Privacy Notice

Welcome. This Privacy Notice describes how Maple Dental Software Inc. (“Maple Dental,” “we,” “us”) handles personal information in connection with the MapleDent Cloud platform (“MapleDent”), a Canadian dental practice-management platform that includes a patient-facing portal (the “Patient Portal”). Dental records are sensitive health records. Handling them is a matter of trust, and we are committed to earning and keeping yours. Setting out our practices openly is part of that work. This Notice should be read together with our Terms of Service to understand our relationship with you, our users.

1. Our Roles

Your dental practice (a “Subscriber”) uses MapleDent to deliver care and is the custodian of your oral health records. Maple Dental operates MapleDent on the Subscriber’s behalf as its service provider.

MapleDent is a tool that a Subscriber uses to deliver and administer care. As between a Subscriber and MapleDent, the Subscriber controls the personal information it maintains on MapleDent, including contact details, insurance coverage, billing information, and clinical records. Your Subscriber is a health information custodian (or trustee or controller, as those or similar terms are used under applicable provincial health-privacy laws).

Maple Dental acts as a service provider. We store and process patient information in secure facilities and access it only on the Subscriber’s instructions, to operate and support MapleDent, or where required by law.

Because our role is the same in every province we serve, this Notice is written to apply across Canada. It aligns with applicable Canadian privacy legislation, both federal and provincial, and with the health professions legislation governing our Subscribers. Our practices are set out in a documented privacy management program, overseen by our Privacy Officer, covering how we protect personal information, train our people, and handle complaints. We will make that program available to a regulator on request.

2. Consent

Your Consent to this Notice. By accessing MapleDent or using the Patient Portal, you consent to the collection, use, and disclosure of your personal information as described in this Notice and in accordance with applicable privacy laws. Your consent is informed: we tell you what we collect, why, how it is used, and with whom it may be shared. Where we wish to use personal information for a purpose not described here, we will explain the new purpose and seek your further consent.

Patient Consent is the Subscriber’s Responsibility. As custodian, the Subscriber is responsible for obtaining and maintaining the patient consents required by law for the collection, use, and disclosure of patient information. Maple Dental handles those records only on the Subscriber's instructions, and relies on the Subscriber's consent rather than this Notice as the authority for doing so. MapleDent provides consent-by-design tools, including consent capture workflows at patient registration (for example, by tablet in the clinic), to help the Subscriber obtain and record these consents.

Withdrawing Consent. You may withdraw consent, subject to legal and contractual limits and reasonable notice, by contacting your Subscriber. Withdrawing consent may limit MapleDent’s availability to you.

3. Access, Correction & Deletion of Records

Authorized Users and Website Users. You may ask Maple Dental to access, correct, or delete the account information we hold about you. We will respond within the time required by law (ordinarily within 30 days), will explain any limits on what we can do, and will not charge a fee for reasonable requests. Where the law provides a right to have your information moved to another organization, we will support that transfer in the manner the law requires.

Patients. Because the Subscriber is the custodian of patient records, patients exercise access, correction, and deletion rights through their Subscriber. Where Maple Dental receives a request directly from a patient about clinical records, we will direct the request to the appropriate Subscriber and assist the Subscriber in responding.

Special Rules for Health Professionals. Dental records are subject to professional record-keeping requirements. To preserve a complete record, MapleDent maintains a complete version history of changes to clinical records. Some records are archived rather than erased where retention is legally required. Where a record cannot be deleted for these reasons, we (or the Subscriber) will tell you in writing, explain the reason, tell you how to challenge that decision, and where appropriate offer alternatives such as restriction or correction. Where we have shared information with a service provider and a disposal request is granted, we will require that provider to dispose of it as well.

4. Information We Collect

The personal information associated with MapleDent falls into a few broad categories.

Subscriber and Clinic User Account Information. When a Subscriber is onboarded and Clinic Users are set up, we collect the information needed to create and administer accounts. This includes names, roles, business contact details, and login credentials.

