Privacy Policy

1. Introduction

Dr. Fersan Marei Dentistry Professional Corporation ("we", "us", "our") is committed to protecting the privacy and confidentiality of personal information and personal health information entrusted to us. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the clinic scheduling portal at marei.ca (the "Portal").

As a dental practice operating in Ontario, Canada, we are governed by the Personal Health Information Protection Act, 2004 (PHIPA) with respect to personal health information, and by the Personal Information Protection and Electronic Documents Act (PIPEDA) with respect to other personal information collected in the course of commercial activities.

2. Key Definitions

Personal Health Information (PHI)

As defined under PHIPA, personal health information includes information about an individual's physical or mental health, health care history, treatment plans, health care providers, and payments or eligibility for health care. In the context of our Portal, this includes:

• Optional patient reference information provided by the clinic for identification purposes on treatment estimates
• Procedure codes, treatment plans, and clinical notes
• Production records related to dental procedures performed
• Treatment estimates including procedure details and associated fees
• Uploaded documents such as production sheets, receipts, and clinical images
• The Portal does not independently collect or store patient medical histories, diagnoses, or treatment records beyond what is necessary for scheduling, production tracking, estimate generation, and the anonymous clinical records Dr. Marei creates for his own care of a patient: clinical notes, letters, and readings of documents provided for a patient's care. All of these are held without any patient identifying information

Health Information Custodian

The referring dental clinic is the health information custodian under PHIPA and is responsible for the personal health information in its custody or control. Dr. Fersan Marei acts as an agent of the clinic under PHIPA when providing dental services at the clinic. As an agent, Dr. Marei collects, uses, and discloses personal health information only as authorized by the clinic and in accordance with PHIPA.

Personal Information

Information that does not relate to health care but identifies an individual, such as business contact details, clinic registration information, and account credentials.

3. Information We Collect

Personal Health Information

• Optional patient reference information provided by the clinic for identification purposes on treatment estimates
• Dental procedure codes, descriptions, and fees from the ODA fee guide
• Production records: procedure counts, production totals, clinical notes
• Treatment estimates with procedure details, tooth numbers, and cost breakdowns
• Uploaded clinical documents and images (production sheets, receipts, and documents a patient or their physician provides, such as a medication list, medical history, or a reply to a request for medical clarification)

Production sheets and other documents uploaded to the Portal are stored as image or PDF files. Patient identifying information that may appear on these documents, such as names, dates of birth, contact details, and health card, chart or file numbers, is NOT extracted into the Portal's database. From a production sheet or receipt, only aggregate financial data such as total production amounts and procedure counts is extracted. From a clinical document, only clinical facts are extracted, such as medications, conditions, allergies and a physician's answers. The result is checked automatically and discarded in full if it still contains identifying information.

Personal Information

• Clinic name, address, phone number, and email
• Contact person name, email, and phone number
• Sign-in details: your email address, and a hashed password only if you choose to add one. Clinic accounts normally have no password (see Section 12)
• Financial information: collection amounts, payment methods, cheque numbers

Automatically Collected Information

• Usage data such as pages visited and features used
• Device information including browser type, operating system, and IP address
• When a treatment estimate is accepted or declined through its link, the IP address and browser details of the device used, recorded with that decision
• Cookies and similar technologies for session management

4. Consent

Under PHIPA, we collect, use, and disclose personal health information only with your consent, or as permitted or required by law. By registering for and using the Portal, you consent to the collection, use, and disclosure of your information as described in this Privacy Policy.

You may withdraw your consent at any time by contacting us at privacy@marei.ca. Please note that withdrawing consent may affect your ability to use the Portal and may not apply to information we are required to retain by law or for regulatory purposes.

Where we act as an agent of a referring dental clinic (the primary health information custodian), we collect and use personal health information on their behalf and in accordance with PHIPA.

