Here our answer includes a no — and you’re better off reading it before you sign

Tout renseignement détenu par un organisme est confidentiel et, sous réserve du consentement exprès de la personne qu'il concerne, il ne peut être utilisé ou communiqué que conformément à la présente loi. […] un renseignement est considéré détenu par un organisme même lorsque ce dernier en confie la conservation à un tiers.

What it means

The third paragraph is the one that matters for a vendor: you remain the holder of the information, and therefore responsible for protecting it, even when you entrust its storage to someone else. Outsourcing the hosting outsources none of your responsibility.

What we answer

The contract provides that you remain the owner of your data and that we process it only for an enumerated list of purposes: you remain the holder within the meaning of Law 5, and we act on your behalf. We give you the material to demonstrate it — the data flow, the regions, the sub-processors by role, the contractual commitments.

hard law·Assented to 4 April 2023; in force 1 July 2024; text read as up to date to 1 April 2026·Official source

Un tel mandat ou un tel contrat doit être, selon le cas, confié ou conclu par écrit et, lorsque la personne ou le groupement à qui il est confié ou avec qui il est conclu n'est pas un organisme, prévoir, sous peine de nullité:

What it means

“On pain of nullity” — the wording is rare and it is decisive. The contract must provide for: security measures that comply with the applicable rules, use strictly limited to the contract, a signed confidentiality undertaking, products authorized by the body, notice without delay of any breach OR ATTEMPTED breach, a right of audit, and the return of the information and its secure destruction at the end of the term.

What we answer

Our master agreement covers most of these requirements, and sometimes word for word: section 14.9 already covers “any breach or attempted breach”. But it was not drafted as a section 77 contract, and some elements are not expressly in it — the signed confidentiality undertaking, return at no cost, certified destruction. For a body covered by Law 5, an addendum is necessary, and we say so rather than leave a doubt hanging over a possible nullity.

hard law·In force; text read as up to date to 1 April 2026·Official source

Avant de confier un mandat ou de conclure un contrat de service ou d'entreprise impliquant une communication d'un renseignement à l'extérieur du Québec, l'organisme qui le détient doit s'assurer qu'une évaluation des facteurs relatifs à la vie privée a été réalisée. […] Il en est de même lorsque l'organisme confie […] à l'extérieur du Québec la tâche de […] conserver pour son compte un renseignement.

What it means

Same architecture as section 17 of Law 25: it is not a ban on leaving Quebec, it is a condition. Prior assessment, a conclusion of adequate protection, a contract. And the third paragraph expressly captures the mere fact of entrusting storage to a third party outside Quebec.

What we answer

Your instance is hosted in Canada, in the Canada Central (Toronto) region by default, so not inside the province of Quebec. For Law 5, any province other than Quebec is “outside Québec” exactly as Virginia is — the threshold is provincial. Microsoft's residency commitment is to Canada, not to the province of Quebec: it expressly reserves the right to copy customer data between Canadian regions, and provides that personnel located outside Canada may access it remotely. Hosting in a Quebec region, available only under private hosting (the shared cloud has only one Canadian region), therefore moves processing closer to Quebec without contractually guaranteeing it. Your privacy impact assessment therefore has to conclude on adequate protection, not on a location.

hard law·In force; text read as up to date to 1 April 2026·Official source

Un organisme doit procéder à une évaluation des facteurs relatifs à la vie privée de tout projet d'acquisition, de développement et de refonte de produits ou services technologiques ou de système de prestation électronique de services lorsque ce projet implique la collecte, la conservation, l'utilisation, la communication ou la destruction de renseignements qu'il détient.

What it means

The trigger is ACQUISITION, not leaving Quebec: any project to acquire, develop or redesign a technological product or service is caught as soon as it involves collecting, keeping, using, releasing or destroying information the body holds. The assessment bears on the “project”, so it precedes signature. The text provides no exception for a use outside the clinical record, and the Collège des médecins says the same thing on its side: a few lines from the sentence we quote below, in the requirement on the Collège des médecins, it writes that all AI tools in health must have been the subject of a PIA, generally carried out by the person responsible for the protection of personal information at the place where the tool will be used. That is a requirement distinct from the one in section 78, which is triggered by a communication outside Quebec.

What we answer

Guard against reading this too quickly: one might think that a use outside the clinical record — administrative work, correspondence, drafting — deploys with no formality. It does not — the acquisition itself triggers a PIA, and neither the dedicated instance nor Canadian hosting exempts you from it. What we provide: the path a request takes, the hosting regions, the list of model providers and their countries, the sub-processors by role, the commitments in the contract, the audit log and the model catalogue restricted by the administrator — enough to fill in the assessment. The assessment must also cover the calls the server makes on its own, which the catalogue restriction does not bind: extracting the text of a document added to a knowledge base or pulled from a connector, and the Law 25 detector if you enable it. What we cannot do: carry it out. It belongs to your privacy officer, and it happens before acquisition, not after deployment.

hard law·In force 1 July 2024; text read as up to date to 1 April 2026; Collège des médecins position published 26 February 2026·Official source

Un organisme doit inscrire dans un registre tout produit ou service technologique qu'il utilise. […] L'organisme doit publier ce registre sur son site Internet ou, à défaut, le rendre accessible au public par tout autre moyen approprié.

What it means

The most frequently ignored obligation in Law 5, and it reaches the private practice: Schedule II, paragraph 1, covers the “private professional’s office”, which section 481 of the Act respecting the governance of the health and social services system defines as the enterprise in which physicians, dentists or other professionals practise on their own account. A solo practitioner is therefore a body, and the register must be PUBLISHED, not merely kept.

What we answer

Our product has to appear in that register, and entering it there is on you. We give you what you need to describe it honestly: product name, vendor and its country, purpose, categories of information processed, hosting regions, sub-processors by role. Ask us for that sheet — it is written to be pasted straight into your register.

hard law·2023, c. 5; in force; text read as up to date to 1 April 2026·Official source

Un organisme doit analyser mensuellement les accès aux renseignements qu'il détient et toutes autres utilisations et communications de ceux-ci […]. Malgré le premier alinéa, un organisme visé à l'annexe II de la Loi sur les renseignements de santé et de services sociaux (chapitre R-22.1) a l'obligation d'effectuer une telle analyse au moins une fois par année.

What it means

A private practice falls under the second paragraph: the analysis of accesses is annual, not monthly. Added to it are irreversible destruction (s. 12), a written contract as soon as destruction is entrusted to a third party — it must set out the processes used, where applicable the third party’s obligation to report regularly, and the obligation to notify the body if it engages someone else to perform the contract (s. 13) —, proof of destruction to be retained (s. 14), and a reassessment of the technological product every two years (s. 17).

What we answer

The audit log gives you the material for the annual analysis: authentications, impersonations and administrative changes, time-stamped, with the authentication log sealed by cryptographic chaining. Two things we do not issue today: the certificate of destruction section 14 asks for, and the destruction clauses section 13 requires in the contract when you entrust destruction to us — processes, reporting, notice of subcontracting. Those are the two points to settle in the order form if Schedule II covers you.

hard law·M.O. 2024-010; in force 1 July 2024; text read as up to date to 1 April 2026·Official source

Si l'incident présente un risque qu'un préjudice sérieux soit causé, l'organisme doit, avec diligence, aviser le ministre et la Commission d'accès à l'information.

What it means

Two recipients, not one: the Minister AND the Commission, plus every individual concerned. And the trigger is broader than elsewhere — the obligation arises as soon as there are grounds to believe an incident has occurred OR IS LIKELY to occur. On destruction, the regulation requires it to be secure, suited to the medium and irreversible, with proof retained.

What we answer

The contract obliges us to notify you without delay, with the nature of the incident, the people affected, the period and the measures taken. The two regulatory notices — to the minister and to the Commission — remain yours, and we give you the material to draft them. On destruction, the deletions you request are propagated; the formal certificate of destruction is a deliverable we do not yet issue.

hard law·Act in force; regulation in force 1 July 2024·Official source

Pour la constitution, la tenue, la détention, le maintien et la conservation de tout dossier clinique, [...] le médecin utilise un produit technologique certifié conformément aux dispositions d'une loi dont l'application relève du ministre de la Santé et des Services sociaux.

What it means

The clinical record must sit on a certified product — certification now belongs to Santé Québec. Section 10 carries a proviso that has to be read: it excepts the records covered by sections 7, 8 and 9, including expert-assessment records. Do not take it for a green light — the Collège still targets expert reports in its February 2026 position. The deadlines differ depending on where you start from: section 49 covers the physician already on an uncertified technological medium as of 11 July 2024; one still on paper falls under section 47, so 1 January 2027, or 2030 for a physician who has practised alone for thirty-five years. Section 11 of the same regulation adds requirements about the PRODUCT itself, and they bear on us directly: the physician must ensure that the technological product neither carries nor broadcasts advertising and promotes no product, service or supplier. A model catalogue presented as a commercial showcase would breach that; ours is a list of options the administrator restricts.

What we answer

The platform is built for the work around care — administrative writing, correspondence, monitoring, training, non-clinical documents — and not for keeping the clinical record itself, which must sit on a product certified by the Bureau de certification. We are not, and we will not let that be assumed in order to close a sale: this is precisely the kind of grey area that gets paid for at inspection.

hard law·In force 11 July 2024; compliance required no later than 31 December 2026·Official source

Il n'est donc pas adéquat de verser des rapports de consultation ou d'expertise, des dossiers cliniques ou des portions de ceux-ci […] dans un outil d'IA non certifié par le MSSS, comme c'est le cas pour les outils d'IA générative grand public (ex. : ChatGPT, Copilot, Gemini, etc.) ou même pour certaines solutions destinées aux professionnels de la santé (ex. : OpenEvidence, UpToDate, etc.)

What it means

The Collège’s criterion is certification, and it targets putting a clinical record into the tool. The end of the sentence counts as much as the start: the Collège also names tools designed for clinicians, not only consumer assistants. For a scribe, it requires a certified tool and the patient’s consent at first use, a reminder at subsequent visits, and fresh consent if the subject matter becomes more sensitive or if the tool changes. Worth noting too, because it is easily overlooked: section 20, paragraph 8 of the Code of ethics of physicians requires the physician to take reasonable means to ensure that professional secrecy is preserved “when he uses, or when persons collaborating with him use” information technologies. That is the baseline IT standard in a physician’s practice, and it reaches his collaborators as much as himself.

What we answer

We are not certified, so this position applies to us. For a while we wrote here that “for everything that is not the clinical record” the platform is used with no further formality: that was false, and the same CMQ section says so six lines further down — every AI tool in health must have been the subject of a privacy impact assessment, with no exception for uses outside the clinical record. What we deliver remains an instance dedicated to your practice, hosted in Canada, and we supply the material for that assessment; it is your privacy officer who carries it out. If certification is what you need to go further, tell us: that is the kind of request that changes our priorities.

regulator expectation·Published 26 February 2026·Official source

Le médecin conserve tout dossier clinique pendant une période d'au moins 10 ans suivant la date de la dernière inscription au dossier ou suivant la date de la fin de l'intervention en santé publique, selon la plus éloignée des échéances.

