Privacy policy

Draft. This policy must be reviewed and approved by the clinic before the website goes live.

This is the statement of information practices of Midland Dental Smile Solutions under Ontario's Personal Health Information Protection Act, 2004 (PHIPA). It also explains what happens to your information when you use this website.

Effective date: [TBC, date of launch]. Last reviewed: October 23, 2026.

In short

• Your dental record is personal health information. We protect it under PHIPA and the record-keeping standards of the Royal College of Dental Surgeons of Ontario (RCDSO).
• We use your information to provide your dental care, to bill you, your insurer or the Canadian Dental Care Plan, and to meet our legal and professional duties. We never sell it.
• Requests you send through this website go from our own web server to our clinic email inbox. No outside form service is involved.
• Only if you agree, this website uses the Google tag to count how many people call, email or send a request after clicking one of our ads. Without your consent nothing is sent to Google. We never send Google what you type into our form, and we do not use your visit for remarketing. You can change your choice at any time.
• You can ask to see or correct your records. If you are not satisfied with our answer, you can complain to the Information and Privacy Commissioner of Ontario.

Who is responsible

Midland Dental Smile Solutions ("we", "us") is a dental clinic at 16821 Highway 12, Unit 3, Midland, ON L4R 0A9. For the records of our patients, the clinic's dentist is the health information custodian under PHIPA. Our dentists, hygienists, staff and service providers act on our behalf as our agents. They may only use your information as this policy and the law allow.

Our Privacy Officer makes sure we follow this policy, answers questions about our information practices, handles requests for access and correction, and receives complaints. You can reach our Privacy Officer at:

Privacy Officer, Midland Dental Smile Solutions
16821 Highway 12, Unit 3, Midland, ON L4R 0A9
Phone: 705-526-6666
Email: info@midlandsmilesolutions.com (subject "Privacy")

Laws and standards we follow

• PHIPA and its regulation (O. Reg. 329/04): for personal health information, which includes everything in your dental record and the reason you contact us about care.
• PIPEDA, the federal Personal Information Protection and Electronic Documents Act: for other personal information we handle in the course of business, for example data from this website and from our online ads.
• RCDSO guidance on dental recordkeeping: what our records contain and how long we keep them.
• Canada's Anti-Spam Legislation (CASL): we do not send marketing emails or text messages without your consent.

Personal health information at our clinic

What we collect

Depending on your care, this can include your name, contact details and date of birth, an emergency contact, your medical and dental history and medications, dental charts, x-rays, photos and other images, treatment plans and clinical notes, appointment records, and insurance, billing and Canadian Dental Care Plan (CDCP) details. We collect it mainly from you. With your consent, we may also collect it from other health care providers, for example your physician or a dental specialist, or from your insurer.

How we use it

• to examine, diagnose and treat you, and to arrange referrals and follow-up care
• to contact you about appointments and treatment
• to bill you, your insurer or benefit plan, or the CDCP
• to keep our care safe and of good quality, and to meet our professional obligations to the RCDSO
• to comply with the law, for example a court order

For any other purpose we ask for your express consent first. We never use or share your health information for marketing without your express consent.

Consent

• Your care team: When you give us information to receive care, PHIPA allows us to assume your implied consent to use it, and to share it with other health care providers involved in your care, unless you tell us otherwise.
• Everyone else: We ask for your express consent before we share your information with anyone who is not providing you with health care, for example your insurance company or benefit plan, your employer, a family member or a lawyer, unless the law permits or requires the disclosure.
• Withdrawing or limiting consent: You can withdraw your consent, or tell us not to use or share certain information, at any time by contacting our Privacy Officer. This does not undo uses that already happened, and it cannot stop us from recording what the law or professional standards require. If we cannot share everything another provider needs for your care, we will tell that provider that some information is withheld.
• Without consent: In limited cases the law permits or requires us to share information without consent, for example to reduce a significant risk of serious bodily harm, to report a child in need of protection to a children's aid society, to report to public health authorities where the law requires it, to respond to a court order or summons, for legal proceedings, to cooperate with the RCDSO in its regulatory work, or to a dentist who takes over our practice. We share only what is needed, and only as PHIPA and other laws permit or require.