5. How We Use Your Information

We use the information we collect for the following purposes:

• Providing and maintaining Portal access and account authentication
• Facilitating scheduling and booking between clinics and Dr. Marei
• Generating treatment estimates and tracking production records
• Turning a dentist's dictation into text and drafting clinical notes and letters for the dentist to review
• Suggesting addresses while a clinic registers
• Processing and recording collection payments
• Sending transactional emails such as booking confirmations, reminders, and notifications
• Sending clinics occasional emails about Dr. Marei's visiting service, each with an unsubscribe link
• Storing uploaded documents as audit records attached to production and collection entries
• Analyzing usage patterns to improve the Portal experience

6. Disclosure of Information

We do not sell, rent, or trade personal information or personal health information. We may disclose information in the following circumstances:

• To the referring dental clinic for purposes of coordinated patient care
• To third-party service providers who process data on our behalf (see Section 8)
• As required by law, regulation, court order, or regulatory body (including the RCDSO)
• To protect the rights, safety, or property of our practice, our patients, or the public

7. Cookies & Tracking Technologies

We use cookies and similar technologies to operate and improve the Portal:

Session Cookies

Essential cookies required for authentication and session management. These are necessary for you to log in and use the Portal securely. They are removed when you sign out, and they expire after a period without activity.

Preferences Saved in Your Browser

Some choices are saved in your browser's local storage instead of a cookie, such as your light or dark theme, your answer to the cookie notice (saved under the name “cookie-consent”), and the sign-in option you last used on that device.

Analytics

We measure how this site is used, in two ways that are kept deliberately separate:

• Vercel Analytics and Speed Insights record page views and page load times. They come with our hosting provider, Vercel, and are served from this site. They set no cookies, do not follow you to other websites, and do not store your IP address: it is used only to work out a country and is then discarded. Because they collect no personal information, they run for all visitors.
• Google Analytics 4 runs only if you tap Accept on the cookie notice. It sets cookies and sends usage data to Google. It never runs inside the Portal (the pages you see after signing in), on the after-care instruction pages, or on invitation, estimate and password reset pages. If you tap Decline, it is not loaded at all: your browser never requests it.

You can change your answer at any time with Cookie settings at the bottom of this page. If you decline after accepting, Google Analytics is switched off and the page reloads without it. The Google Analytics cookies set on this site are also removed from your browser.

After-care instruction pages

The pages a patient reaches by scanning the QR code on a printed after-care sheet are treated more strictly than the rest of the site. The address of those pages names a dental procedure, so that address is never sent to any analytics provider: every one of them is reported only as “/aftercare”, with the procedure and the language removed.

We do keep a count, in our own database, of how many times each after-care sheet is opened in each language, so we know which instructions are being used and which languages to add next. That count holds no IP address, no device information, no identifier of any kind, and no time of day. It holds only the sheet, the language, and the date. It cannot be connected to a person, and it is never shared.

To count each sheet once a day per phone, the page leaves a cookie in the browser after it loads. The cookie names the sheet and holds the date, nothing else. It is sent only to the after-care pages and expires after one day. If you tap Decline on the cookie notice, the page leaves no such cookie and removes one it has already left. A phone that declined can then be counted more than once a day. Search engines and link previews are not counted.

8. Third-Party Services

We use the following third-party service providers to operate the Portal. These providers act as our agents and are contractually obligated to protect the confidentiality and security of your information:

• Vercel: hosting for this website and the Portal (servers in the United States).
• Neon: PostgreSQL database hosting, in the United States. All data is encrypted at rest and in transit.
• Vercel Blob: private file storage for uploaded documents and images (Montreal, Canada region). Files are not public. The Portal serves them only to a signed-in dentist who is allowed to see them.
• Google Drive: an inbox folder Dr. Marei uses to send documents to the Portal, such as production sheets, receipts, cheques and clinical documents. The Portal reads the files with a service account and keeps a private copy in Vercel Blob of each one it can use. It then moves the original into a Processed folder in that Drive, where it stays.
• Resend: email delivery for one-time sign-in codes, booking confirmations, notifications, other system emails, and the occasional emails to clinics described in Section 5.
• Google sign-in: if you choose Continue with Google, Google shares your name, email address and profile picture with us. The Portal saves your name and email address.
• Google Maps Platform: address suggestions on the clinic registration page. What you type in the address box is sent to Google to find matching addresses.
• Google Analytics 4: website usage measurement, loaded only after you accept the cookie notice. Never loaded inside the Portal or on the after-care instruction pages.
• Vercel Analytics & Speed Insights: page view and performance measurement without cookies. No personal information is collected.
• OpenAI (Whisper): transcription of dictation. When a dentist dictates in the Portal, for example a clinical note or a letter, the recording is sent to OpenAI to be turned into text before Anthropic's Claude writes the note or letter. The Portal does not save the recording. OpenAI does not use this data to train its models.
• Anthropic (Claude AI): writes clinical notes and letters from dictation, runs the Portal Assistant that dentists use inside the Portal, and reads uploaded images and PDFs (OCR). Production sheets, receipts and cheques are read for financial figures, and clinical documents (for example a medication list, a medical history, or a physician's reply) are read for clinical facts only. What is returned and kept never includes patient identifying information. Anthropic does not use this data to train its models and retains it only in accordance with its data retention policies.

