Privacy Policy

Contacting us

If you have questions or complaints about how we handle your information, or wish to:

• ask questions
• update or delete your account
• change user preferences
• register a concern
• opt out of marketing
• exercise any of your data rights

You may contact us at [email protected]. We will respond to all inquiries within 30 days. You may be asked to verify your identity.

About us

We provide the ChartAI Platform to licensed dental professionals to assist with ambient clinical documentation and related services. The Services support charting, patient communication, AI-powered automation, and enhanced clinical workflows.

Definitions

• "you" refers to the user of our Platform and Services.
• "your information" includes your personal, professional, or health information.
• "privacy laws" includes PIPEDA and PIPA (British Columbia) applicable health information laws, and any other jurisdictional laws that apply to us.

Types of information we collect

We collect the following types of data:

Patient information

Our application only collects personal information that is either:

• directly entered by authorised healthcare practitioners, or
• captured during their use of the application.

The collection of this data, including device metadata, is essential for improving the user experience, optimising performance, and enforcing strong security protocols. For patient/clinical information processed through the Services, the healthcare practitioner/clinic generally acts as the data controller (or equivalent under applicable law), and General Technologies acts as a processor/service provider processing such information on the controller's documented instructions. Where GDPR applies, processing of data concerning health requires an applicable Article 9 condition in addition to an Article 6 lawful basis. Where Canadian private-sector laws apply (including PIPEDA and provincial regimes), the clinic/practitioner is responsible for obtaining any required patient consent and providing appropriate notices for collection, use, and disclosure of sensitive information.

As part of its core functionality, the application can generate summaries of clinical discussions. This means the entire conversation between a healthcare provider and their patient may be recorded, including sensitive personal health information. Audio recordings are used to generate a text-based transcript (the "Transcript") and to support additional clinical workflows that aid documentation and care delivery.

Transcripts

General Technologies uses advanced machine learning and artificial intelligence technologies to analyse Transcripts in order to deliver core functionality and continuously improve our services. Processing these Transcripts is essential: without it, the application cannot function as intended.

We do not disclose Transcripts or audio recordings to third parties except (a) to contracted service providers operating the Services on our behalf under confidentiality and security obligations and only to the minimum extent necessary, (b) where you authorize disclosure (including via integrations), or (c) as required by law.

We rely on healthcare practitioners to obtain any necessary patient consent prior to using the application. If a practitioner does not have the patient's consent to collect and use their personal information in this way, the application must not be used with that patient.

Voice data

By accessing or using the Voice Service, you agree to the collection and processing of voice data. This "Voice Data" may include information such as audio recordings from the microphone during your use of the Service. When you use our voice services, we collect and use your voice input and other information to respond to your requests, provide the requested Service to you, and improve our services. We obtain your express consent to collect and process voice data and reaffirm consent periodically, especially when dealing with sensitive information. The collection and processing of voice data comply with all applicable privacy laws in British Columbia, including requirements for consent, purpose limitation, and data security.

Log data

We may also collect information that your browser or mobile device sends whenever you visit our Service ("Log Data"). This Log Data may include information such as your computer's Internet Protocol ("IP") address, browser type, browser version, the pages of our Service that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers, and other statistics.

How we collect information

We collect information:

• directly from you during registration or usage of the Platform
• through communications (email, chat, calls)
• through cookies and analytics
• from your employer (for employees)
• from public and third-party sources (for verification or recruitment)
• via authorized integrations or services

How we use this information

AI training and development

We may use de-identified or pseudonymized information, including clinical and operational data, to improve and train our artificial intelligence (AI) models, but only where permitted by law and with the necessary consent.

When we process personal information for the purpose of AI model development:

• We apply data minimization and pseudonymization techniques to reduce re-identification risk.
• We do not use identifiable patient data for model training unless we have obtained explicit informed consent from the individual or the healthcare provider authorised to provide it on their behalf.
• Where applicable, we ensure training datasets are processed in accordance with provincial and federal privacy legislation, including PIPEDA, PIPA (BC), and Quebec's Private Sector Act.
• We conduct privacy impact assessments and employ technical safeguards to prevent inference or membership attacks and to ensure data is not regurgitated in outputs.

If personal information is used in a manner that could reasonably be expected to impact individual privacy, we will provide clear notice, justification, and opt-out mechanisms where possible.

