Specific, rather
than reassuring.

Under Canadian health-privacy law, your practice is the health information custodian. The record belongs to your practice, and the obligations to your patients are yours.

DentureFlowPro acts as your electronic service provider — we supply and operate the software that stores and presents that record on your behalf. In that role we:

• use personal health information only as necessary to provide the service to you;
• do not disclose it to anyone else, and do not sell it, rent it, or use it for advertising;
• do not use your patients' information to train artificial-intelligence models;
• hold it under the safeguards described below.

This distinction matters. It means the record stays yours, and it means you can answer your own patients — and your College — about who holds their information and on what basis.

Two different sets of information, held for two different reasons, under two different responsibilities.

About you, the practitioner using DentureFlowPro. Your account details, and an audit entry for what you do in the record. That is a separate document, because it is a different subject with different obligations — see the privacy policy for practitioners.

About your patients, held on your practice's behalf. Your practice decides what goes into a chart; the system is capable of holding:

• identifying and contact details — name, date of birth, address, telephone number, email address, and the chart number your office assigns;
• medical history and health questionnaire responses, allergies, medical alerts and clinical flags;
• the clinical record itself — treatment notes, treatment plans, appointments and their outcomes;
• clinical images: intraoral and extraoral photographs, radiographs, scans and scanned documents;
• insurance and benefit details, including CDCP status and policy information;
• financial records — fees charged, payments received, receipt numbers and account balances;
• where your practice uses patient texting: mobile number, message content, and the consent and opt-out state described further down this page.

What is not collected. There is no advertising or cross-application tracking in this product, and no analytics that follow a person between services. Nothing here is sold or rented. Patient information is not used to train artificial-intelligence models. We do not ask for information we have no use for — there is, for instance, no reason for this system to hold a patient's social insurance number, and it does not.

Personal health information is stored in Canada. Every component that holds patient data sits in Google Cloud's Montréal region (northamerica-northeast1):

• the application, running on Google Cloud Run in Montréal;
• the database holding the clinical record, a managed Cloud SQL instance in the same region;
• patient documents and radiographs, in regional storage in Montréal;
• the nightly database backups, in the same Montréal region — not in a multi-region location outside Canada.
• the AI processing, on Vertex AI in that region — described in full below.

Records created in your practice therefore remain in Canada in the ordinary course of operation, rather than being processed in another jurisdiction. Data is encrypted in transit and encrypted at rest under Google-managed keys.

DentureFlowPro uses AI to format dictated notes, read radiographs, draft referral letters and assist with intraoral examinations. That processing runs on Google Cloud Vertex AI, in the same Montréal region as the rest of your data, under our signed agreement with Google Cloud — not through a consumer AI service.

• Nothing is sent unless a staff member asks for it. AI runs when someone invokes a feature, on the record in front of them — there is no background processing of your database.
• Your patients' information is not used to train models, ours or anyone else's.
• The AI does not write clinical attestations. That the medical and dental history were reviewed, and that consent was obtained and explained, are confirmed by the clinician — never asserted on their behalf by a model.
• AI output is a draft. A clinician reviews and signs; the note locks on their action, not the model's.

• Four staff roles — Denturist, Treatment Coordinator, Chairside Assistant and Dental Technologist — each seeing what their work requires and no more.
• Financial information is restricted to the denturist and front desk. Laboratory and technical roles never see billing.
• Releasing a complete patient record is restricted the same way, because it is a records function rather than a clinical one.
• Practices are separated at the architectural level. Every record belongs to a clinic, the active clinic is re-validated on every single request, and access across practices is refused outright rather than filtered out of a result. It fails closed.
• Every staff member signs a confidentiality agreement before the system will return any patient data. This is enforced by the server, not merely hidden in the interface.
• Two-step verification is available to any staff member who wants it, with single-use backup codes and an administrator reset behind that.

Under PHIPA, being able to answer "who accessed this record, and when" matters as much as preventing improper access in the first place. DentureFlowPro records:

• logins and failed login attempts;
• every chart view — so "who looked at this patient's chart" is a question with an answer;
• every creation, update and deletion of a record;
• every export of a patient record, separately flagged. A download otherwise leaves no trace, so it is deliberately captured.

Each entry carries the staff member, the record affected, the originating IP address and a timestamp.

• Denturist notes lock on entry. Notes written by other staff enter a review queue and are locked by the denturist.
• Corrections append. Notes are not deleted, and cannot be backdated.
• Clinical attestations are affirmed, not assumed. The record states what the clinician has confirmed — nothing is asserted on their behalf by default.
• Appointment status changes write their own locked entries, so the treatment timeline documents itself.

A patient may ask for a copy of their own record, and a patient moving practices is entitled to have their chart follow them. These are two different needs, and the platform serves both:

• A readable PDF of the complete record — demographics, health history, clinical notes, appointments and account history — for the patient themselves.
• A structured export, including radiographs and scanned documents, suitable for import by a receiving practice's system. A transfer without the images is not a transfer.
• Every release is audited, so your practice can always evidence what was disclosed, to whom, and when.

The record is append-only by design, and there is deliberately no facility to delete a patient chart from the interface.

This is not an oversight. Denturists across Canada are subject to record-retention obligations that outlive most requests to remove information, and a chart that can be erased on impulse is not a legal record. Providing a copy of a record and destroying a record are two different requests, and only the first can be answered on the spot.

Where a genuine erasure obligation arises, it is handled as a deliberate, audited, administrator-level operation with the legal basis recorded against it — never as a button on a chart.

Appointment reminders and recall messaging are off unless deliberately switched on, both at the platform level and again by each individual practice. Nothing is sent by default.

When enabled:

• Consent is verified at the moment of sending, not when a message is queued — so a patient who withdraws consent is not messaged by something already in the queue.
• A patient's STOP reply is honoured immediately, and can only be reversed by the patient's own instruction.
• Quiet hours are enforced in the practice's local time zone.
• Every message sent is retained on the patient's chart, so you can always evidence what a patient was told.

• Encrypted in transit (TLS) and at rest.
• Passwords stored using bcrypt at a deliberately high work factor; sign-in attempts rate-limited per source.
• Session cookies are HTTP-only, transmitted only over TLS, and restricted against cross-site use.
• A strict Content-Security-Policy, HSTS, MIME-sniffing protection, and a prohibition on framing the application — which prevents clickjacking of clinical actions.
• Cross-site request forgery protection on every state-changing request.
• File downloads are checked against the owning practice on every request, not merely by an unguessable link.
• Nightly encrypted database backups, held in the Montréal region rather than a multi-region location outside Canada.

An automated suite of more than a hundred and fifty tests — including browser tests, and covering access control, separation between practices, billing arithmetic, record export and the consent rules above — runs against every change before it can be accepted.

Deployments to production are deliberate and manual. Nothing reaches the live system automatically.

Software is one half of compliance; the practice is the other. To hold up your end:

• Give every staff member their own account. Shared logins destroy the value of the audit trail — it can only tell you who did something if "who" is a real person.
• Remove accounts promptly when someone leaves.
• Use strong, unique passwords, and never reuse a password from another system.
• Keep your own privacy policy, consent practices and breach procedure current. As custodian, those remain your responsibility.