Canada — Quebec — ANX-CA-QC: Mandate and Service Contract Terms, and Communication Outside Québec
Document ID: ANX-CA-QC · Version: 1.0 · Effective date: [[TO CONFIRM: publication date]]
Language: French controls (fr/annex-ca-qc.md). This English text is a convenience translation. The French version of the MDPA and of this Annex is presented to the Clinic first (Charter of the French language, s. 55). The Clinic is bound by an English version only if, after the French version was provided to it, it expressly chose to be (MDPA clause 22).
Applies to: Clinics in Quebec. Part of the Master Data Processing Agreement (the "MDPA"). Terms defined in the MDPA have the same meaning here.
1. Parties and roles
1.1 Roles. For the personal information of the Clinic's patients in DentalX:
- the Clinic is the person carrying on an enterprise (and, where the Act respecting health and social services information (chapter R-22.1) applies to it, the body) that holds the information; and
- VstreamX is its mandatary or service provider (mandataire ou prestataire de services) under section 18.3 of the Act respecting the protection of personal information in the private sector (chapter P-39.1, the "Private Sector Act").
1.2 Professionals. Where the Clinic's dentists hold the records of their own patients as professionals under the Professional Code and the regulations of the Ordre des dentistes du Québec, each is a party to this Annex through the acceptance certificate (MDPA clause 21).
2. Mandate in writing (Private Sector Act, s. 18.3)
2.1 The written mandate. The Clinic entrusts VstreamX with the hosting and processing of the personal information described in MDPA Schedule 1, in writing, by the MDPA and this Annex.
2.2 Measures VstreamX must take. As section 18.3 requires, VstreamX takes the following measures:
- (a) Confidentiality. It protects the confidentiality of the information communicated to it, by the measures in MDPA Schedule 2 and the confidentiality and secrecy obligations in MDPA clause 5.
- (b) Use only for the mandate. It uses the information only for carrying out the mandate (MDPA clauses 3 and 4).
- (c) No retention after the end. It does not keep the information after the end of the mandate. The only exception is database backups, which expire within 7 days of the deletion and are used only to recover from a failure (MDPA clause 14.5(a)). Earlier file versions, the audit trail and the WhatsApp opt-out choices are deleted on the deletion date (MDPA clause 14.5(b) to (d)), and nothing is kept under MDPA clause 14.5(e).
- (d) Notice of violations. It notifies the Clinic's person in charge of the protection of personal information without delay of any violation, or attempted violation, by any person of any obligation concerning the confidentiality of the information communicated. In any event the notice is given within the 24 hours of MDPA clause 9, and includes attempts that VstreamX detects and that could have compromised the information.
- (e) Verification. It allows the person in charge of the protection of personal information to conduct any verification relating to these confidentiality requirements (MDPA clause 12).
3. Communication outside Québec (Private Sector Act, s. 17)
3.1 Where the information goes. The information is communicated outside Québec:
- to VstreamX, in Manitoba; and
- to its Sub-processors in the United States and other countries (MDPA clause 13.1 and Schedule 3).
3.2 The Clinic's assessment. Before communicating the information, the Clinic carries out a privacy impact assessment ("PIA"). The PIA takes into account in particular:
- the sensitivity of the information;
- the purposes for which it will be used;
- the protection measures, including contractual ones, that will apply; and
- the legal framework applicable in the State where it will be communicated, including that State's personal-information protection principles.
3.3 This written agreement. The communication is subject to this written agreement. The agreement takes into account the results of the PIA, through the measures in MDPA Schedule 2, clauses 4, 5, 7, 13 and 16 of the MDPA, and this Annex. Where the Clinic's PIA identifies further mitigation measures that it requires, the Clinic records them in the Service. VstreamX then either:
- confirms in writing that it will apply them, in which case they form part of this agreement; or
- tells the Clinic why it cannot.
3.4 PIA pack. VstreamX supplies the Clinic, at no charge and in French, a PIA pack containing:
- (a) the description of the processing and of the data flows;
- (b) MDPA Schedules 1, 2 and 3;
- (c) a description of the legal framework of Manitoba, Canada and the United States applicable to the information, including access by public authorities, and VstreamX's transfer assessment;
- (d) the measures that mitigate the risks; and
- (e) a pre-filled PIA template, which follows the guide of the Commission d'accès à l'information ("CAI").
