the Act respecting health and social services information and the Act respecting health system governance. Published on 18 June 2025, updated on 17 November 2025.

What we answer

On responsibility for the content, there is nothing to negotiate: the text produced is yours, errors included, and a model can assert something false with aplomb. On the two questions the order asks you to put to your vendor, here are our answers without evasion. Confidentiality: a dedicated instance, per-user and per-group access, an audit log, a contract providing for confidentiality (s. 14), incident notice without delay (14.9), an annual right of audit (14.10) and a prohibition on training on your content without written authorization (14.2 and 14.7) — but hosting in the Canada Central region (Toronto) by default, a Quebec region being offered only under private hosting, and inference outside Canada (the United States, France; a Singapore entity for video). Compliance with the record-keeping regulations: partial, and the gap is named below — retention is not configurable and timers that cannot be turned off delete some items before your 5 years. Treat the platform as a drafting tool alongside the record, never as the record.

attente du régulateur·2025-11-17·Official source

Rien dans le présent règlement ne doit être interprété comme excluant l'utilisation de l'informatique ou de toute autre technique pour la constitution et la tenue des dossiers d'un diététiste. […] Un diététiste doit conserver chaque dossier pendant au moins 5 ans à compter de la date du dernier service rendu.

What it means

The regulation is short and old, and that is precisely what makes it a trap: section 1.03 authorizes computerization WITHOUT attaching any condition of confidentiality to it, unlike the equivalent regulations of the other orders. Do not conclude from that that hosting is unconstrained — the confidentiality obligation comes from elsewhere, from the Professional Code (s. 60.4), from the Code of ethics of dietitians and from Law 25 — but it does mean that this particular regulation will give you no technical benchmark. Section 2.04 sets the 5 years, section 2.05 requires premises or a piece of furniture to which the public does not have free access. Consolidated version read as up to date to 1 April 2026.

What we answer

The regulation's silence is not a permission, and we will not present it as one: your confidentiality obligation rests on the Professional Code and on Law 25, and it applies in full to what you put into the platform. What we offer: per-user and per-group access, an audit log, a restrictable model catalogue with a kill switch that binds administrators too — but not the calls the server makes on its own, full export, and the usual contractual commitments. What we do not offer: retention configurable over 5 years. Three hard-coded timers destroy before term — transcriptions at 30 days, tool-produced files at 7 days, attachments staged but never sent at 48 hours — and there is no certificate of destruction. Keep the master record in your record system.

droit dur·2026-04-01·Official source

Le membre doit donner suite, avec diligence et au plus tard dans les 30 jours de leur réception, aux demandes écrites d'accès à des documents, de correction et de suppression de renseignements ainsi que de versements de commentaires au dossier formulées par un patient et visées aux articles 60.5 et 60.6 du Code des professions (chapitre C-26).

What it means

The Order has no records regulation of its own — the record belongs to the institution, and section 51 refers expressly to the Access Act (chapter A-2.1) and to the health-network governance statutes for those practising in a public body. What follows you personally is the deadline: 30 days to answer a request for access, correction or deletion, plus the secrecy duty of section 48, which asks you to avoid even revealing that a person has used your professional services.

What we answer

On the 30 days, the question is not whether the platform is fast: it is whether you can find what a patient asks you for. An administrator locates and removes a named person's data — conversations, documents, knowledge bases — using per-object rights and the audit log, but case by case, with no self-service portal and no committed contractual deadline. If you practise in an institution, section 51 returns you to the institution's regime anyway, and it is the institution that decides what may be put in here. On section 48, one precision that matters for an order where many members work in teams: sharing outside your organization is on by default, and that is a setting to make beforehand, not afterwards.

droit dur·À jour au 1er avril 2026·Official source