What it means

Ten years, not five — the “five years” people repeat comes from the old regulation. The clock restarts at the last entry. Expert-assessment records are kept ten years from the end of the mandate or the final judgment, research records fifteen years, and registers ten years (s. 18).

What we answer

No configurable purge applies to what you save, but three of the product's clocks reach a record and know nothing of your ten years: transcriptions at 30 days, tool-produced files at 7 days, attachments never sent at 48 hours. But ten years is long for a working tool: the clinical record belongs in a certified product, and whatever you keep here has to be exported to your archive.

hard law·In force 11 July 2024; text read as up to date to 1 April 2026·Official source

5° obtient préalablement du client une autorisation écrite pour faire un enregistrement audio ou vidéo d'une entrevue ou d'une activité; cette autorisation spécifie l'usage ultérieur de cet enregistrement ainsi que les modalités de révocation de cette autorisation;

What it means

Two distinct rules. Paragraph 1 prohibits disclosing information about the client, except with formal written authorization — or verbal authorization in an emergency — or where the law so orders; section 18 adds the prevention of an act of violence. Paragraph 5 targets “an audio or video recording”: a scribe that captures the voice falls under it, assisted note-taking without capture does not. And the authorization must specify “the subsequent use” — so processing by the platform has to be named in it, not implied. Two companions from the same regime: section 11, paragraph 3 requires the psychologist to explain, BEFORE the service, “the rules on confidentiality and their limits as well as the modes of transmission” — recourse to a third-party platform is precisely a limit and a mode of transmission, so it is named at the consent stage. And the nurse has an exact equivalent: section 32.1 of her code requires prior written authorization before any audio or video recording of an interview, specifying the intended use.

What we answer

The platform can transcribe and summarize, but it does not ask for any authorization on your behalf and keeps no record of one as such. The written authorization, its scope and its revocation remain your file — and if the client revokes it, deleting the recording and everything derived from it is on you, which the platform allows but does not automate.

hard law·O.C. 439-2008; version read as up to date to 1 April 2026·Official source

Le psychologue peut utiliser l'informatique ou toute autre technique pour la constitution et la tenue de ses dossiers pourvu que la confidentialité des renseignements qui y sont contenus soit assurée. […] Le psychologue doit conserver chaque dossier pendant au moins 5 ans à compter de la date du dernier service professionnel dispensé.

What it means

Computerization is permitted, but not on its own: section 1 requires the record to be kept “at the place where he practises his profession” and section 7 requires it to be in a cabinet locked by key or otherwise. Five years is a floor, counted from the last service; destruction falls under section 9 and must preserve confidentiality. In an institution, sections 8 to 10 are set aside by section 12.

What we answer

No configurable purge applies to the content you save, and the record exports. Three timers are hardcoded and reach a record directly — transcriptions at 30 days, tool-produced files at 7 days, attachments staged but never sent at 48 hours: if one of them holds a piece of your record, that is where your five-year floor is decided, and you have to export it first. On the place of practice: hosting with a third party is not, on its own, keeping the record “at the place where you practise”. Those are the timers that reach a record; other clocks exist elsewhere in the product, and the Confidentiality and compliance page publishes the full inventory.

hard law·O.C. 448-92; sections 2 and 8 unchanged since 1992; text read as up to date to 1 April 2026·Official source

Sans restreindre la portée de l'article 3, un psychologue évite de verser dans un dossier toute donnée brute qui n'a pas fait l'objet d'un traitement ou toute information non vérifiée susceptible de porter préjudice au client.

What it means

Two things stay out: raw data that has not been processed, and unverified information liable to prejudice the client. It is a rule about what GOES INTO the record, and section 3, paragraph 10 completes it by requiring the psychologist’s signature on every entry: what goes in is therefore processed, reviewed and signed. The Code of ethics adds a rule on the way out — raw, uninterpreted data related to an assessment or inherent in a psychological consultation is released to no one other than a psychologist (C-26, r. 212, s. 49), and section 50 covers test protocols. The Ordre writes it itself in “Les notes au dossier”: a note is a summary of the professional services rendered, not a verbatim transcript.

What we answer

The platform transcribes an interview and summarizes a document, and neither is an entry in the record until the professional has written one. A transcription is raw data; an unreviewed summary is unverified information; nothing we produce carries your signature. We put no mark on generated content: once exported, nothing in the text will say it came from a model, and identifying it is on you. Section 49 also poses a question to settle BEFORE uploading: inference runs at model providers established outside Quebec, several of them in the United States, which are not psychologists — raw assessment data or a test protocol should not be sent there until you have concluded that the section permits it. Confidential mode and the model catalogue restricted by the administrator are there to frame that choice, not to make it for you. One caveat that counts here: this restriction binds the models the user picks, not the ones the server keeps — extracting the text of a document added to a knowledge base goes through a proprietary model fixed in the code — a scanned document reaches it whatever your restriction says, whereas a file attached to a conversation goes through the user's own model.

hard law·O.C. 448-92; text read as up to date to 1 April 2026; “Les notes au dossier”, Psychologie Québec, March 2020·Official source

1° sauvegarder les données ainsi recueillies et en conserver une copie; 2° utiliser une base de données distincte de toute autre pour la tenue des dossiers visés par la présente section; 3° protéger l'accès de ces données, notamment par l'utilisation d'un mot de passe.

What it means

Three technical obligations as soon as a computerized medium serves the record: a backup with a copy kept, a database separate FROM ANY OTHER, and protected access. Retention is at least five years from the CLOSING of the record (s. 9, para. 1), and section 8 wants the record in the office premises or in an appropriate archiving location.

What we answer

Every client gets a dedicated instance with its own database: that settles separation between clients. Watch the exact reach of section 4, paragraph 2 — “separate from any other” also covers your own other uses, so do not mix your client records with a general-purpose workspace in the same instance. Backups run as continuous archiving, access goes through your identity provider, with per-object rights and an audit log.

hard law·Decision of 19 December 1996; version read as up to date to 1 April 2026·Official source

Un logiciel de traitement de texte qui n'a pas été conçu expressément pour produire des notes au dossier (p. ex. : Word) ne permet pas d'assurer une inaltérabilité de la note. Ainsi, les notes produites à l'aide de ces outils doivent être imprimées, signées et considérées au même titre que des notes manuscrites.

What it means

The standard does not condemn the tool: it finds that software not expressly designed to produce entries in a record cannot ensure their unalterability, and it draws a procedural consequence — a note produced with such a tool must be printed, signed and treated in the same way as a handwritten note. Rule 3.2.2 further expects the nurse to authenticate so that her entries are tied to her, and rule 4.2 that a trace of earlier versions remains available. The 2023 standard applies to all members, in institutions as in private practice.

What we answer

Let us say it without hedging: our platform is a conversation and drafting tool, not a clinical documentation system, and it was not designed to produce entries in a record. A note written here therefore falls exactly into the case described by rule 3.2.2: printed, signed, treated as a handwritten note. What we can show goes in the right direction without being enough — named accounts, per-user and per-group access, an audit log, and message editing that leaves an entry in the log. But that trace documents a conversation on our side, not the successive versions of an entry in your record: the unalterability the standard requires is decided in the system that holds the record, and that system is not ours.

regulator expectation·2023 (ISBN 978-2-89229-755-3); replaces the 2002 Énoncé de principes; PDF read in full text on 11 August 2026·Official source

Le psychologue permet, avec diligence et au plus tard dans les 30 jours de la réception d'une demande écrite à ce sujet, à son client ou à toute personne qui dispose de l'autorisation de ce dernier, de prendre connaissance ou d'obtenir copie des documents qui le concernent dans tout dossier constitué à son sujet.

What it means

The period runs from RECEIPT of the written request, it is 30 days at most, and it bears on “the documents concerning him in any record made in his respect” — so on items, not only on the entry in the record. Section 21 grants the same period for correction. The same thirty days appear at the OIIQ (I-8, r. 9: s. 61 for access, s. 64 to correct, delete or file comments) and at the Collège des médecins (M-9, r. 17, s. 99 to correct or delete, and s. 94, shorter: twenty days to give access). One proviso not to be glossed over: the periods in the nurses’ code apply to practice outside the public sector; in an institution, section 59 refers to the Act respecting Access.

What we answer

Conversations, documents and attachments export, and editing a message leaves an entry in the audit log — enough to produce a copy and correct within the period. But there is a collision here you had better know about before you sign: our transcriptions are purged at 30 days, the timer cannot be disabled and there is no configurable retention. A request received on day 25 can therefore see the item asked for disappear DURING your response period, and for a physician, whose access is given in twenty days, the margin is thinner still. The practical rule fits in one sentence: the moment a request arrives, export the transcription and the files concerned that same day, before you even draft the reply. We cannot lengthen the timer for you, and we would rather write it here than let you find out on day 30.

hard law·O.C. 439-2008; for the OIIQ, O.C. 1513-2002 and O.C. 836-2015; for the Collège des médecins, O.C. 1213-2002; texts read as up to date to 1 April 2026·Official source

Le membre doit conserver tous ses dossiers dans le local de son cabinet de consultation réservé à l'exercice de sa profession ou dans un lieu d'archivage approprié.

What it means

Two places are allowed, and it is the second that concerns us: the consulting-room premises reserved for practice, or an “appropriate archiving location”. The regulation does not say what makes a location appropriate, names neither cloud computing nor any country, and therefore does not prohibit custody by a third party — but it is a rule about PLACE, and “your data stays in Canada” is not an answer to it. The other orders have their own, sometimes narrower: the psychologist keeps the record “at the place where he practises his profession” (C-26, r. 221, s. 1), the pharmacist likewise (P-10, r. 23, s. 2.01), and the dentist must keep his records, or ensure that they are kept, in premises or a cabinet to which the public has no access or that can be locked (D-3, r. 16, s. 21). That “ensure that they are kept” is aimed precisely at custody by a third party: the responsibility follows the record all the way to us. One provision makes computerization possible and states its condition: section 1 of the same regulation specifies that nothing in the division is to be interpreted as excluding a computerized medium, provided the process compromises neither professional secrecy (s. 60.4 of the Professional Code), nor the client’s right to consult and obtain a copy (60.5), nor his right to have it corrected (60.6).

What we answer

Your instance is dedicated and hosted on Azure, in the Canada Central (Toronto) region by default and a Quebec region only under private hosting, with encryption in transit and at rest, per-user and per-group access lists, and an audit log. That is enough to document a place, not enough to stand in for one: hosting with us is not, on its own, keeping your record at the place where you practise. For the texts that allow only the place of practice, the prudent reading remains the one we hold elsewhere on this page — the platform is a working tool, and the record lives where you practise. For the OIIQ the question is more open, and it is you who must conclude that a Canadian data centre constitutes an “appropriate archiving location”: we supply the material — region, sub-processors by role, access controls, contractual commitments — and not the conclusion.

hard law·Decision 96-12-19, s. 8; the texts of the three other orders date from 1992, 2004 and 1981 respectively; all read as up to date to 1 April 2026·Official source

Toutefois, il ne peut détruire un original qui appartient à un client sans avoir obtenu l'autorisation de celui-ci ou sans lui avoir donné la possibilité de le reprendre.