Who we share it with

• other health care providers involved in your care, for example specialists, your physician or a hospital
• dental laboratories and manufacturers that make crowns, bridges, dentures, implant parts or clear aligners for you, for example Align Technology, the maker of Invisalign^® aligners, which may store information outside Canada
• your insurer or benefit plan, when we bill them directly for you
• if you are covered by the CDCP: Sun Life, which administers the plan for the Government of Canada, to process your claims
• the service providers listed under Our service providers

We do not sell personal information, and we do not share it with anyone for their own marketing.

This website

You can use this website without telling us who you are. These are all the ways it collects information.

Requests through our form

When you send a request, we receive the topic you chose, your name, your phone number, your email address if you give it, your message if you write one, your consent, the page you sent it from and the time. If you came to our website from an ad or a campaign link, we also receive the ad click ID (gclid, gbraid or wbraid) and campaign tags (utm_source, utm_medium, utm_campaign, utm_term, utm_content). They tell us which ad or campaign led to your request.

We use your request only to answer it and to book your visit. Once we receive it, we treat it as personal health information. Please do not write details about your health, medications, insurance or health card numbers in the message. We will ask for what we need by phone or at your visit.

Your request travels over an encrypted connection (HTTPS) to our web server. A script on the server sends it as an email to our clinic inbox, which is hosted by Microsoft 365. The request is not stored in a database on the web server. As a safeguard against lost email, the server keeps an encrypted copy of each request for up to 30 days and then deletes it automatically. The copy cannot be read on the server. Only our website administrator can open it, and only to pass a lost request on to the clinic. Email between our providers' servers is normally encrypted in transit, but this cannot be guaranteed for every step.

To block spam, the form has a hidden field for bots and accepts at most five requests in ten minutes from the same visitor. For this count the server keeps a coded (hashed) value derived from your IP address and the date, not the address itself. A new value is used each day.

Your privacy choices

We ask before we use optional services. A notice at the bottom of the page offers "Accept all", "Reject all" and "Choose". Until you decide, and if you reject, these services do not run and nothing is sent to Google. If your browser sends a Global Privacy Control signal, ad measurement stays off and we do not show the notice. You can change your choice at any time with "Privacy settings" at the bottom of every page or right here.

Google tag (ad measurement)

We advertise with Google Ads. To see which ads lead people to contact us, this website uses the Google tag of Google LLC (USA), but only if you allow ad measurement. Your browser then connects to Google, and Google receives your IP address, information about your browser and device, the address of the page and of the page you came from, cookie identifiers, and the ad click ID if you came from an ad. We also tell Google when someone taps a phone number or an email link, or sends a request, and on which page this happened.

We never send Google your name, your contact details, the topic you chose or your message. We have switched off ad personalization in the Google tag, so we do not use your visit for remarketing. We do not use Google Analytics.

Google processes this data in the United States and other countries, and may also use it for its own purposes as described in How Google uses information from sites that use its services and in the Google Privacy Policy. You can manage the ads Google shows you in My Ad Center.

Cookies and browser storage

If you turn ad measurement off, we delete the _gcl_ cookies and the stored click IDs. You can also block or delete cookies in your browser settings at any time. The website works without them.

Map

Maps load only after you click "Load map", or right away if you allow Google Maps in your privacy settings. Google then receives your IP address and the address of the website you are on, and may set cookies. Links that open Google Maps take you to Google's service, where Google's privacy policy applies.

Video

Our clinic video is hosted on YouTube, a Google service. It loads only after you click "Play video". We use YouTube's privacy-enhanced mode (youtube-nocookie.com). When you play the video, Google receives your IP address and the address of the website you are on, and may store data in your browser. Links that open YouTube take you to Google's service, where Google's privacy policy applies.

Server logs

Our hosting provider records each visit to the web server: IP address, date and time, the page requested, the referring page, browser information and the result of the request. The referring page and the web address can include an ad click ID if you came from an ad. These logs are used only to keep the website secure and to find faults, and are kept only as long as needed for these purposes.

Fonts, links and social media

All fonts are served from our own server. This website makes no connection to Google Fonts. We link to our Facebook page, but this website has no Facebook pixel or plugin. Facebook receives data only if you follow the link.

Our service providers

These companies help us run the clinic and this website. Where they handle personal health information for us, they act as our agents or electronic service providers under PHIPA and may use or disclose it only as needed to provide their service. Their staff must follow the same rules. We share with them only what they need, and we require them to protect the information. Google, which receives only website usage data and no health information, is described under Google tag.