[[TO CONFIRM: French PIA pack and template completed before Quebec opens]]
3.5 Patient data gate. The Clinic cannot add patient records in DentalX until its person in charge of the protection of personal information attests in the Service that the PIA has been completed, and that it concludes the information will receive adequate protection. The Clinic keeps the PIA, and may upload it to the Service.
4. Information systems project (Private Sector Act, s. 3.3)
The Clinic's adoption of DentalX is a project to acquire an information system involving personal information. The PIA under clause 3 may also serve as the assessment that section 3.3 requires. VstreamX supplies, on request, the information needed to meet section 3.3:
- that the system can produce the information in a structured, commonly used technological format; and
- the measures that protect the information.
5. Confidentiality incidents
5.1 Notice. VstreamX notifies the Clinic of any confidentiality incident (access, use or communication not authorised by law, loss, or any other breach of protection) as clause 2.2(d) provides.
5.2 What VstreamX provides. It provides the information the Clinic needs to:
- (a) assess the risk of serious injury;
- (b) notify the CAI and the persons concerned with diligence where there is a risk of serious injury; and
- (c) record the incident in its register of confidentiality incidents, which the Clinic must keep for all incidents.
6. Act respecting health and social services information (R-22.1)
To the extent R-22.1 applies to the Clinic, VstreamX also undertakes to:
- (a) have each member of its personnel who may have access to the information sign a confidentiality agreement before that access;
- (b) use only the technological products and services that meet the requirements applicable under R-22.1, and inform the Clinic of any change of Sub-processor in advance, so that the Clinic can verify those requirements before the change (MDPA clause 7.5 applies);
- (c) provide the Clinic, on request, with any information about the security measures and the processing;
- (d) allow audits by the Clinic and by the competent authorities;
- (e) notify the Clinic immediately of any confidentiality incident; and
- (f) not keep the information after the end of the contract (clause 2.2(c)).
[[TO CONFIRM: counsel's opinion on whether R-22.1 applies to private dental offices, and the exact provisions to cite]]
7. Rights of the persons concerned
7.1 Assistance. VstreamX assists the Clinic within 5 business days (MDPA clause 8) to answer requests for access, rectification and portability within the 30-day period.
7.2 Portability. The Service exports a patient's record, and the whole Clinic's data, in a structured, commonly used technological format.
8. Identification, location and profiling
DentalX includes no feature that identifies, locates or profiles a person by means of technology. If VstreamX were to introduce one, it would be off by default, and the Clinic would be informed in advance (Private Sector Act, s. 8.1).
9. French language
- The French versions. VstreamX provides the Terms of Service, the Privacy Policy, the MDPA, this Annex, the PIA pack and the Executed Copy in French, at no additional charge. The French versions control unless the Clinic, after they were provided to it, expressly chose to be bound by the English versions (Charter of the French language, s. 55).
- The interface. DentalX's user interface is available in French. [[TO CONFIRM: French UI complete before Quebec opens]]
10. Clauses brought to the Clinic's attention
The MDPA and the Terms are presented in full in the scroll region before acceptance, and the key terms are highlighted. The following are expressly brought to the attention of the Clinic, so that they bind it under articles 1435 and 1436 of the Civil Code of Québec:
- the liability limitation (Terms s. 18; MDPA clause 17);
- the choice of Manitoba law and courts (Terms s. 23; MDPA clause 23); and
- the sub-processor list (MDPA Schedule 3).
11. Retention
- The Clinic's duty. The Clinic keeps its records for the period required by the regulation of the Ordre des dentistes du Québec on the keeping of records: at least 5 years from the last entry. [[TO CONFIRM: current ODQ regulation reference and period]]
- No auto-deletion. DentalX does not auto-delete clinical records.
12. Applicable law
- Quebec law applies. The Private Sector Act and, where it applies, R-22.1 apply to the information whatever law governs the commercial relationship. The same is true of articles 1435 to 1437 of the Civil Code of Québec, which apply to a contract of adhesion.
- No waiver. Nothing in the Terms or the MDPA waives these provisions.
Items to confirm before publication (Quebec)
- Publication date.
- The French PIA pack and template, completed before Quebec opens (§3.4).
- Counsel's opinion on whether R-22.1 applies to private dental offices, and the provisions to cite (§6).
- The French user interface, completed before Quebec opens (§9).
- The current ODQ record-keeping regulation reference and period (§11).