What it means

The rule is not about a duration but about OWNERSHIP of the item: an original belonging to the client may not be destroyed either without his authorization or without his having been given the opportunity to take it back. A deletion that happens by itself offers neither. The Collège des médecins draws the opposite conclusion for a different item: its fact sheet on the AI scribe requires the recording and the verbatim transcript to be destroyed as soon as the physician has reviewed and signed the note, because they remain seizable by an access request for as long as they exist. The two requirements do not contradict each other — they cover different items — but they pull a platform in two opposite directions.

What we answer

Three of the product's timers are hardcoded and cannot be disabled: transcriptions at 30 days, tool-produced files at 7 days, attachments staged but never sent at 48 hours; no retention is configurable. In the OIIQ’s direction, that is a defect and we say so: if the only copy of an original belonging to your client passes through one of those three routes, its deletion will happen without authorization and with no opportunity to take it back, which section 9 prohibits — so never let an original live there, export it the same day. In the Collège’s direction it is an advantage, and a fortuitous one: a transcription will not survive thirty days with us, which goes in the direction the scribe sheet asks for, without exempting you from destroying it as soon as you sign. The same timer is therefore a risk in one case and a rescue in the other, depending on the item it carries off. And in both cases, we issue no certificate of destruction. Those are the timers that reach a record; other clocks exist elsewhere in the product, and the Confidentiality and compliance page publishes the full inventory.

hard law·Decision 96-12-19, s. 9; text read as up to date to 1 April 2026; Collège des médecins fact sheet “Utilisation d’un scribe IA”, 28 January 2025·Official source

Si toutefois l'optométriste opte pour un fournisseur à l'extérieur du Québec, il doit alors s'assurer que des protections similaires à celles du Québec sont offertes en vertu des lois susceptibles de s'appliquer aux données.

What it means

Let us be exact about the force of this text, because the nuance is the whole point: hosting in Quebec is “preferable”, not mandatory — it is a preference. What does become mandatory is the VERIFICATION, the moment you go outside Quebec. The optometrist must then establish that the laws applicable to the data offer protections similar to Quebec’s, which presupposes knowing which country the data resides in and which regime it falls under. The obligation rests on the professional, not on the provider.

What we answer

Our default region is Canada Central (Toronto): outside Quebec, so you are in the case that triggers the verification, and our job is to give you the material for it rather than a conclusion. We document the Canadian hosting region and its paired region, the list of model providers and their countries, what is sent to them and what is not, and what the contract commits to. Three points we do not hide. First, the host’s residency commitment is to CANADA, not the province, and it reserves the copying of data between Canadian regions. Second, that same section 1.5 states two other preferences we do not meet: it favours a method in which the provider and the intermediaries can “never” access the informational content of the data — a “zero knowledge” service — and that is not our architecture; encryption is in transit and at rest, but processing requires access in the clear. Third, it favours secure services intended specifically for health professionals, and we are a general-purpose AI platform. The equivalence analysis remains yours, and those two gaps are part of it.

regulator expectation·Decision of the board of directors of 18 October 2019·Official source

Les informations contenues dans les requêtes pourraient être retransmises lors d'interactions avec d'autres personnes, au risque de communiquer des renseignements personnels et des informations de santé, sans avoir obtenu de consentement préalable.

What it means

This is the Quebec order that goes furthest against CONSUMER generative AI: it holds that the risks of those systems “far outweigh the benefits”. The mechanism it describes is precise — what is typed into a prompt can resurface in other users’ interactions, which would amount to disclosing health information without consent. So the question to put to a vendor is not “are you secure?” but “what do you do with what is typed in?”.

What we answer

Let us start with the mechanism the Ordre describes, because that is the question: consumer systems use interactions to improve their algorithms, so an input can resurface for someone else. That reuse happens at the MODEL PROVIDER, not in the partitioning between clients — a dedicated instance does not neutralise it, since the computation runs at third-party providers, several of them in the United States. What we can show: the console displays, provider by provider, the published training and retention policy, the model catalogue is restricted by the administrator, and our contract prohibits using your content to train a public model without your written authorization. What we cannot claim: that those policies bind us rather than their authors — our contract binds us to you, it does not bind OpenAI, Anthropic or Google. The partitioning, for its part, is real and worth stating: your database is yours, access is per user and per group, nothing is pooled with another organization. The Ordre finally raises hosting outside Quebec: our default region is Toronto, and a Quebec region exists only under private hosting. Choosing the model provider therefore remains a decision to be taken with your eyes open, not a risk cancelled by the dedicated instance.

regulator expectation·20 December 2023·Official source

L'ergothérapeute doit s'assurer de la sécurité des données sauvegardées dans l'infonuagique, comme indiqué selon l'indicateur 3.22 du Cadre de référence sur les aspects clinico-administratifs liés à l'exercice de la profession d'ergothérapeute dans le secteur privé (juin 2015).

What it means

The obligation is personal: it is the occupational therapist who must ensure the security of data placed in the cloud. It does not delegate to the provider, and it is not presumed from the provider announcing it. The guideline sets the benchmark by cross-reference to indicator 3.22 of another of the Ordre’s documents, the Cadre de référence of June 2015 — that is where you have to go and read what is actually expected.

What we answer

We supply what is needed to make that demonstration: encryption in transit and at rest, a dedicated instance, per-user and per-group access, an audit log, a documented hosting region, and security clauses in the contract with an annual audit right. What we will not do is claim to satisfy indicator 3.22: we have not read the 2015 Cadre de référence, and compliance announced with a document one has not opened is worth nothing. If your inspection relies on it, send it to us and we will answer point by point.

regulator expectation·April 2025·Official source

Il doit conserver ce dossier à l'endroit où il exerce sa profession. […] Le travailleur social peut utiliser l'informatique ou toute autre technique comme moyen additionnel pour la tenue de ses dossiers pourvu que la confidentialité des renseignements qui y sont contenus soit assurée.

What it means

The most constraining provision in this whole body of rules, and it turns on two words. Computerization is an “additional” means — a supplement, not the medium of the record — and the record is kept at the place where you practise, in premises or a lockable cabinet (s. 5). The retention floor is five years from the last service (s. 6), set aside in an institution (s. 8).

What we answer

Let us put it plainly: in independent practice, our platform cannot be your only record system. This 1988 text does not allow it, and no quality of hosting changes that in the slightest. Use it as a working tool, keep the record where you practise, and export whatever has to go back there.

hard law·O.C. 929-88; a 1988 text never modernized; read as up to date to 1 April 2026·Official source

Le membre qui désire enregistrer une entrevue obtient préalablement l'autorisation écrite de son client, de son représentant légal ou, s'il s'agit d'un mineur de moins de 14 ans, du titulaire de l'autorité parentale ou du tuteur. Cette autorisation doit spécifier l'usage projeté de cet enregistrement ainsi que les modalités de sa révocation.

What it means

The same rule as for psychologists, and it is often presented as theirs alone: it applies identically to the social worker. Any transcription of an interview by a tool triggers section 27, and the Ordre’s opinion on AI confirms it — consent becomes mandatory as soon as the system records, locates or profiles the client. Section 2 of the same code closes a frequent escape hatch: the duties arising from the Professional Code “are in no way modified by the fact that the member carries on his professional activities within a partnership or company”. Section 22 further prohibits him from limiting his civil liability — no clause of our contract can stand in for that.

What we answer

The platform can transcribe, but it asks for nothing on your behalf and keeps no trace of the authorization. The written authorization, the statement of the intended use — therefore of our processing — and the revocation terms remain your file. If the client revokes, deletion is possible, but you are the one who triggers it.

hard law·O.C. 97-2020; in force since 1 November 2020; read as up to date to 1 April 2026·Official source

Le membre donne suite, avec diligence et au plus tard dans les 30 jours de sa réception, à toute demande écrite d'un client souhaitant prendre connaissance ou obtenir copie des documents qui le concernent dans tout dossier constitué à son sujet.

What it means

Thirty days, and access is free — only transcription, reproduction or transmission charges are allowed. Section 71 adds correction or deletion within the same period, then, WITH THE CLIENT’S CONSENT, transmission at no charge of a copy of the corrected information to any person FROM WHOM the member had received that information — with no time limit for that one — as well as to any person to whom it was disclosed in the preceding six months.

What we answer

Conversations, documents and attachments export, and a message can be corrected in place with an entry in the audit log — enough to hold the thirty days. What the platform does not do: find out from whom you obtained a piece of information, or to whom it was disclosed over the past six months. That chain stays yours, and passing the correction on remains conditional on the client’s consent — it is not a broadcast the member triggers of his own accord.

hard law·O.C. 97-2020; in force since 1 November 2020; read as up to date to 1 April 2026·Official source

Où sont stockées les données ? Sont-elles susceptibles d'être utilisées pour entraîner le SIA ou par une entreprise tierce ?

What it means

The Ordre asks, word for word, the questions every buyer will put to us, and ties them to sections 39, 42 and 43 of the Code — so a failure is actionable before the disciplinary committee. Note 8 goes further: it makes the 2016 telepractice standards applicable, “except as otherwise provided”, every time a member uses an AI system, not only in videoconferencing. Standard 5.03 draws from that the most concrete requirement for a buyer: informing the client of the mechanisms used to secure and back up the records — the text expressly names the “third-party server” — and of how long they will be archived before destruction. The member therefore has to be able to repeat to the client what we tell him.

What we answer

The question contains two, and they do not have the same answer. Where the data is stored: hosting in Canada by default, Toronto by default, Quebec only under private hosting, region and paired region documented, sub-processors published by role. Whether it is liable to be used to train the AI system or by a third-party company: our contract prohibits using your content to train a public model without your written authorization, but the prompts travel through third-party model providers, and it is their published policies — which the console displays provider by provider — that govern what they do with them. We give you the material to answer that second half honestly, not the material to answer “no” on the provider’s behalf. Standard 5.03 additionally requires you to tell your client about the backup mechanisms and the archiving period — ask us for that sheet for your deployment; we produce it.

regulator expectation·26 March 2026, revised 9 April 2026·Official source

Le dossier-patient doit être tenu à jour aussi longtemps que la personne visée par le dossier demeure un patient du pharmacien. Un dossier-patient ne peut être fermé définitivement qu'après une période d'inactivité d'au moins 2 ans, sauf en cas de décès. Dès qu'un dossier-patient est fermé définitivement, le pharmacien peut le détruire.

What it means

There is no retention period for the pharmacist, and the first sentence is what says so: as long as the person remains a patient, the record is kept up to date with no horizon. The two years are not a retention period but the precondition for an optional closing, and destruction is never mandatory. Two sections frame the medium: section 2.01 requires the record to be kept “at the place where he practises his profession”, but section 2.06 specifies that nothing in that division is to be interpreted as excluding “the use of computers or any other means” for the making and keeping of the patient record.

