Privacy for Canadian Clinics

The short version

• Ava works for your clinic. Your clinic stays responsible for its patients' information, and we handle it only to provide Ava to you.
• We are moving Canadian clinics' patient data to Canada. We say so plainly because Canadian privacy law expects you to know where it goes.
• We are HIPAA compliant and SOC 2 Type II, and we share our SOC 2 report with clinics on request.
• There is no official PIPEDA, PHIPA, Law 25, Alberta HIA or BC PIPA certification. The Canadian privacy badges in our footer are links to this page, not certifications. This page sets out what we actually do.

What Ava handles, and why

Ava answers and places calls for your clinic, books appointments in your EMR and follows up with patients. To do that, it handles what callers tell it and what your EMR holds about their appointments: names, phone numbers, email addresses, dates of birth, appointment details, the reason for a visit and, for recall campaigns, the billing codes your EMR holds for past visits.

Calls handled by Ava are recorded and transcribed. Your team uses the recordings and transcripts to review what was said. We use them to check that Ava is doing its job well. We do not sell patient information.

Canadian law expects callers to be told at the start of a call that it is recorded, and why. Ava does not do this by default today, so we set up that greeting with your clinic, telling callers they are speaking with an AI assistant and that the call is recorded, before Ava takes or places calls for you.

Where information is processed

We are moving Canadian clinics' patient data to Canada. Some of the AI model providers we use may process it in other countries. Wherever it is processed, it is subject to that country's law, and its courts and authorities may be able to access it.

Canadian privacy law generally does not require private clinics to keep patient information in Canada. It does expect you to know where it goes, and it expects your agreement with us to protect it to a comparable standard.

Who else handles it

We use service providers for the parts of Ava we do not run ourselves:

• Voice and telephony: connecting calls and carrying the audio.
• Speech: turning what callers say into text, and Ava's replies into speech.
• AI language models: understanding callers and deciding what Ava says and does.
• Hosting and database: storing call records, transcripts and your settings.
• Messaging and CRM: sending texts and emails, and keeping contact records when your clinic uses them.

Ask us and we will send you the current list of named providers, what each one does and where it processes information: team@clinicpro.ai.

How we protect it

• Stored information is encrypted at rest by our hosting providers.
• Access inside your clinic's account is role-based.
• We are HIPAA compliant and SOC 2 Type II.

Calls and texts to your patients

When Ava calls or texts patients for your clinic, these rules are built in:

• Automated calls go out on weekdays between 9am and 6pm in your clinic's time zone, unless your clinic sets other hours. We set your clinic's time zone when you start, and keep any hours you choose within Canada's telemarketing limits.
• A patient who asks Ava to stop calling during a recall or outreach call gets no more of those calls. If a patient wants no calls at all, tell us and we block every automated call to them.
• A patient who replies STOP to a text gets no more texts from your clinic's Ava number and no more recall or outreach calls. Reminder calls for booked appointments continue unless your clinic stops them for that patient.

Your clinic decides who Ava contacts and why. In Canada, promotional texts and emails, such as recall or reactivation offers, generally need the patient's consent under the anti-spam law (CASL). Promotional calls made with an automated or AI voice need the patient's express consent under the CRTC's rules, even when the National Do Not Call List does not apply. We work through what your campaigns need with you before they start.

Your province

Canada has no single health privacy law. This is how the main ones treat a service like Ava. It is a summary, not legal advice, and your clinic's privacy officer or lawyer should confirm what applies to you.

• Ontario: under PHIPA, a service that handles patient information on a clinic's behalf is generally the clinic's agent. It may use the information only as the clinic permits, and must tell the clinic at the first reasonable opportunity if information is stolen, lost, or used or disclosed without authority.
• Alberta: a clinic that is a custodian under the Health Information Act must have a written agreement with an information manager such as Ava (section 66).
• Quebec: patient information held by private clinics where physicians, dentists or other professionals practise falls under the Act respecting health and social services information. Contracts with service providers must include specific terms (section 77), and a privacy impact assessment is needed before information leaves Quebec (section 78). Other personal information falls under the private sector privacy act as amended by Law 25.
• British Columbia, and Alberta clinics outside the Health Information Act: each province's Personal Information Protection Act applies.
• Elsewhere: PIPEDA, a provincial health information act, or both apply, depending on the province and the type of clinic. PIPEDA can also apply when information leaves the province.

Tell us your province and we will work through the agreement and the privacy impact assessment information your clinic needs.

If something goes wrong

If patient information we handle for your clinic is lost or stolen, or is accessed, used or disclosed without authorization, or someone tries to do so, we tell your clinic without delay, with what we know, so you can meet your own duty to notify patients and regulators.

Requests from patients

Patients have the right to see and correct their information. Because your clinic is responsible for it, patients should contact the clinic. We help your clinic answer, including finding a patient's call records.

How long we keep it

We keep call records while your clinic uses Ava, so your team can go back to them. When your clinic asks, we delete a patient's call records and transcripts from our systems and ask our providers to delete their copies. When your contract with us ends, we delete or return your clinic's records as the contract sets out.

Who to contact

Our Privacy Officer is responsible for how we protect personal information, and answers questions about this page. Write to team@clinicpro.ai.

For information collected on this website, read our Privacy Policy.