Choose a new number
or bring your own
Loi 5, Law 25 and your clinic's phone system.
Patient voicemails, faxes and call recordings are health information. Here is what Quebec law asks your clinic to check before choosing a phone system, and our answers.
What Quebec law asks of your clinic.
Three sets of rules apply to the information your phone system handles. In plain language:
Loi 5 · R-22.1
Your patients' health information
- Applies to private dental clinics since July 1, 2024.
- Voicemails, recordings, faxes and texts about care are generally health information.
- A new phone system calls for a privacy impact assessment and goes in your published technology register.
- Information kept outside Quebec, other provinces included, needs an assessment first.
Arts. 77, 78, 106 and 107
Law 25 · P-39.1
Everything else
- Covers personal information that is not patient health information, such as staff files.
- A person in charge of protecting personal information.
- An assessment before information leaves Quebec.
Private-sector privacy act, as amended in 2021
Ordre des dentistes
Patient records
- Keep records for five years after the last entry.
- Note the significant elements of conversations with patients in the record.
- Protect professional secrecy, including with the people and providers you work with.
Record-keeping regulation (D-3, r. 16) and code of ethics
This page explains the rules in plain language. It is not legal advice; your clinic's privacy officer or lawyer has the final word.
Loi 5, article 77
What your contract with a phone provider must include.
If a provider keeps patient information for your clinic, the contract must be in writing and contain these clauses. Without them, the law says the contract is void.
- The provisions of the law that apply to the information.
- The measures the provider takes to keep it confidential and secure, and to use it only for the contract.
- A confidentiality undertaking signed by every person who may access it, before any information is shared.
- Notice without delay of any breach or attempted breach.
- Your right to verify and investigate.
- Return of the information, free of charge, whenever you ask.
- Secure destruction at the end of the contract.
- Notice of any subcontractor, who takes on the same obligations.
Where each type of patient information lives.
Everything is stored in Canada. Some of it is stored in Ontario, which Loi 5 treats as outside Quebec, so include it in your clinic's privacy impact assessment.
| Information | Stored | Who can see it | How long |
|---|---|---|---|
| Call recordings and their transcripts | Canada (Quebec and Ontario) | People you authorize; every play and download logged | You decide |
| Voicemails and transcripts | Canada (Quebec and Ontario) | People you authorize | You decide |
| Faxes | Canada (Quebec and Ontario) | A login per person; every view and download logged | You decide |
| Call history, contacts and account data | Quebec (Beauharnois), backups in Canada | People you authorize | Deleted after you leave |
For your privacy officer
The questions clinics ask us, answered.
These are the questions Quebec clinics send us before they sign, usually in a vendor questionnaire. Need them on letterhead for your file? Ask and we will send them.
Ask for the written version-
Where is the information stored?
In Canada. Our databases run on dedicated servers we manage ourselves in Beauharnois, Quebec. Call recordings, voicemails and faxes are stored in Canadian data centres in Quebec and Ontario, and backups are kept in Canada.
-
Who owns and runs the infrastructure?
We do. Our own team manages the servers, databases and phone platform. We rent hosting from Canadian data centres (OVHcloud in Beauharnois, among others) but do not outsource the running of it.
-
Which subcontractors can touch the information?
Only a few, each for one job: Canadian hosting and storage providers, the phone carriers that connect calls, and AI providers that process audio for features like voicemail transcription, under signed data processing agreements. Ask us for the full list with names.
-
What about the AI receptionist?
If you connect an AI receptionist such as Claio or Doc Clik, the calls it answers are also processed by that company, under its own terms. Include it in your clinic's assessment, and ask it the same questions you are asking us.
-
Is the information used for anything else, like AI training?
No. We use it only to provide your phone service. We do not use your calls, voicemails, faxes or transcripts to train AI models.
-
Who can see it, and is access logged?
Only the people you authorize, each with their own login. Every time someone opens a fax or plays or downloads a recording, we log who, when, from which IP address, and whether it was viewed or downloaded. That helps with the yearly review of accesses clinics must do, and with the access-logging obligation Loi 5 announces.
-
How is it protected?
Calls are encrypted in transit: the signalling with TLS and the audio with SRTP. Stored data is encrypted at rest.
-
How long is it kept?
As long as you decide. You set how long recordings, voicemails and faxes are kept, so you can match your records policy and your professional order's rules.
-
What happens if there is an incident?
We find the root cause, work out exactly which information and which clients were affected, and tell you directly, so you can meet your own obligations. After an outage, we send a written incident report on request.
-
Do you have SOC 2 or ISO 27001?
No. We would rather say so than imply otherwise, and answer your questions in writing instead.
-
What happens when we leave?
No contract and no fees to leave. Your phone numbers go with you. Download what you need to keep; we then deactivate the account and delete its data, usually within about three months, once your move is complete.
The phone system behind these answers.
More than 300 Quebec dental clinics use EMAK: AI receptionist of your choice, texting, fax and paging, with no contract.
Loi 5, Law 25 and dental clinics: common questions.
Does Loi 5 apply to private dental clinics?
Yes. Since July 1, 2024, private dental clinics in Quebec are covered by the Act respecting health and social services information (R-22.1, often called Loi 5) for their patients' health information.
Does Law 25 still apply to our clinic?
Yes, for the personal information that is not patient health information, such as your staff files. Your patients' health information falls under Loi 5.
Does choosing a phone system require a privacy impact assessment?
Under Loi 5, a telecommunications network counts as a technological product or service, so acquiring or overhauling a phone system calls for a privacy impact assessment (art. 106), and the system goes in the technology register your clinic publishes (art. 107).
Is Ontario "outside Quebec"?
Yes. If a provider keeps patient information outside Quebec, including in another province, your clinic must first make sure a privacy impact assessment shows it would be adequately protected (Loi 5, art. 78). We tell you exactly where each type of data is stored so you can do it.
Do phone recordings have to be kept for five years?
The dentists' record-keeping regulation requires patient records to be kept for five years after the last entry, and the significant elements of conversations with patients to be noted in the record. It does not say recordings themselves are part of the record, so set your retention with your privacy officer. In EMAK, you choose how long recordings are kept.
Do you use patient calls to train AI?
No. We do not use your calls, voicemails, faxes or transcripts to train AI models.
Is EMAK SOC 2 or ISO 27001 certified?
No, and we would rather say so plainly. We answer your privacy officer's questions in writing instead, starting with the ones on this page.
Does using EMAK make our clinic compliant?
No provider can make a clinic compliant; the responsibility stays with your clinic. What we do is give you the answers and documents you need for your assessment and your contract.