What we answer

No purge on our side will close a record, which is the right answer here: an automatic two-year retention would breach the section. On the medium, section 2.06 removes the ambiguity — computerizing the patient record is expressly permitted, unlike the “additional means” restriction imposed by the social workers’ regulation. What remains open is the place of practice in section 2.01: hosting with a third party is not, on its own, keeping the record at the pharmacy, and that question is not settled by our architecture.

hard law·R.R.Q., 1981, c. P-10, r. 19; consolidated text up to date to 1 April 2026·Official source

Le pharmacien ne doit divulguer à quiconque aucun code ou marque spécifique pouvant permettre l'utilisation de sa signature numérique ou, plus généralement, aucun autre moyen équivalent permettant de l'identifier et d'agir en son nom.

What it means

A rare section in Quebec codes, and cut to fit our subject: what it prohibits is DISCLOSING to anyone a code, a mark or “any other equivalent means of identifying him and acting in his name”. Nothing confines that wording to a password: an API key or the credentials of a shared service account fall naturally into the category. On our reading, an automation acting under a pharmacist’s identity raises the same question, even though the section does not expressly settle it — it targets disclosure of the means of identification, not automation as such. Section 15 adds that it is up to the pharmacist to put the security measures in place “in his pharmacy”, and section 63 that professional secrecy is lifted only by the patient or by law.

What we answer

Accounts are personal and attribution is per user. Two practical consequences for you: do not share an account in the dispensary — that is the heart of section 56 — and know that a service key hides no one. We wrote here that it was enough not to name it after a pharmacist; that was useless advice. The preamble sent to the provider carries the full record of the administrator who created the key — name, email, job title, department. The name of the key serves only to group reports together. The control therefore bears on WHO creates the key, not on how it is named. Name your keys by function. And ask yourself the question before automating: a task that runs “in your name” under an identity that designates you deserves to be examined in the light of this section, even though the text targets disclosure of the means of identification first.

hard law·O.C. 467-2008, s. 56; consolidated text up to date to 1 April 2026·Official source

Les codes d'accès et mot de passe génériques ne devraient pas être utilisés. […] Assigner un code d'identification à une seule personne […] La période de conservation minimale des journaux est de deux ans.

What it means

Two requirements, and they do not carry the same force: generic access codes and passwords “should not” be used — a conditional — whereas the minimum retention of logs “is two years”, in the indicative. Between the two, a clear rule: an identification code assigned to a single person. Section 5.2.5 adds what must appear in the contract when an external provider accesses the information: a WRITTEN mandate or contract, the measures ensuring the information is neither disclosed to third parties nor used for other purposes, an undertaking not to keep it after expiry, the possibility for the pharmacist to carry out any verification relating to that confidentiality, and notice without delay of any breach or attempt. It is the only IT reference document the Ordre has published, and it serves as the grid for the professional inspection committee.

What we answer

What we can demonstrate: named accounts, no need for a shared account, per-user and per-group access lists, a time-stamped audit log, and a written contract whose section 14 covers confidentiality, purposes, sub-processors, incidents and an annual audit right — that is, most of the clauses in § 5.2.5. Two reservations. Retaining logs for two years is not a setting we expose: there is no configurable retention on our side, and that duration is to be agreed in the order form rather than presumed. Non-retention after expiry, for its part, runs into what we concede elsewhere on this page: we do not issue a certificate of destruction. The rest remains yours — section 15 of the Code of ethics makes putting the measures in place a personal obligation of the pharmacist, and nothing technically stops us from opening an account that two people will share at the counter: that prohibition is one you hold.

regulator expectation·Legal deposit 3rd quarter 2011; the PDF carries no day date; no later edition, and URL verified live on 11 August 2026·Official source

Le dentiste doit signer, parapher ou identifier toute information ou inscription notée dans le dossier par lui-même ou toute autre personne. Il doit assurer l'intégrité et l'inaltérabilité des renseignements qui sont contenus au dossier.

What it means

The provision that bites hardest on a generative AI. “Any other person” means that a note drafted or summarized elsewhere and then filed into the record must stay attributable and be identified by the dentist. Retention is five years following the last entry “of any kind, or insertion” (s. 22) — so a new radiograph restarts the clock for the whole record.

What we answer

The platform keeps the full history of every exchange, which makes it possible to trace what was produced with AI. What it does not do: mark an output as AI-generated, or guarantee the unalterability of content once it has been exported to you. Pasting a generated note into the record without identifying and signing it puts you in breach, and no setting on our side makes up for that.

hard law·Decision 2004-11-24; text read as up to date to 1 April 2026·Official source

Lorsqu'un dentiste demande à un patient de lui révéler des renseignements de nature confidentielle ou lorsque de tels renseignements lui sont confiés, il doit s'assurer que le patient est pleinement au courant des utilisations diverses qui peuvent être faites de ces renseignements.

What it means

The best “AI” hook in the dental code, and it is hard law. Putting a record — including radiographs and photographs, which are part of it — into an AI platform is a “use” the patient must be fully aware of. That means actively informing them, not a notice posted in the waiting room.

What we answer

We give you what you need to inform them: the path a request takes, the hosting regions, the retention policies of each model provider. Informing the patient, and keeping a trace of it, stays yours. Note that leaving Quebec goes through section 78 of Law 5 here, not through Law 25: a dental practice is a body within the meaning of that Act.

hard law·R.R.Q., 1981, c. D-3, r. 4; O.C. 580-2005, s. 1; text read as up to date to 1 April 2026·Official source

Le présent règlement ne doit pas être interprété comme excluant l'utilisation de l'informatique ou de toute autre technologie pour la constitution, la tenue, la détention et la conservation des dossiers et registres d'un ergothérapeute, pourvu que la confidentialité et l'intégrité des renseignements qui y sont contenus de même que l'exercice des droits d'accès et de rectification soient assurés. […] L'ergothérapeute doit assurer la confidentialité et l'intégrité de ses dossiers. […] L'ergothérapeute doit conserver chaque dossier pendant au moins 5 ans à compter de la date du dernier service rendu.

What it means

This is the hard law behind the order's guideline on cloud computing. Three things to retain. The regulation contains NO rule on physical place — no “premises or cabinet kept locked” as with the optometrists or the psychoeducators: the standard is functional, and it adds INTEGRITY to confidentiality and to the rights of access and correction, which bears on the unalterability of the note as much as on its secrecy. The period is 5 years from the last service rendered, and section 18 requires that destruction preserve confidentiality. Finally, section 1 is drafted in the negative — it does not “exclude” computerization — so the permission holds only for as long as the three conditions hold: it is for the occupational therapist to establish that, not for the vendor to assert it.

What we answer

On confidentiality, what we can show: a dedicated instance, Microsoft Azure hosting in the Canada Central region (Toronto) by default, per-user and per-group access, an audit log of changes, shares, administrator access and knowledge-base retrieval, a model catalogue that can be restricted all the way to a global kill switch that binds administrators too, confidentiality in the contract (s. 14), incident notice without delay (s. 14.9), an annual right of audit (s. 14.10) and no training on your content without written authorization (ss. 14.2 and 14.7). On integrity, let us be precise: the audit log traces accesses and changes, but we offer neither a zero-knowledge architecture nor a certified clinical-record product — content generated by a model is not an unalterable note, and inference leaves Canada, to providers established in the United States and in France. The catalogue kill switch, moreover, binds only the models a user picks, not the calls the server makes on its own: the extraction of the text of a document added to a knowledge base, conversation titles, the agent's screenshot, the Law 25 detector if you enable it. On the 5 years: retention is not configurable, there is no certificate of destruction, and three of the product's timers that cannot be turned off — 30 days for transcriptions, 7 days for tool-produced files, 48 hours for attachments never sent — can carry off a piece of the record before your deadline. The record stays in your record system; the full export in open formats feeds it.

hard law·Décision 2013-11-15, 2013 G.O. 2, 5148 ; amended by L.Q. 2023, c. 34, a. 1293 et 1634 ; text read as current to 1 April 2026·Official source

Le présent règlement permet l'utilisation de l'informatique ou de toute autre technologie de l'information pour la constitution, la tenue, la détention et la conservation des dossiers d'un membre pourvu que la confidentialité et l'intégrité des renseignements qui y sont contenus de même que l'exercice des droits d'accès et de rectification soient assurés. […] Le membre doit assurer la confidentialité et l'intégrité de ses dossiers et en restreindre l'accès aux seules personnes autorisées. […] Le membre doit conserver chaque dossier et tout relevé d'honoraires ou autre montant facturé pour chaque client pendant au moins 5 ans à compter de la date du dernier service professionnel rendu.

What it means

Mind the number: the regulation in force is C-26, r. 200.2, and its section 39 expressly replaces the former C-26, r. 207, which LégisQuébec still serves under a banner reading “Replaced on 1 January 2016” — to cite r. 207 today is to cite a replaced text. The current regulation permits computerization on three cumulative conditions — confidentiality, integrity, exercise of the rights of access and correction — and section 10 adds the text's only access rule: restrict access to authorized persons only. The period is 5 years from the last professional service rendered (s. 11), destruction must preserve confidentiality (s. 12), and s. 22, para. 2 provides that only a member may act as assignee of another member's records. Worth noting, because it is a step backwards: the former r. 207 itemized precise security measures — identification and authentication, access profiles, access logging, backups, security of the premises — which r. 200.2 does not reproduce.

What we answer

The three conditions in section 2 have to be handled separately, and we do not meet three out of three. Access restriction (s. 10): a dedicated instance, per-user and per-group access, a model catalogue that can be restricted all the way to a global kill switch that binds administrators too, an audit log of changes, shares, administrator access and knowledge-base retrieval — that condition, we support with evidence. Confidentiality: Microsoft Azure hosting in the Canada Central region (Toronto) by default, confidentiality in the contract (s. 14), incident notice without delay (s. 14.9), an annual right of audit (s. 14.10), no training on your content without written authorization (ss. 14.2 and 14.7) — but inference leaves Canada, to providers established in the United States and in France, and the kill switch does not bind the calls the server makes on its own. Integrity: no zero-knowledge architecture and no certified clinical-record product; the platform is not where your record lives. On the 5 years in section 11, retention is not configurable, there is no certificate of destruction, and three of the product's timers that cannot be turned off — 30 days, 7 days, 48 hours — can carry off a piece before your deadline; export beforehand. And s. 22, para. 2 settles the question of assignment without us: only a member of the order can be an assignee.

hard law·Décision 2015-11-06, 2015 G.O. 2, 4566 ; replaces C-26, r. 207 ; amended by L.Q. 2020, c. 15, a. 74 et L.Q. 2023, c. 34, a. 1293 et 1634 ; text read as current to 1 April 2026·Official source

Rien dans le présent règlement ne doit être interprété comme excluant l'utilisation de l'informatique ou de toute autre technique pour la constitution et la tenue du dossier optométrique. […] Un optométriste doit conserver chaque dossier pendant au moins 5 ans à compter de la date du dernier service rendu. […] Un optométriste doit conserver ses dossiers dans un local ou un meuble auquel le public n'a pas librement accès et pouvant être fermé à clef ou autrement.