Some of these providers process or store information outside Canada, including in the United States.

9. Data Retention

We retain personal health information and personal information in accordance with our legal and regulatory obligations:

• Health records: Retained for a minimum of 10 years from the date of the last entry, as required by the RCDSO and applicable Ontario regulations
• Financial records: Retained for a minimum of 7 years as required by the Canada Revenue Agency
• Account data: Retained for as long as your account is active. Upon account deletion, personal information is removed except where retention is required by law
• Uploaded documents: Retained as part of the associated production or collection record and subject to the same retention periods

10. Your Rights Under PHIPA

Under the Personal Health Information Protection Act (PHIPA), you have the following rights with respect to your personal health information:

• Right of Access: You have the right to request access to your personal health information in our custody or control. We will respond to your request within 30 days.
• Right of Correction: You may request that we correct any inaccurate or incomplete personal health information. If we do not agree with the correction, you may attach a statement of disagreement to the record.
• Right to Withdraw Consent: You may withdraw your consent for us to collect, use, or disclose your personal health information at any time, subject to legal or regulatory restrictions. Withdrawing consent may limit your ability to use the Portal.
• Right to Complain: If you believe your privacy rights have been violated, you have the right to file a complaint with the Information and Privacy Commissioner of Ontario (IPC). The IPC can be reached at 1-800-387-0073 or www.ipc.on.ca.

Your Rights Under PIPEDA

For personal information that is not health information, you also have rights under PIPEDA, including the right to access, correct, and request deletion of your personal information, and to withdraw consent. To exercise any of these rights, contact us at privacy@marei.ca.

11. Data Breach Notification

In accordance with PHIPA, if a breach of personal health information occurs that poses a risk of significant harm, we will:

• Notify affected individuals at the first reasonable opportunity
• Report the breach to the Information and Privacy Commissioner of Ontario
• Take immediate steps to contain the breach and prevent further unauthorized access
• Notify the regulatory college (RCDSO) where required

12. Data Security

We implement appropriate technical and organizational safeguards to protect personal health information and personal information:

• All data transmitted between your browser and the Portal is encrypted using TLS (Transport Layer Security)
• Database content is encrypted at rest through our database provider (Neon)
• Uploaded files are stored privately in Vercel Blob (Montreal, Canada region)
• Documents sent through the Google Drive inbox are copied into the same private storage. The originals stay in Google Drive (see Section 8)
• Clinic accounts normally have no password. They sign in with Google, or with a one-time code sent by email that is stored only in hashed form
• A password can be added to an account. It is hashed using bcrypt with 12 rounds and is never stored in plain text
• Role-based access controls restrict access to sensitive data based on user permissions
• Rate limiting protects against unauthorized access attempts
• Security headers (HSTS, X-Frame-Options, CSP) are enforced on all pages

While we strive to protect your information using commercially reasonable safeguards, no method of transmission over the Internet or electronic storage is completely secure. We cannot guarantee absolute security.

13. Children's Privacy

The Portal is designed for use by dental professionals and clinic administrators. It is not directed at individuals under the age of 18. We do not knowingly collect personal information directly from children. Patient information entered into the Portal (including for minor patients) is collected and managed by the treating dental professionals in accordance with PHIPA.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we provide. Changes will be posted on this page with an updated "Last updated" date. Your continued use of the Portal after any changes constitutes your acceptance of the revised policy. We encourage you to review this policy periodically.

15. Contact & Privacy Officer

If you have questions about this Privacy Policy, wish to exercise your rights, or have concerns about how your information is handled, please contact our Privacy Officer:

If you are not satisfied with our response, you may contact the Information and Privacy Commissioner of Ontario at 1-800-387-0073 or visit www.ipc.on.ca.