Patient Information. In delivering care, a Subscriber enters and generates patient information on MapleDent, which may include names, contact details, dates of birth, appointment and scheduling data, dental imaging and X-rays, clinical charting and notes, and billing and claims information. This information is entered and controlled by the Subscriber as the custodian.

Children's Information. Dental practices treat children, so patient information on MapleDent will often relate to a minor. We treat the personal information of minors as sensitive in all cases, and we apply the same safeguards to it that we apply to clinical records generally. Consent for a minor's information is obtained by the Subscriber from the parent, guardian, or other person authorized to give it, in accordance with the law of the province where care is delivered.

Patient Portal Account Information. When a patient uses the Patient Portal, we process the authentication information (such as a user ID, email address, and password) needed to secure access, and a log of portal activity.

Information Collected Automatically. When you use MapleDent or our website, we automatically collect limited technical information such as IP address, device and browser type, and activity logs. We use cookies only for authentication and to remember account preferences.

Retention. We keep personal information only as long as it is needed for the purposes described in this Notice, or as long as a legal, regulatory, or professional record-keeping obligation requires. Retention periods reflect the sensitivity of the information: account and technical information is kept for shorter periods than clinical records, which are retained by the Subscriber under the record-keeping rules that apply to its profession. When information is no longer needed for any of these purposes, we dispose of it or render it anonymous.

5. Information We Do Not Collect

Credit Card Information. Maple Dental does not charge patients to use the Patient Portal and does not collect patient payment-card information. A Subscriber’s own subscription is paid by pre-authorized debit, electronic funds transfer, or credit card under its Subscription Agreement.

Limiting Collection. Following a privacy-by-design approach, we do not ask for personal information beyond what is necessary to operate MapleDent, secure accounts, and support Subscribers. Optional information may be declined, though doing so may limit what we can offer.

6. How We Use Your Information

We use personal information only for the limited purposes of operating MapleDent, supporting Subscribers, and complying with law. Specifically, we use it to:

• create, administer, and secure user accounts;
• operate MapleDent’s functions — scheduling, charting, imaging, billing, communications, and reporting — on Subscriber’s behalf;
• provide support and respond to requests from a Subscriber and users;
• send service communications, including appointment reminders and account notices (see Section 8 on SMS);
• maintain the security, integrity, and availability of MapleDent, including detecting and responding to misuse, and maintaining logs;
• meet our legal, regulatory, and professional record-keeping obligations and respond to lawful requests.

If we want to use personal information for a purpose not listed above, we will explain it and, where required, seek consent before doing so.

7. How We Share Your Information

With Your Subscriber. Patient information is made available to the Subscriber and to the Subscriber’s authorized users, on a need-to-know basis.

Within MapleDent. Personal information is accessible to MapleDent personnel on a need-to-know basis to operate and support MapleDent. Our personnel are bound by confidentiality obligations.

With Service Providers (subprocessors). We rely on a small number of trusted service providers to host and operate MapleDent, specifically our Canadian hosting and infrastructure provider and our SMS delivery provider. We disclose the subprocessors used to operate the hosted MapleDent. Our general-purpose marketing website and internal operational tools that do not process MapleDent personal information are out of scope. Each subprocessor is subject to a risk-based assessment and to contractual privacy and security obligations substantially similar to those in this Notice, and is limited to what is needed to provide its service. A current list is published on our Subprocessors page.

With Your Consent or Direction. We share personal information with others when you or your Subscriber direct us to.

For Legal Reasons. We may disclose personal information where required by law, court order, or other legal process. Where permitted, we will notify the affected Subscriber or individual before a compelled disclosure and take reasonable steps to limit its scope.

We do not sell personal information, and we do not share it for advertising or marketing purposes.

8. Where Your Data Is Stored

Canadian Data Residency. Personal information in MapleDent is hosted on infrastructure located in Canada. We are committed to keeping MapleDent data in Canada in the ordinary course of operating MapleDent. Data residency describes where information is stored, not the path it travels. When information moves between you and MapleDent over the public internet, the route is determined by the networks in between and may pass briefly outside Canada. That routing is not within Maple Dental's control. Information in transit is encrypted, with the SMS exception described below.

