Built for Law 25

Law 25 (formerly Bill 64) modernizes Quebec's legal framework for the protection of personal information. For clinics, it imposes strict obligations regarding the collection, use and retention of health data.

Zenicall was designed from the ground up to meet these requirements: a privacy impact assessment (PIA), signed data processing agreements with our providers, and a published privacy policy. Compliance is assessed at the organization responsible for the information: we give you what you need to document yours.

What Law 25 requires from a clinic

Law 25 amends Quebec's Act respecting the protection of personal information in the private sector. Its obligations came into force in three stages, in September 2022, 2023 and 2024. For a clinic, they come down to the following:

• A person in charge of the protection of personal information. By default, this is the person with the highest authority in the business. The role can be delegated in writing, and the person's title and contact details must be published on your website.
• Published policies. A privacy policy in plain language, and rules governing how information is handled (retention, destruction, roles, complaint handling).
• Clear, free and informed consent. Health information is sensitive information: using it requires express consent, given for specific purposes.
• A register of confidentiality incidents. Every incident is recorded. If it presents a risk of serious injury, you must notify the Commission d'accès à l'information (CAI) and the people concerned.
• A privacy impact assessment (PIA). It is required before acquiring or developing a system that processes personal information, and before communicating information outside Quebec.
• Individuals' rights. Access, correction, withdrawal of consent and, since September 2024, data portability.

Violations can lead to administrative monetary penalties of up to $10 million or 2% of worldwide turnover, and penal fines of up to $25 million or 4%. Depending on your status, Quebec's Act respecting health and social services information may also apply: check with your professional order or legal advisor.

Questions to ask before adopting a tool that answers your phone

An AI receptionist hears your patients' names, phone numbers and often the reason for their visit. Before choosing one, ask the provider:

1. Where are recordings and transcripts hosted? In Canada, or elsewhere? Communicating information outside Quebec requires a PIA on your part.
2. Which subcontractors process the calls, and are they bound by data processing agreements?
3. Is the data used to train AI models?
4. Who at the provider can listen to calls, and how is that access logged?
5. How long are recordings kept, and can you request their destruction?
6. How quickly are you notified of a confidentiality incident?
7. Can the provider give you a PIA, or what you need to complete yours?

What Zenicall gives you

Our servers and your recordings are in Canada. Our providers are bound by data processing agreements, data is encrypted in transit and at rest, access is restricted to authorized people, and your data is not used to train AI. We provide our PIA on request, along with a collection notice that you approve before go-live. See also: Canadian data hosting and secure access.