Privacy Policy

1. Person in charge of the protection of personal information

In accordance with section 3.1 of Law 25, lapin.ia has designated a person in charge of the protection of personal information:

• Name and title: Pascal Girard, CEO
• Email: support@lapinia.ca
• Phone: 418 254-2544
• Mailing address: 1170 chemin Dion, Lévis, Québec G7A 2B7

For any question about this policy or about exercising your rights, please contact this person.

2. Scope

This policy covers:

• the lapinia.ca website and its subdomains;
• the lapin.ia platform used by client clinics;
• messages sent to patients on behalf of clinics (email, SMS);
• our marketing communications, demos and online forms.

It applies to three groups of people: website visitors, users at client clinics (managers, receptionists, practitioners) and patients on a clinic’s waitlist.

3. Roles and responsibilities

For patient information, the clinic is responsible; lapin.ia acts as a service provider. The client clinic decides which patients are on its waitlist and for what purposes they are contacted. lapin.ia processes this information only on the clinic’s instructions, under a written agreement that complies with section 18.3 of Law 25 (service contract and data processing agreement).

The clinic remains responsible for obtaining its patients’ consent to be contacted about an available slot.

For website visitors and clinic user accounts, lapin.ia is responsible for the processing, in accordance with this policy.

4. Personal information we process

Health information. A patient’s expected type of treatment and priority may reveal health information, which Law 25 considers sensitive. We limit this data to what is strictly necessary to match a patient with a suitable slot. We never receive clinical records, diagnoses or treatment plans.

Minors. A clinic may add a minor patient to its waitlist. It must then provide the contact information of the parent or guardian, to whom messages are addressed. The lapinia.ca website is not intended for people under the age of 14.

5. Purposes of processing

Patient information is never used for marketing by lapin.ia or by any third party. We do not sell any personal information.

6. Messages sent to patients

lapin.ia messages are sent on behalf of the clinic and clearly identify it. They are used only to offer an appointment slot or to confirm a booking.

• A message contains the minimum information: the clinic’s name and the date, time and length of the slot. It does not describe the treatment.
• Patients can stop receiving these offers by replying STOP (or ARRÊT) by text, or through the unsubscribe link in an email. The clinic is notified.
• Offers are sent between 8 a.m. and 8 p.m., clinic time.
• A slot goes to the first patient who accepts it. The others are told it is no longer available.

7. Automated decisions and artificial intelligence

lapin.ia automatically chooses which patients receive a slot offer, and in what order. As required by section 12.1 of Law 25, we inform the people concerned.

The main factors used are: how well the slot length matches the expected treatment, the treating practitioner, the priority level set by the clinic, the availability provided, and time spent on the list. Offers go out in waves: a few patients first, then others if no one accepts.

This decision does not deprive anyone of care: patients keep their place on the list and can always book directly with the clinic. You can ask the clinic for the information and factors used, have them corrected, and ask for a staff member to review the decision.

AI models may be used to write messages or to interpret patients’ replies (e.g., “Yes, I’ll take the slot”). AI providers may not use this information to train their models.

8. Service providers and disclosure to third parties

We use service providers who are bound by contract to confidentiality and security obligations (Law 25, s. 18.3). The full list is available on request.

We may also disclose information:

• when required by law or at the legitimate request of a competent authority;
• to prevent fraud or protect our rights;
• in the event of a merger, acquisition or sale of assets, with notice to the people concerned;
• in any other case, with your consent.

9. Hosting and transfers outside Québec

Production data is hosted in Canada. Some processing, such as sending text messages or calling an AI model, may involve a transfer outside Québec, for example to the United States.

Before any transfer, we conduct a privacy impact assessment (Law 25, s. 17). It considers the sensitivity of the information, the purpose, the contractual and technical safeguards, and the legal framework at the destination. The transfer takes place only if the information will be adequately protected. To reduce risk, we send these providers only the minimum information required and avoid sending them health information whenever possible.

10. Retention periods

We keep information only as long as necessary for the intended purposes.

We may keep some information longer if the law requires it or if it is relevant to legal proceedings.

11. Your rights

Subject to the law, you may:

• access your information and obtain a copy;
• have it corrected if it is inaccurate or incomplete;
• request its deletion;
• receive it in a structured, technological format (portability, Law 25, s. 27);
• withdraw your consent at any time;
• ask that its dissemination cease or that it be de-indexed;
• get an explanation of an automated decision and ask for it to be reviewed;
• file a complaint with the Commission d’accès à l’information (section 15).

Patients: please send your request to your clinic first, since it is responsible for your information. lapin.ia will help it respond. You can also write to us; we will forward your request to the clinic.

Users and visitors: write to support@lapinia.ca, stating your identity, the nature of your request and the information concerned. We respond within 30 days, free of charge, unless the request is clearly abusive.

12. Confidentiality incidents

In accordance with sections 3.5 to 3.8 of Law 25:

• we keep a register of confidentiality incidents;
• if an incident involves patient information, we notify the clinic concerned without delay, and no later than 48 hours after detecting it;
• if the incident presents a risk of serious injury, the Commission d’accès à l’information and the people concerned are notified;
• we take reasonable measures to reduce the injury and to prevent a similar incident from happening again.

13. Cookies

The lapinia.ca website uses cookies and similar technologies. Non-essential cookies are disabled by default and are set only with your consent, given through the banner on your first visit.

You can change your choices at any time through the “Cookie preferences” link at the bottom of the page, or set your browser to block cookies. Messages sent to patients contain no advertising tracking pixels.

14. Security

We apply reasonable technical and organizational measures, suited to the sensitivity of the information:

• encryption in transit (TLS) and at rest;
• logical separation of data between clinics (multi-tenant);
• least-privilege access and multi-factor authentication;
• access logging and monitoring;
• minimization of the information sent to providers;
• an incident response plan and regular assessments.

No measure is foolproof; transmission over the Internet carries some residual risk.

15. Links, changes and complaints

Links to third-party sites. This policy does not apply to the third-party sites we link to, including your clinic’s portal.

Changes. The version in effect is the one published on this page. If there is a significant change, we will notify client clinics by email and post a notice on the website before it takes effect. Any new purpose will be subject to consent where the law requires it.

Contact us. 9398-⁠0829 Québec inc. (lapin.ia), Person in charge of the protection of personal information, 1170 chemin Dion, Lévis, Québec G7A 2B7, support@lapinia.ca, 418 254-2544.

Complaints. If you believe your rights have not been respected, you may file a complaint with the Commission d’accès à l’information du Québec (cai.gouv.qc.ca) or, where PIPEDA applies, with the Office of the Privacy Commissioner of Canada (priv.gc.ca).