What it means

A warning about numbering before the substance, because the order itself got it wrong. The record-keeping regulation in force is O-7, r. 20 — the former R.R.Q., 1981, c. O-7, r. 9, renumbered. Yet the reference list of the order's Guidelines of 18 October 2019 designates that same regulation as “RLRQ, c. O-7, r. 5”: that number is not its own, it is the number of the Code of ethics of optometrists, which had moreover already been REPLACED on 17 May 2018 by O-7, r. 5.1 (which the same list cites correctly elsewhere). The living ethical provision is therefore section 55, para. 6 of r. 5.1, which requires the optometrist to “take reasonable means to ensure that professional secrecy is preserved when using information technology”. On the substance: r. 20 dates from 1981 and it shows its age. Section 1.02 permits computerization WITHOUT attaching any condition to it — no confidentiality, no integrity, no rights of access — unlike the more recent regulations of the other orders. Safekeeping is described as a piece of furniture kept under lock and key (s. 2.05), the period is 5 years from the last service rendered (s. 2.04), and the regulation provides nothing on the cessation of practice.

What we answer

For optometry, the operative obligation comes not from the record-keeping regulation but from the Code of ethics: section 55, para. 6 of O-7, r. 5.1 asks you to take reasonable means to preserve professional secrecy when you use information technology. You are the one who carries that duty, and reading it presupposes knowing what the tool does. What we provide: a dedicated instance, Microsoft Azure hosting in the Canada Central region (Toronto) by default, per-user and per-group access, an audit log of changes, shares, administrator access and knowledge-base retrieval, a model catalogue that can be restricted all the way to a global kill switch that binds administrators too, confidentiality in the contract (s. 14), incident notice without delay (s. 14.9) and an annual right of audit (s. 14.10). What you must write into your analysis: inference leaves Canada — providers established in the United States and in France — which is exactly the case the order's guideline asks you to check; and the catalogue kill switch binds only the models a user picks, not the calls the server makes on its own. On section 2.04, retention is not configurable and we issue no certificate of destruction; three of the product's timers that cannot be turned off — transcriptions at 30 days, tool-produced files at 7 days, attachments never sent at 48 hours — can carry off a piece before your 5 years. The optometric record stays in your system; the full export in open formats feeds it.

hard law·R.R.Q., 1981, c. O-7, r. 9 ; amended by L.Q. 2023, c. 34, a. 1293 et 1634 ; text read as current to 1 April 2026·Official source

Par conséquent, il est essentiel de vérifier à quelles réglementations les entreprises sont soumises, en fonction du lieu où elles opèrent et du lieu où entreposés les serveurs. […] À travers les mécanismes de protection du public, des recommandations pourraient être émises et des ajustements pourraient être exigés en fonction des éléments jugés questionnables ou problématiques, à la lumière du présent outil.

What it means

The order itself writes that the tool “creates no formal enforceable rules”, but the sentence we quote second closes the door again: the public-protection mechanisms — professional inspection, the syndic — will use it as a reference, and adjustments may be required. To be treated as an expectation of the inspection, not as optional reading. Two operational requirements follow from it directly: check which regulations the provider is subject to according to its place of operation AND the location of its servers, and provide “a method for extracting, backing up and keeping personal and sensitive data outside the AI tool”, the order recalling that the record must be kept for at least 5 years (C-26, r. 222.1.4, s. 10). The document also recalls that de-identification, pseudonymization and anonymization do not prevent re-identification.

What we answer

What we can document: the platform is operated by Hilo Tech, a Quebec company, on a dedicated instance hosted on Microsoft Azure in the Canada Central region (Toronto) by default — a Quebec region exists only under private hosting. Inference, for its part, leaves Canada: model providers in the United States and in France, and a Singapore entity for video. The contract bars any training without your written authorization (ss. 14.2 and 14.7), imposes confidentiality (s. 14), incident notice without delay (s. 14.9) and gives you an annual right of audit (s. 14.10). On the “method for extracting and keeping the data outside the tool”, the full export exists and it is what answers. What we cannot say: that restricting the model catalogue covers everything — it binds administrators as well as users, but not the calls the server makes on its own — the extraction of the text of a document added to a knowledge base, the indexing of that base, web search, the Law 25 detector if you enable it, conversation titles, agent screenshots, Learning-module audio, mail triage, and more. The Confidentiality and compliance page enumerates them all, with what leaves and to which model. For a clientele whose information touches on sexual health, that list must appear as it stands in your ethical deliberation.

regulator expectation·2026-01-29·Official source

La présente section permet l'utilisation des technologies de l'information pour la tenue, la détention ainsi que le maintien des dossiers des clients d'un sexologue pourvu que la confidentialité des renseignements qui y sont contenus ainsi que l'exercice des droits d'accès et de rectification soient assurés. […] Le sexologue doit conserver chaque dossier pendant au moins 5 ans à compter de la date du dernier service professionnel rendu.

What it means

The authorization of digital is conditional and the condition has two limbs, not one: confidentiality, AND the concrete exercise of the rights of access and correction. A tool that protects well but from which a client's record can be neither extracted nor corrected does not comply with section 1. Added to that are section 2 — the record is kept “at the place where he practises his profession” — and the 5-year floor in section 10. Consolidated version read as up to date to 1 April 2026.

What we answer

On the second limb, the platform answers: conversations, documents and attachments export in full, a message can be corrected in place and the change leaves an entry in the audit log. On retention, the warning is the same as for every professional order: retention is not configurable and three of the product's timers cannot be turned off — transcriptions at 30 days, tool-produced files at 7 days, attachments staged but never sent at 48 hours. If one of those items belongs to the record, it will disappear before your 5 years: export it to your record system. We are not a certified clinical-record product and we do not claim to be one; the platform is a working tool alongside the record, not the record.

hard law·2026-04-01·Official source

Ils doivent être détruits dès que la sage-femme a révisé et signé la note produite par le scribe IA. Il est fortement recommandé que ces 2 actions aient lieu à la fin de la consultation ou immédiatement après celle-ci. […] Un rappel verbal de l'utilisation du scribe IA est requis à chaque rencontre, en étant claire que le consentement peut être retiré à tout moment. […] L'utilisation et le nom du scribe IA utilisé doivent être mentionnés dans la note. […] Éviter les solutions qui conservent les données à l'extérieur du Canada.

What it means

This is the most precise Quebec opinion in existence on the automated transcription of a clinical encounter, and it sets four operational obligations: the recording and the verbatim are a draft, to be destroyed AS SOON AS the note is signed; the initial consent must be recalled verbally at EVERY encounter, with a fresh consent if the subject is particularly sensitive or if the software changes in a major way (the opinion gives as an example a transfer of data abroad); the name of the scribe used must appear in the note; and the order recommends avoiding solutions that keep data outside Canada. The opinion adds two legal consequences that few vendors mention: the recording and the transcription may be the object of a request for access to the record for as long as they have not been erased, and a PIA as well as a vendor contract — including a confidentiality undertaking signed by its staff — are required before use.

What we answer

We do transcribe, so we have to be exact about the gap. Transcriptions are deleted after 30 days by a timer that cannot be turned off: that is a floor, not destruction “as soon as the note is signed”. Nothing in the platform detects that a note has been reviewed and signed, and we issue no certificate of destruction. For as long as a transcription exists, it is reachable by a request for access, exactly as the opinion says. Three things are yours and the platform will not do them for you: the verbal recall of consent at each encounter, entering the name of the scribe in the note, and suspending the recording on a sensitive subject. On the recommendation to avoid solutions that keep data outside Canada: your instance and your data at rest are in Canada, in the Canada Central region (Toronto) by default, but inference leaves the country — the United States and France, plus a Singapore entity for video. The transcribed content therefore passes through a model outside Canada. We say so rather than let the opposite be believed.

regulator expectation·2025-09-30·Official source

La sage-femme qui utilise un support faisant appel aux technologies de l'information pour le traitement et la conservation de tout ou partie des renseignements et documents relatifs à un dossier doit: 1° sauvegarder les données ainsi recueillies et en conserver une copie; 2° utiliser une base de données distincte de toute autre pour la tenue des dossiers visés par la présente section; 3° protéger l'accès à ces données, notamment par l'utilisation d'un mot de passe.

What it means

Paragraph 2 is the surprising one: the database must be SEPARATE FROM ANY OTHER for the keeping of records. This is not an encryption requirement or an access-control requirement, it is a compartmentalization requirement — the record does not share its store with anything else. Added to that are backup with a copy (para. 1), protection of access (para. 3), the 5-year floor in section 6 — the birth-summary note being excluded from the right of destruction at the expiry of the period — and section 7 on the confidentiality of retention. Section 1 recalls that digital is admitted only if sections 60.4 to 60.6 of the Professional Code are not thereby compromised. Consolidated version read as up to date to 1 April 2026.

What we answer

Your instance is dedicated: the database is shared with no other customer. But if you put clinical content into a conversation, it lives in the same store as all your other work — correspondence, management notes, research. That is not “a database separate from any other for the keeping of records” within the meaning of paragraph 2, and we will not claim the contrary: the platform is not a midwifery record system and is not certified as a clinical-record product. What we provide: per-user and per-group access, an audit log, a restrictable model catalogue — over what a user picks, not what the server keeps, full export. What we do not provide: guaranteed 5-year retention — retention is not configurable and timers that cannot be turned off delete transcriptions at 30 days, tool files at 7 days and attachments never sent at 48 hours — nor a certificate of destruction.

hard law·2026-04-01·Official source

L'utilisation d'un SIA doit être expliquée de façon claire et accessible, en précisant ses avantages, ses limites et la manière dont les renseignements personnels ou de santé sont utilisés et stockés. Le consentement libre et éclairé de la clientèle est essentiel, et un refus ne doit jamais compromettre la qualité des soins ou des services offerts.

What it means

The statement expressly targets administrative use and record-keeping as much as clinical use — “Whether AI is used for administrative assistance, record-keeping, drafting or directly for clinical purposes”. The requirement quoted is the one that falls back on the vendor: you must be able to explain to the person how their information is USED and STORED, which presupposes knowing it. The statement also asks that you know how to “provide quality care and services if the person refuses the use of an AI system” — so a path without AI must exist. The order publishes no precise day: the page carries the mention “January 2026”.

What we answer

We give you what you need to make that explanation without approximation: the hosting region (Canada Central, Toronto, by default; a Quebec region only under private hosting), the list of model providers and their countries — the United States and France, plus a Singapore entity for video —, what is sent to them and what is not, retention periods, sub-processors by role, and the contract clauses: confidentiality (s. 14), incident notice without delay (14.9), annual audit (14.10), no training without your written authorization (14.2 and 14.7). Two clarifications that the transparency requirement makes mandatory rather than optional: retention is not configurable and some timers cannot be turned off; and restricting the model catalogue does not bind the calls the server makes on its own. On the right of refusal, the answer is simple and it is yours: nothing in the platform forces its use, but it is your organization that must provide the path without AI.

regulator expectation·Janvier 2026·Official source

À l'expiration du délai prévu à l'article 10, le membre peut procéder à la destruction d'un dossier à la condition que celle-ci soit faite de manière à ce que la confidentialité des renseignements qui y sont contenus soit assurée. […] La présente section ne doit pas être interprétée de manière à exclure l'utilisation de l'informatique ou de toute autre technique pour la constitution et la tenue des dossiers, pourvu que la confidentialité des renseignements soit respectée.