Cross-Border Transfers. We do not transfer MapleDent personal information outside Canada in the ordinary course. If a transfer outside Canada became necessary, we would assess the privacy risks before making it, document the basis for the transfer, apply measures to reduce the risks identified, and disclose the transfer in this Notice or on request.

SMS. Appointment reminders and other text messages are delivered through a third-party telecommunications provider committed to Canadian data residency. Because SMS travels over carrier networks, these messages are not encrypted in transit in the way other MapleDent data is. This is an exception to our standard safeguards, and sensitive clinical information should not be sent by SMS. Text messages include an opt-out (for example, replying “STOP”), and message content is screened to support compliance with Canada’s anti-spam legislation (CASL) and carrier requirements.

9. Artificial Intelligence Governance

No Training on Your Records. A Subscriber’s records and patient information are not used to train, fine-tune, or evaluate artificial-intelligence models, whether by Maple Dental, our service providers, or any third party, except with the Subscriber’s express written authorization. In particular, we do not train AI models on clinical billing codes or clinic data. Where we use aggregate or de-identified information to monitor and improve MapleDent, we do not attempt to re-identify it, and we treat de-identified information as personal information for the purposes of this Notice.

No Automated Decisions About You. We do not use artificial intelligence or automated processing to make predictions, recommendations, or decisions that have a significant effect on an individual. If we ever introduce a tool that does, we will disclose it and provide a way to seek a human review and an explanation.

Limited, Disclosed Operational Uses. We may use narrowly scoped automated tools to support MapleDent operations, such as security-threat detection or structured search within records a user is already authorized to view. Where any such use affects personal information, it will be described here and, where required, consent will be sought.

10. Information Security

Maple Dental maintains administrative, physical, and technical safeguards designed to protect personal information against unauthorized access, use, disclosure, alteration, and destruction, commensurate with the sensitivity of the information held. These include, without limitation:

• encryption of personal information in transit and at rest (with the SMS exception noted in Section 8);
• role-based, least-privilege access controls, with access granted only to those who require it;
• multi-factor authentication for production access, and identity verification for MapleDent users;
• monitoring and logging of activity within MapleDent, including access to records, and version history of changes to clinical records;
• an information-security program maintained toward recognized industry standards;
• contractual confidentiality and security obligations on all service providers, supported by risk-based assessments; and
• a documented incident-response process, including timely notification to affected Subscribers and individuals, and to applicable regulators, where a breach creates a real risk of significant harm, as required by law.

No system can be guaranteed to be completely secure. If you believe your account has been accessed without authorization, or that the security of MapleDent has been compromised, contact us immediately.

11. Changes to this Privacy Notice

Maple Dental may update this Privacy Notice from time to time in response to changes in applicable laws or the continued development of MapleDent functionality. Where a change is material, we will provide reasonable advance notice, ordinarily at least 30 days, on MapleDent or by email. Your continued use of MapleDent after the change takes effect constitutes your acceptance of the updated Notice. Where a change is purely clarifying or corrects an error, it may take effect on posting. Prior versions remain available on request.

12. Contact & Regulators

If you have questions about this Privacy Notice or our privacy practices, or wish to exercise a privacy right, contact:

Maple Dental Software Inc. — Privacy Officer · privacy@mapledentalsoftware.ca

If you are a Patient, requests about your care or your records are handled by your Subscriber as custodian; please contact your Subscriber directly, and we will support it in responding.

Complaints. If you are not satisfied with how we have handled your personal information or your request, you may complain to our Privacy Officer. We will acknowledge your complaint, investigate it, and give you a written response, ordinarily within 30 days. If you remain unsatisfied, you may take the matter to the regulators listed below.

Regulators. You may also contact the Office of the Privacy Commissioner of Canada, or your provincial regulator — including the Information and Privacy Commissioner of Ontario, the Office of the Information and Privacy Commissioner of Alberta, or the Office of the Information and Privacy Commissioner for British Columbia — about our handling of personal information.