Information outside Canada

When we keep your records with a provider outside our premises, for example cloud-based practice software, we do so with your consent as the RCDSO requires, and we check how the provider protects the information.

Some of our service providers store or process information outside Canada, mainly in the United States. There, it is subject to the laws of that country, and courts, law enforcement and national security authorities may be able to access it. We choose providers that protect information, and we send them only what is needed.

How long we keep information

If you ask for access to your information, we keep it for as long as you need to use your rights, even if the period above has ended. When we no longer need information, we destroy it securely.

How we protect information

We use physical, administrative and technical safeguards suited to the sensitivity of health information, for example restricted access to records, confidentiality obligations for our staff and service providers, and password-protected systems. This website is only available over an encrypted connection (HTTPS). Our form does not use an outside form service, and no form contents are sent to Google.

If a privacy breach happens

If your personal health information is stolen or lost, or used or disclosed without authority, we will tell you at the first reasonable opportunity. We will also tell you that you can complain to the Information and Privacy Commissioner of Ontario. Where PHIPA requires it, we also report the breach to the Commissioner, and we report yearly breach statistics to the Commissioner.

If a breach involving other personal information creates a real risk of significant harm to you, we report it to the Privacy Commissioner of Canada and notify you, as PIPEDA requires. We keep a record of every breach.

Your rights

• Access: You can ask to see your record or to get a copy of your complete dental record, including x-rays and study models. Please send your request in writing to our Privacy Officer. We answer as soon as possible and no later than 30 days. If we need more time, we may extend this once by up to 30 days and will tell you in writing why. We may charge a fee for copies, limited to reasonable cost recovery as the Commissioner's guidance sets it, and we will give you an estimate first. In rare cases the law allows or requires us to refuse access to part of a record. We will then explain the reason in writing and tell you how to complain. If we do not answer within 30 days, or within the extended period, PHIPA treats this as a refusal, and you may complain to the Commissioner.
• Correction: If you believe your record is inaccurate or incomplete, you can ask us in writing to correct it. We answer within 30 days, or within an extension of up to 30 more days that we explain in writing. If we refuse, you can ask us to attach a statement of disagreement to your record. Where we correct a record, we will, on request, tell the others who received the incorrect information.
• Consent: You can withdraw your consent or limit how we use and share your information, as described under Consent.
• Website data: You can ask what personal information from this website we hold about you. You can change your choice about measurement at any time.

Children and substitute decision-makers

A patient who is capable of making their own decisions about their information decides for themselves, at any age. For a child under 16, a parent, guardian or children's aid society can also make these decisions, except about treatment or counselling that the child consented to on their own. If a capable child and a parent disagree, the child's decision applies. For a patient who is not capable, a substitute decision-maker decides, as set out in PHIPA.

Our form is meant for adults. A parent or guardian can send a request for a child.

Email and text messages

Ordinary email and text messages are not fully secure. When you email us, we use your address to reply. We use email and text messages mainly for appointments. We send personal health information, such as x-rays or treatment plans, by email only through a secure, encrypted service. If you prefer ordinary email, we explain the risk first and note your choice. Before we send, we check that we have the right address. If you prefer, call us instead.

We do not send you marketing messages without your consent.

Questions and complaints

Please contact our Privacy Officer first (see Who is responsible). We take every concern seriously and will reply in writing.

You can also complain to the Information and Privacy Commissioner of Ontario about how we handle your personal health information. A complaint must be in writing. It must normally be made within one year after you learned of the problem, or within six months after we refused a request for access or correction.

Information and Privacy Commissioner of Ontario
2 Bloor Street East, Suite 1400, Toronto, ON M4W 1A8
Phone: 416-326-3333 or 1-800-387-0073, TTY 416-325-7539
www.ipc.on.ca, info@ipc.on.ca

For personal information that is not health information, for example data from this website, you can complain to the Office of the Privacy Commissioner of Canada.

Office of the Privacy Commissioner of Canada
30 Victoria Street, Gatineau, QC K1A 1H3
Phone: 1-800-282-1376, TTY 819-994-6591
www.priv.gc.ca

Changes to this policy

We update this policy when our practices or the law change. The date at the top shows the current version. If we change how we use your information in an important way, we will say so on this page.