What it means

The regulation frames both ends of a record's life: section 10 sets the 5-year floor from the last professional service rendered, section 11 makes destruction conditional on confidentiality, and section 9 requires premises or a cabinet kept locked “or otherwise” — the formula that covers logical access control. Section 12 authorizes computerization on the same condition. One particular clause for audiologists: section 15 requires that the calibration data of assessment instruments be kept for 5 years. Consolidated version read as up to date to 1 April 2026.

What we answer

The access control required by section 9 is in place: per-user and per-group access, an audit log, a restrictable model catalogue with a kill switch that binds administrators too — but not the calls the server makes on its own. On section 11, we have to be precise: the platform deletes, but it does not ATTEST — we issue no certificate of destruction, and if your order or a client asks you for proof of it, the audit log is the closest thing we have. On the 5-year period, the platform does not hold it for you: retention is not configurable, and timers that cannot be turned off destroy, before term, transcriptions (30 days), tool-produced files (7 days) and attachments never sent (48 hours). Keep the master copy of the record elsewhere and use the full export.

hard law·2026-04-01·Official source

Les SIA reposent sur l'analyse de grandes quantités de données cliniques de nature délicate, ce qui accroît les risques liés à la confidentialité, à la sécurité des données et aux usages secondaires non consentis. […] La clientèle doit être informée de manière claire et compréhensible de l'utilisation de SIA dans sa prise en charge, du rôle réel de ces outils (offrir du soutien, et non prendre des décisions), des types de données utilisés et des limites de ces technologies

What it means

To classify honestly: this is neither a position statement nor a guideline, it is the thematic feature of the order's professional magazine — but the main article is signed by the Direction de l'exercice de l'hygiène dentaire, and therefore by the order itself, and its conclusion sets the expectation: “the integration of AI in dental hygiene must be considered in a prudent, gradual and supervised manner”. The passage quoted names the three risks that concern a vendor — confidentiality, data security, non-consented secondary uses — and then the duty to inform the clientele. The order signed the Montréal Declaration for a Responsible Development of Artificial Intelligence in 2018, and the issue publishes a summary of it. Published in April 2026 (the article's page put online on 24 April 2026); the feature runs from pages 15 to 32.

What we answer

“Non-consented secondary uses” is the phrase that calls for a contractual answer, and we have it: no training on your content without your written authorization (ss. 14.2 and 14.7), confidentiality (s. 14), incident notice without delay (14.9), an annual right of audit (14.10). For informing the clientele, we supply the material: the path a request takes, the hosting regions — Canada Central (Toronto) by default, a Quebec region only under private hosting —, the model providers and their countries (the United States, France, and a Singapore entity for video), retention periods, sub-processors by role. Two things to say out loud rather than in a footnote: the Law 25 detector is a paid option, disabled by default, and it is itself an outbound call to a model; and the model-catalogue kill switch does not bind the calls made by the server (the extraction of the text of a document added to a knowledge base, conversation titles, agent screenshots, Learning-module audio, mail triage). Finally, we are not a diagnostic-aid device and we do not analyse radiographs: the L'Explorateur feature talks a great deal about assisted diagnosis, and that is not what we do.

commentary·Avril 2026·Official source

Rien dans la présente section ne doit être interprété comme excluant l'utilisation de l'informatique ou de toute autre technique pour la constitution ou la tenue des dossiers, livres et registres d'un hygiéniste dentaire, pourvu que l'exactitude et la confidentialité des renseignements soient respectés, ainsi que pour le maintien de ses équipements. […] Un hygiéniste dentaire doit conserver ou s'assurer que soit conservé chaque dossier pendant au moins 5 ans à compter de la date du dernier service rendu.

What it means

Two words not to skim over. First “accuracy”: section 9 admits computerization on condition that ACCURACY and confidentiality are respected — in a 1996 regulation, that is the integrity of the content, and it bears directly on a tool that drafts. Then “or ensure that they are kept” in section 13: the dental hygienist most often practises in a dentist's office, and the regulation nonetheless makes them answerable for the retention of the record, even when they do not hold it. Section 2 requires an office laid out so as to ensure that confidentiality is respected, and section 14 premises or a cabinet kept locked “or otherwise”. Consolidated version read as up to date to 1 April 2026.

What we answer

On accuracy, the honest answer is that no vendor can guarantee it: a model can produce a false statement with confidence, and the re-reading remains yours. What we provide to support it: the audit log time-stamps changes, a corrected message leaves a trace, and the model catalogue can be restricted. On confidentiality and access: per-user and per-group access, a contract providing for confidentiality (s. 14), incident notice without delay (14.9) and an annual right of audit (14.10). On retention, the gap is the same everywhere: retention not configurable, timers that cannot be turned off (transcriptions 30 days, tool files 7 days, attachments never sent 48 hours), no certificate of destruction, full export available. If you practise in a dentist's office, note that section 13 makes you responsible for the retention even of the record you do not hold: the platform does not relieve you of that.

hard law·2026-04-01·Official source

Le présent chapitre ne doit pas être interprété de manière à exclure l'utilisation de l'informatique ou de toute autre technique pour la constitution, la tenue, la détention, le maintien et la conservation des dossiers et registres d'un technologue en imagerie médicale, d'un technologue en radio-oncologie ou d'un technologue en électrophysiologie médicale, pourvu que la sécurité, la confidentialité et l'intégrité des renseignements et des documents de ces dossiers ou registres soient respectées. […] Le technologue doit s'assurer de la confidentialité et l'intégrité de ses dossiers.

What it means

The striking fact here is an absence, and it deserves to be stated: as at 12 August 2026, the order has published NO position, no opinion and no guideline on artificial intelligence. Its “Avis et positions de l'Ordre” page contains none, and a site search for “intelligence artificielle” returns only training courses, a podcast and member profiles. That is notable for a profession where AI is already present in the room — assisted detection, image reconstruction, radiation-oncology planning. The applicable floor is therefore the general law: the Act respecting health and social services information, the Professional Code and the Code of ethics (T-5, r. 5), plus this regulation — a triple condition of security, confidentiality and INTEGRITY (ss. 1 and 8), retention of at least 5 years (s. 10) and holding in a place kept locked “or otherwise” (s. 11). Section 2 is worth knowing: where the workplace stands in the way of compliance with the regulation, the technologist must inform their employer in writing and then notify the order. Consolidated version read as up to date to 1 April 2026.

What we answer

Do not look for an attestation from an order that has not pronounced itself: it is your institution, through its person in charge of the protection of personal information, that will have to decide, and the privacy impact assessment under section 106 of Law 5 is triggered by the acquisition itself. What we put on the table: a dedicated instance hosted in the Canada Central region (Toronto) by default — a Quebec region exists only under private hosting —, inference outside Canada (the United States, France, and a Singapore entity for video), an audit log, per-user and per-group access, a restrictable model catalogue — over what a user picks, not what the server keeps, full export, and a contract that provides for confidentiality (s. 14), incident notice without delay (14.9), an annual audit (14.10) and a prohibition on training without written authorization (14.2 and 14.7). Two blunt limits on the integrity that section 8 requires: we are not a certified clinical-record product, and the platform neither processes nor interprets medical images. On retention: retention not configurable, timers that cannot be turned off, no certificate of destruction.

hard law·2026-04-01·Official source

L'utilisation de l'intelligence artificielle (IA) est permise, mais comme pour tout autre outil utilisé dans le cadre de la pratique professionnelle, son usage doit être conforme aux lois et aux règlements qui encadrent la profession. […] Quelle que soit la technologie employée, les diététistes-nutritionnistes demeurent pleinement responsables et imputables du contenu produit. L'IA peut être un outil d'aide à la rédaction, mais elle ne peut en aucun cas se substituer au raisonnement clinique.

What it means

The question asked is exactly ours — can AI write the note in the record — and the answer is yes, subject to conditions. The order poses four preliminary questions, two of which bear on the vendor: are confidentiality and the protection of personal information ensured, and does the tool make it possible to comply with all the laws and regulations that govern the profession. It refers by name to the Code of ethics of dietitians, the Professional Code, the Regulation respecting the keeping of records by dietitians, the Regulation respecting the keeping of consulting rooms, Law 25, the Act respecting health and social services information and the Act respecting health system governance. Published on 18 June 2025, updated on 17 November 2025.

What we answer

On responsibility for the content, there is nothing to negotiate: the text produced is yours, errors included, and a model can assert something false with aplomb. On the two questions the order asks you to put to your vendor, here are our answers without evasion. Confidentiality: a dedicated instance, per-user and per-group access, an audit log, a contract providing for confidentiality (s. 14), incident notice without delay (14.9), an annual right of audit (14.10) and a prohibition on training on your content without written authorization (14.2 and 14.7) — but hosting in the Canada Central region (Toronto) by default, a Quebec region being offered only under private hosting, and inference outside Canada (the United States, France; a Singapore entity for video). Compliance with the record-keeping regulations: partial, and the gap is named below — retention is not configurable and timers that cannot be turned off delete some items before your 5 years. Treat the platform as a drafting tool alongside the record, never as the record.

regulator expectation·2025-11-17·Official source

Rien dans le présent règlement ne doit être interprété comme excluant l'utilisation de l'informatique ou de toute autre technique pour la constitution et la tenue des dossiers d'un diététiste. […] Un diététiste doit conserver chaque dossier pendant au moins 5 ans à compter de la date du dernier service rendu.

What it means

The regulation is short and old, and that is precisely what makes it a trap: section 1.03 authorizes computerization WITHOUT attaching any condition of confidentiality to it, unlike the equivalent regulations of the other orders. Do not conclude from that that hosting is unconstrained — the confidentiality obligation comes from elsewhere, from the Professional Code (s. 60.4), from the Code of ethics of dietitians and from Law 25 — but it does mean that this particular regulation will give you no technical benchmark. Section 2.04 sets the 5 years, section 2.05 requires premises or a piece of furniture to which the public does not have free access. Consolidated version read as up to date to 1 April 2026.

What we answer

The regulation's silence is not a permission, and we will not present it as one: your confidentiality obligation rests on the Professional Code and on Law 25, and it applies in full to what you put into the platform. What we offer: per-user and per-group access, an audit log, a restrictable model catalogue with a kill switch that binds administrators too — but not the calls the server makes on its own, full export, and the usual contractual commitments. What we do not offer: retention configurable over 5 years. Three hard-coded timers destroy before term — transcriptions at 30 days, tool-produced files at 7 days, attachments staged but never sent at 48 hours — and there is no certificate of destruction. Keep the master record in your record system.

hard law·2026-04-01·Official source

Le membre doit donner suite, avec diligence et au plus tard dans les 30 jours de leur réception, aux demandes écrites d'accès à des documents, de correction et de suppression de renseignements ainsi que de versements de commentaires au dossier formulées par un patient et visées aux articles 60.5 et 60.6 du Code des professions (chapitre C-26).

What it means

The Order has no records regulation of its own — the record belongs to the institution, and section 51 refers expressly to the Access Act (chapter A-2.1) and to the health-network governance statutes for those practising in a public body. What follows you personally is the deadline: 30 days to answer a request for access, correction or deletion, plus the secrecy duty of section 48, which asks you to avoid even revealing that a person has used your professional services.