For clarity, de-identification and anonymization reduce privacy risk, but information will be treated as outside the scope of GDPR only where it is anonymized such that individuals are not identifiable (consistent with Recital 26); pseudonymized information remains personal information under applicable privacy laws and is handled accordingly.

Marketing and opt-out

We may send emails or promotional materials related to our services. You can:

• unsubscribe via any message you receive, or
• email [email protected]

We do not use health information for marketing. We do not share information with third parties for their own marketing purposes without your explicit consent.

Data storage

We store personal information of Canadian users in Canada.

We recognise the importance of data sovereignty and are committed to safeguarding personal information. Accordingly, personal information of users located in Canada is stored on servers within Canada. Where Québec law applies, before communicating personal information outside Québec, we conduct a privacy impact assessment and implement appropriate contractual and technical safeguards to ensure the information would receive protection equivalent to that provided under Québec law.

For users located outside of Canada, we store and process personal information in jurisdictions that are appropriate to the delivery of our Services and in accordance with the legal requirements of the applicable region. Where personal information is transferred or processed outside a user's country of residence, we ensure that appropriate safeguards, including data processing agreements and technical protections, are in place to maintain the confidentiality and integrity of that information in compliance with applicable privacy laws.

Information sharing

We may share data with:

• our staff and affiliates
• third-party service providers under contract
• regulators and legal authorities
• parties to a corporate transaction
• anyone you authorize us to share with (e.g., via integrations)

We ensure third parties follow the same or stronger privacy practices via contractual terms.

How and why we share your information with trusted third parties

To operate our website and application effectively, we engage trusted third-party providers to support essential functions such as:

• Fraud detection and prevention
• Payment processing and transaction notifications
• Delivering requested services or information
• Maintaining and improving the functionality of our website and application
• Providing customer support

In the event of a corporate transaction such as a merger, acquisition, reorganisation, or sale of our business, we may transfer personal information as part of that process. In such cases, we will ensure that any transferred data remains protected in a manner consistent with this Privacy Policy.

Except as described above, General Technologies will not use or share any personal information collected from users or patients without proper authorisation.

Cookies and analytics

Cookies are files with a small amount of data, which may include an anonymous unique identifier. Cookies are sent to your browser from a website and stored on your computer's hard drive. We use "cookies" to collect information. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may be unable to use some portions of our Service.

Third-party analytics tools (e.g., Google Analytics) do not receive any Protected Health Information (PHI) or patient data.

How we safeguard your information

Confidentiality incidents / privacy breaches

We maintain a record (register) of confidentiality incidents/privacy breaches as required by applicable law. Where a breach of security safeguards involving personal information creates a real risk of significant harm, we will notify affected individuals and report to the Office of the Privacy Commissioner of Canada as required under PIPEDA, and we will keep breach records as required.

Where Québec's private-sector law (as amended by Law 25) applies, if a confidentiality incident presents a risk of serious injury, we will notify the Commission d'accès à l'information du Québec (CAI) and affected individuals as required, and maintain the incident register.

Your rights

You have the right to:

• access your information
• correct inaccurate data
• request deletion or anonymization
• request portability in a machine-readable format
• object or withdraw consent (subject to legal exceptions)
• lodge a complaint with the appropriate regulator

Please send your requests to [email protected].

Employees

We collect the following from employees or applicants:

Children's privacy

Our Service does not address anyone under the age of 13 ("Children"). We do not knowingly collect personally identifiable information from children under 13. If you are a parent or guardian and you are aware that your Children have provided us with Personal Information, please contact us. If we become aware that we have collected Personal Information from children under age 13 without verification of parental consent, we take steps to remove that information from our servers.

Third party sites

Our Services may contain links to external websites. We are not responsible for the privacy practices of those sites. Review their policies independently.

Links to other sites

Our Service may contain links to other sites not operated by us. If you click on a third-party link, you will be directed to that third-party's site. We strongly advise you to review the Privacy Policy of every site you visit. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

Privacy Officer

We have appointed a Privacy Officer who is responsible for overseeing our compliance with applicable privacy laws, including the Personal Information Protection Act (PIPA) of British Columbia. If you have any questions, concerns, or requests regarding your Personal Information or our privacy practices, please contact our Privacy Officer at [email protected].

General

We may modify this Privacy Policy at any time, so please review it periodically. By continuing to use the Services after any modification, you consent to be bound by the modified Privacy Policy. This Privacy Policy is governed by the laws of British Columbia. If you have any questions about this Privacy Policy, please contact us at: [email protected].