What we answer

On the 30 days, the question is not whether the platform is fast: it is whether you can find what a patient asks you for. An administrator locates and removes a named person's data — conversations, documents, knowledge bases — using per-object rights and the audit log, but case by case, with no self-service portal and no committed contractual deadline. If you practise in an institution, section 51 returns you to the institution's regime anyway, and it is the institution that decides what may be put in here. On section 48, one precision that matters for an order where many members work in teams: sharing outside your organization is on by default, and that is a setting to make beforehand, not afterwards.

hard law·Current to 1 April 2026·Official source

Rien dans le présent règlement ne doit être interprété comme excluant l’utilisation de l’informatique ou de toute autre technique assurant la constitution et la tenue des dossiers, livres et registres d’un acupuncteur, notamment les dossiers de ses patients, pourvu que la confidentialité des renseignements soit respectée et que l’application des dispositions des articles 60.5 et 60.6 du Code des professions (chapitre C-26) ne soit pas compromise.

What it means

This is the wording found almost verbatim in several orders' records regulations: computing is PERMITTED, on two conditions. Confidentiality must be respected, and the application of ss. 60.5 and 60.6 of the Code des professions must not be compromised — meaning the record must stay accessible to the patient and to the syndic. A tool that renders the record unreadable, non-exportable or unavailable during an inquiry fails that condition even if nothing leaks.

What we answer

The instance is dedicated, hosted in Canada, and a whole-environment export exists (a pg_dump archive plus the documents tree), so accessibility within the meaning of ss. 60.5 and 60.6 is not threatened by proprietary lock-in. Two reserves apply to you as to the other practitioners on this page. Confidentiality under this regulation is not only about storage: the content of a request goes to the model provider, and it is the contract that governs that, not encryption. And the calls the server makes on its own — extracting an uploaded document, the Law 25 detector, the conversation title — escape the catalogue restriction; that is our gap and it is named on this page.

hard law·Current to 25 August 2026·Official source

Rien dans la présente section ne doit être interprété comme excluant l’utilisation de l’informatique ou de toute autre technologie pour la tenue, la détention ainsi que le maintien des dossiers d’un audioprothésiste, pourvu que la confidentialité des renseignements qui y sont contenus ainsi que l’exercice des droits d’accès et de rectification soient assurés.

What it means

This clause is more demanding than several neighbouring orders', and the difference matters. It asks not only for confidentiality but that THE EXERCISE OF THE RIGHTS OF ACCESS AND RECTIFICATION be ensured. A tool that keeps the record confidential but from which an entry cannot be extracted or corrected fails the article, without a single leak. The regulation also sets a floor: each record is kept for at least 5 years from the last professional service rendered.

What we answer

On access and rectification: a message can be edited, a document replaced in a base, a whole-environment export exists, and the trace of changes stays in the audit log — that is the material for both rights. On the 5-year floor, the honest answer is that the product does not manage it for you: there is no retention setting at all, conversations and documents stay until someone deletes them, and the nine hardcoded timers run the other way — they delete, they do not retain. Three of them can carry off a piece before your 5 years if you leave it where they apply. The record of reference must remain your records system, not the conversation.

hard law·Current to 25 August 2026·Official source

Un fournisseur d’un produit ou service technologique qui, dans le cadre d’un contrat conclu avec un organisme, lui fournit un tel produit ou service certifié est tenu de s’assurer que ce dernier respecte les critères prévus par un règlement pris en vertu du paragraphe 2° du deuxième alinéa de l’article 92 pendant toute la durée de ce contrat.

What it means

This regime binds THE SUPPLIER and not only you, which is rare. Section 92 lets the Minister determine by regulation the cases in which only a CERTIFIED technology product or service may be acquired or used, and set the certification criteria — information protection, security, functionality, interoperability. Section 93 then bars the organisation from using an uncertified product. Section 94 requires the supplier of a certified product to keep meeting the criteria FOR THE WHOLE DURATION OF THE CONTRACT, and section 95 lets a person designated by the Minister serve a peremptory demand for conformity documents ON THE SUPPLIER, who must comply. Section 96 requires the list of certified products to be published.

What we answer

Two things, and the order matters. First the state of the law: no regulation under the first paragraph of s. 92 currently determines the cases in which certification is mandatory, so the s. 93 prohibition is not triggered and nothing stops you today from using an uncertified product. Then what already reaches you: the Règlement d'application (R-22.1, r. 1) requires your register of technology products and services to record the supplier's name and, where applicable, whether it is a product certified by the Minister. We are not, and no process is under way — so «not certified» is what goes in that column about us. If the Minister exercises the s. 92 power for a category that covers you, that line stops being a note and becomes a prohibition; tell us when that happens, because the s. 94 duty would then be ours, not yours.

hard law·In force since 1 July 2024; text current to 25 August 2026·Official source

Un organisme ne peut conserver un renseignement qu’il détient au-delà de la durée nécessaire à la réalisation des fins pour lesquelles il l’a recueilli ou utilisé, sous réserve d’un règlement pris en vertu du deuxième alinéa, de la Loi sur les archives (chapitre A-21.1) ou du Code des professions (chapitre C-26).

What it means

A CEILING, not a floor — and in practice the two pull against each other. Section 16 forbids keeping information beyond the time necessary for the purposes pursued, but it expressly reserves retention regulations, the Archives Act and the Code des professions, which impose FLOORS: five years for an audioprosthetist from the last service, longer elsewhere. A health record therefore lives between two opposing bounds, and it is the organisation that must hold both.

What we answer

The product holds neither for you, and the order of that matters. On the ceiling: there is no retention setting at all; conversations, documents and knowledge bases have no clock and stay until someone deletes them. Nothing enforces s. 16 on its own. On the floor: the nine hardcoded timers delete without notice and without a certificate of destruction, and three of them can carry off a piece of a professional record before the deadline your order requires. In other words the product errs in both directions, and the correction is organisational: the record of reference must remain your records system, and what passes through here must be treated as working material.

hard law·In force since 1 July 2024; text current to 25 August 2026·Official source

Avant d’entreprendre la prestation de services professionnels, le psychologue obtient, sauf urgence, le consentement libre et éclairé de son client […] en communiquant notamment les renseignements suivants: […] les règles sur la confidentialité ainsi que ses limites de même que les modalités liées à la transmission de renseignements confidentiels reliés à l’intervention.

What it means

The consent required here is not consent to treatment: it is a consent whose CONTENT is prescribed, and one of the prescribed elements is the ARRANGEMENTS FOR TRANSMITTING confidential information. It is owed BEFORE the first session. A psychologist who routes sessions, notes or documents through a tool that transmits them to a third-party provider has changed those arrangements, and the section obliges them to have explained them in advance — limits included. Watch for a common shortcut: obtaining the client's consent to the intervention is not informed consent to automated processing they have never been told about.

What we answer

What we can do, we do: the list of the ten calls the server may make is published in full (see the server-calls table) and the nine timers are inventoried, so a psychologist has the factual material to carry into their consent form. What we do not do: nothing in the product warns a practitioner when those arrangements change. If a release adds an outbound call, the consent signed the day before describes a routing that is no longer the right one, and there is no automatic notice to flag it. Watching our release notes is therefore your job, and it is the point to put in the purchase order if you want a notice commitment.

binding law·In force 1 September 2012; consolidated text read as of 25 August 2026·Official source

Le psychologue respecte la vie privée des personnes avec qui il entre en relation professionnelle, notamment en s’abstenant de recueillir des renseignements et d’explorer des aspects de la vie privée qui n’ont aucun lien avec la réalisation des services professionnels convenus avec le client.

What it means

This is a limit on the EXTENT of collection, not on its authorisation: the psychologist is entitled to collect, and has a duty not to collect beyond what relates to the agreed services. Automatic transcription and summarisation run in exactly the opposite direction — they capture the entire session, including digressions and unrelated confidences, then fix a written trace of it that did not exist before.

What we answer

The product offers no selective capture: a transcript takes everything that is said, a summary works on everything that was taken, and indexing a knowledge base sends the full text of every document to the embeddings service. No setting excludes a passage at source. The sorting section 14 requires must therefore be done by you, upstream — on what goes into the tool — because once the material is in, we supply nothing that restricts it retroactively.

binding law·In force 1 September 2012; consolidated text read as of 25 August 2026·Official source

Le psychologue ne remet pas à autrui, sauf à un autre psychologue, les données brutes et non interprétées reliées à une évaluation ou inhérentes à une consultation psychologique.

What it means

The prohibition is not about disclosure in general — professional secrecy already covers that — but about HANDING OVER TO ANOTHER a precise kind of material: raw, uninterpreted data. The permitted recipient is named and there is only one: another psychologist. Section 50 shuts the same door on a test protocol, which may go neither to the client nor to a non-psychologist third party, so as to preserve the instrument's metrological value. Watch for a common shortcut: uploading raw data or a protocol into a tool is handing it to that tool's operator and its subprocessors, who are not psychologists.

What we answer

The product does not distinguish raw data from interpreted data: a document placed in a knowledge base is indexed in full and its entire text goes to the embeddings service, and an attachment on a conversation follows the route of the chosen model. No setting marks a file as “raw data” to block its egress. The control section 49 requires is therefore entirely at the moment of upload, and it is manual: what must not be handed over must not be uploaded.

binding law·In force 1 September 2012; consolidated text read as of 25 August 2026·Official source

L'ergothérapeute qui exerce la profession au sein d'un organisme, d'une société ou d'une personne morale qui regroupe d'autres professionnels ou d'autres intervenants du secteur de la santé doit obtenir le consentement de son client avant d'inscrire ou de verser les renseignements et documents énoncés à l'article 6 dans un dossier unique accessible aux autres professionnels ou intervenants.

What it means

The duty is not about the record's confidentiality but about the act of POOLING it: consent is owed BEFORE entering or filing, and the trigger is a record becoming “accessible to the other professionals or persons involved”. The exemption covers public institutions; it therefore does not cover the private multidisciplinary clinic, which is precisely the setting where a shared workspace is most naturally set up. Watch for a common shortcut: restricting access is not obtaining consent — the section targets the filing itself, not the security of what has been filed.

What we answer

The platform supplies the technical half and not the legal half. Shared knowledge bases and shared conversations make their content reachable by the other members of the workspace, under permissions you set; that is exactly the “single record” the section is aimed at. What we do not supply: no screen asks for or records the client's consent before a filing, nothing marks content as requiring that consent, and an administrator retains an access the client never consented to. On top of that sits a limit already named elsewhere on this page: the audit log covers no READ route, so afterwards you will be able to show what was filed, but not who consulted it. Section 19's consent is therefore collected outside the tool, and its proof is kept outside the tool.

binding law·In force 12 March 2020; consolidated text read as of 25 August 2026·Official source

Le médecin s'assure que le produit technologique utilisé: ne comporte ou ne diffuse aucune forme de publicité ni ne fait la promotion de produits, d'appareils, de substances, de matériel, d'équipements, d'instruments, de médicaments, de services ou de fournisseurs de produits ou de services; ne comporte pas d'outil d'aide à la décision conçu de manière à orienter la décision du médecin.

What it means

This is the only provision in the whole corpus that places a requirement on the PRODUCT itself rather than on its user, and it has two limbs. The first bans all advertising and all promotion — the list runs as far as medications and suppliers of services. The second matters most for an AI tool: the product must contain no decision-support tool “designed so as to steer the physician's decision”. A generative assistant produces suggestions; the question is therefore not whether it offers a view, but whether it is designed to bend the physician's.

What we answer

We answer plainly, because the answer governs the use. HiloIntelligence is not a clinical-record system and must not be used as the technological product that holds the record: on the second limb, a general-purpose assistant does not meet this requirement by construction, since producing a recommendation is precisely what it does. On the first limb, the platform itself broadcasts no advertising, but we apply no filter to what the models write: an answer may name and recommend a medication, a device or a supplier, and web search queries a commercial service that surfaces commercial content. The audit log records per-turn document retrieval with chunk identifiers, which helps show what fed an answer; there is, however, no export route for that log. If you are a physician, the compatible use is the one where the tool stays beside the record and where the decision, its justification and its trace remain in the system that holds the clinical record.

binding law·In force 11 July 2024; consolidated text read as of 25 August 2026·Official source

Lorsqu'un renseignement contenu dans un dossier clinique doit être corrigé, rectifié ou supprimé, la correction, la rectification ou la suppression est conservée avec l'inscription originale, en indiquant le motif de la modification et sa date de même que le nom de la personne l'ayant demandée et celui de la personne l'ayant effectuée.

What it means

Correcting is not replacing. The original entry SURVIVES its correction, and the trace must carry four things: the reason, the date, who asked for it and who made it. That is the exact opposite of an ordinary software edit, which overwrites. The meeting point with AI is immediate: rewording, summarising or “correcting” a generated note is a modification within this section once the text has been filed to the record.

What we answer

The platform keeps no such register. Editing a message replaces it; regenerating an answer produces another; neither keeps the earlier version beside the new one, and nothing captures the reason or the name of the requester. That does not put us in breach — we are not the clinical record — but it fixes a clear limit of use: text destined for the record must be corrected IN the system that holds the record, where the trace section 4 requires exists, and not here before being copied across. The draft lost along the way is precisely what the section means to preserve.

binding law·In force 11 July 2024; consolidated text read as of 25 August 2026·Official source

Tout médecin constitue, tient, détient et maintient, sur un support technologique, un seul dossier clinique par patient par lieu d'exercice, peu importe le mode de consultation.

What it means

Since 11 July 2024, a technological medium is no longer a tolerance but the RULE: a single clinical record per patient per place of practice. The older regulations of other orders say instead that technology “is not excluded” — the contrast is useful, because it shows the direction these texts are moving. Section 12 adds the configuration standard: where health services are delivered by technological means, the product must be “configured so as to ensure the highest level of confidentiality”. That is a requirement on SETTINGS, and therefore on defaults as much as on an administrator's choices.

What we answer

On the single record, the consequence is a warning: everything placed here — an attachment, a conversation, a knowledge base — is a copy outside that single record, and the section provides for no parallel second record. On section 12, what we supply is real but partial: workspace partitioning, permissions, confidentiality mode and model-catalogue restriction are all configurable, and the instance is isolated. What “the highest level” does not yet cover with us is named elsewhere on this page: encryption at rest rests on Microsoft-managed keys rather than yours, some calls leave the server without passing through the catalogue restriction, and no read route is logged. A highest-level configuration is therefore something to verify with us setting by setting, before going live.

binding law·In force 11 July 2024; consolidated text read as of 25 August 2026·Official source

Lorsqu'un client demande qu'une copie de son dossier ou que des renseignements contenus dans ce dossier soient transmis à un tiers, le psychologue ne peut transmettre ces renseignements que 15 jours après la date de signature par le client d'un consentement à cet effet. Le client peut, à l'intérieur de ce délai, révoquer son consentement. Toutefois, dans les cas d'urgence, le client peut renoncer à ce délai de 15 jours.

What it means

Almost every obligation on this page sets a deadline NOT TO BE EXCEEDED. This one does the opposite: it imposes a WAIT. The signed consent does not authorise the sending, it starts its countdown, and for fifteen days the client may change their mind. Only urgency allows the wait to be waived. The second paragraph adds a trace: any transmission to a third party, like any copy handed to the client, is recorded in the file by a note signed by the client and dated.

What we answer

This is the obligation computing contradicts most directly, because sharing is instantaneous by construction. The platform transmits immediately — share link, export, connector — and offers no deferred send, no queue that could be cancelled, and no notion of revocable consent. Once content has gone to a third party, nothing on our side recalls it. The fifteen-day wait therefore cannot be tooled with us: it is kept upstream, by not placing in the tool what must not yet circulate. As for the signed and dated note the second paragraph requires, it belongs to the psychologist's file; our audit log records the creation of a share, it does not collect the client's signature and does not replace that note.

binding law·In force 1 September 2012; consolidated text read as of 25 August 2026·Official source

Lorsque la destruction de renseignements détenus par un organisme est confiée à un tiers, l'organisme doit conclure par écrit avec celui-ci un contrat à cette fin. […] le contrat doit prévoir: les procédés à utiliser pour la destruction des renseignements; le cas échéant, l'obligation pour le tiers de régulièrement rendre compte à l'organisme de la destruction des renseignements; l'obligation pour le tiers qui s'adjoint une personne ou un groupement pour l'exécution du contrat d'en aviser l'organisme […]. [Art. 14] Un organisme doit conserver une preuve de toute destruction de renseignements.

What it means

Entrusting destruction to a third party is not an operational detail: it triggers a written contract whose CONTENT is prescribed — the procedures used, an obligation to account regularly for the destructions, and an obligation to report any subcontractor the third party brings in. Section 14 closes the loop: the body must keep PROOF of every destruction. Deleting inside software is entrusting a destruction to a third party; the requirement is not aimed only at the paper shredder.

What we answer

This is the sharpest gap on this page for a health body, and it is not about deletion itself. Deletion works, and it is immediate. What we do not supply are the three elements section 13 requires in the contract — we do not describe the destruction procedures, we do not account periodically for the deletions performed, and our subprocessor list is published by role rather than notified to you when it changes. And nothing on our side produces the proof section 14 requires: the audit log records the act of deletion inside the instance, but it is not exportable, it does not cover copies, backups or indexes, and a destruction attestation is not among our deliverables. A body subject to this regulation must therefore have these elements written into the purchase order before entrusting us with information destined to be destroyed.

binding law·In force 1 July 2024; consolidated text read as of 25 August 2026·Official source

Au moins une fois tous les 2 ans, un organisme doit voir à ce que les produits ou services technologiques qu'il utilise fassent l'objet d'une évaluation portant sur les normes visées au premier alinéa de l'article 16. Toutefois, une telle évaluation doit être faite à chaque fois qu'est modifiée une règle particulière visée à cet alinéa qui porte sur un tel produit ou service.

What it means

The evaluation is not a pre-sale exercise filed away once signed: it recurs AT LEAST EVERY TWO YEARS, and it must be redone each time a rule applicable to the product changes. It is therefore a continuing obligation of the body, bearing on OUR products, and the practical question it raises is simple: what will you evaluate them with?

What we answer

With what we publish, and it is worth knowing what that does and does not contain. We have no SOC 2 report and no ISO certification to place in your file, and we are not certified by Santé Québec's Bureau de certification — we do not let that be assumed. What you can evaluate: this page and its admissions, the contract, the subprocessor list published by role, the table of calls the server may make and the timer inventory. What we do not provide: an independent evaluation, nor any notice mechanism when the product changes in a way that would invalidate your previous evaluation — which is precisely the trigger the section provides for. Watching our release notes is therefore your job, and a notice commitment is to be negotiated in the purchase order.

binding law·In force 1 July 2024; consolidated text read as of 25 August 2026·Official source

Le membre qui a recours aux technologies de l'information pour la prestation de services professionnels doit s'assurer que: l'identité du client est protégée; le client est en mesure d'utiliser l'application informatique; l'application informatique répond aux besoins du client; le client comprend le but et le fonctionnement de l'application informatique.

What it means

Four conditions, and three of them are not about security at all. The first protects identity; the other three bear on the CLIENT facing the software — that they are able to use it, that the tool meets their needs, and that they understand its purpose AND ITS OPERATION. It is a comprehensibility requirement placed on the professional about the tool, and it is rare: no other instrument on this page states an equivalent. It becomes demanding when the application is a generative model, whose operation is precisely what resists plain explanation.

What we answer

On the first condition, the instance is isolated and access is partitioned; that is the part we tool. The other three play out outside the product, and we do not especially help with them: nothing in the interface explains to the end client what a language model is, how an answer is produced, or what leaves for a provider — the server-calls table and the timer inventory exist on this site for the BUYER, not for the buyer's client. We supply neither a client-facing information document nor any check of their ability to use the tool. If your services run through the platform, explaining the purpose and the operation remains a deliverable you produce, and confirming it with each client remains your act.

binding law·In force 1 November 2020; consolidated text read as of 25 August 2026·Official source

Avant de recueillir des renseignements de nature confidentielle concernant un patient, le membre doit l'informer des utilisations qui peuvent en être faites.

What it means

The information is owed BEFORE collection, and it bears on the USES — not on retention, not on security, but on what will be done with the information. Watch for a common shortcut: a patient consenting to care has not thereby been told that their information will feed an automatic transcript, a model-written summary or the indexing of a knowledge base. Those are uses, and they are declared in advance.

What we answer

What we can give you to meet this obligation, we publish: the ten calls the server may make, the nine timers, and the fact that indexing a knowledge base sends a document's full text to the embeddings service. That is the raw material of an honest statement of uses. What we do not do: no screen presents those uses to the patient, nothing collects or dates that prior information, and above all — the point that matters for a duty owed BEFORE collection — nothing warns you when the list changes. A release that adds an outbound call widens the uses without the information given the day before accounting for it.

binding law·In force 28 February 2013; consolidated text read as of 25 August 2026·Official source

Le pharmacien doit respecter le secret de tout renseignement de nature confidentielle obtenu dans l'exercice de la pharmacie. Il doit notamment éviter de révéler qu'une personne a fait appel à ses services.

What it means

The second sentence is the one a tool evaluation does not go looking for. It protects not the CONTENT of the record but the EXISTENCE OF THE RELATIONSHIP: the mere fact that a person turned to the pharmacist is covered. That is metadata confidentiality — and metadata is precisely what software produces without being asked: a title, a filename, a log entry, a conversation list.

What we answer

One specific point concerns you, and it is verifiable on this page: AUTOMATIC TITLING of a conversation is one of the calls the server makes on its own, and it escapes the model-catalogue restriction. If a conversation concerns a named person, the text used to title it goes to a model you did not choose — and a title naming someone reveals exactly what this section asks you to withhold. What you can do here: do not name the person in the thread, and rename the conversation by hand. What we do not supply: no setting disables titling, and an uploaded document's filename is not treated as confidential data. Protecting the existence of the relationship therefore happens in what you write, not in a setting.

binding law·In force 1 September 2012; consolidated text read as of 25 August 2026·Official source