Privacy policy

Section 1

The essentials

• Data stored and processed in Québec.Your data is hosted and processed in the Montréal region.
• Excluded from training.Your data is not used to train any model, at AtomicMD or at its suppliers.
• Limited purposes.Your data is neither sold nor used for advertising or profiling.
• Human decision.AtomicMD makes suggestions and the physician decides.
• Exercising your rights.A written request is handled by the person in charge of the protection of personal information.

Section 2

What we collect

Source of the information. Information about a patient is provided by their physician in the practice of their profession, by dictation, typing or photograph of a document. AtomicMD does not collect information directly from the patient and does not have their contact details.

The physician’s voice. Dictation relies on recording the physician’s voice. The physician may also choose to record an encounter after informing the person concerned, obtaining their consent and confirming that consent in the application. Recording always requires an action by the physician.

The clinical text of the case. What the physician dictates or writes is transcribed, then analyzed by AtomicMD, in Québec. Before any processing of this text by a model, whether to put it into a note, analyze the case, write a follow-up entry, answer a question or prepare the billing, direct identifiers (name, health insurance number, date of birth, phone and social insurance numbers, stretcher) are removed from the text and replaced with neutral tokens. Clinical values are kept.

The image of a document, when the physician asks for it to be read. It is sent as is to the reading model, in Montréal, processed in memory, then deleted; only the text kept is stored.

The identity of the visit : a label, the age, the sex, the stretcher or bed, the reason for visit, the health insurance number when it is used for billing, and, when a card has been read, the name and date of birth shown on it.

What is sent to the artificial intelligence models. Three things: the audio of the dictation or recorded encounter, as is, to the transcription service; the photograph of a document, as is, to the reading model; and the clinical text, stripped of its direct identifiers, with the age, sex and reason for visit, which are part of the clinical context needed to analyze the case. The name, health insurance number, date of birth and stretcher known for the visit, as well as health insurance, phone and social insurance numbers recognizable by their format, are replaced with neutral tokens in the text sent. All of this processing runs in Québec, in the Montréal region.

Your account : the email address, the name, the licence number if you choose to provide it, and your consents.

Section 3

Purposes of processing

Your information is used for five purposes: providing you with the service (transcribing, structuring the note, preparing the documents and the billing), securing it (authenticating, logging access, detecting abnormal use), contacting you when necessary, improving the service based on the physician’s reactions to the suggestions, in de-identified form and with no link to the visit, and checking the quality and safety of the artificial intelligence’s suggestions. For this last purpose, the solution keeps, for each call to a model, what was sent to it and what it answered (the decision trace), for 90 days. A physician designated by Technologies AtomicMD inc., bound by professional secrecy, may read a trace that the user physician has questioned through a reaction or a report, or a small random sample, solely for this verification. Every reading is recorded in the log, a questioned trace is kept until its review and for no more than six months, and no information from these reviews is disclosed in a form that could identify a person.

It is neither sold nor used for advertising, profiling or training a model. It is not used to make an automated decision.

Section 4

Consents

Ambient listening to an encounter requires the patient’s consent. Before opening the microphone, the application shows the physician the sentence to say to the patient (what the tool does, the transcription, the deletion of the recording within 48 hours, the right to refuse or to ask to stop at any time, with no effect on care) and asks them to obtain consent; the physician confirms it in one click, and listening stays closed until the confirmation is recorded. The version of the confirmed text, sentence included, and the date are kept on the visit, and the confirmation leaves a trace in the log, with no clinical content. The patient may refuse with no effect at all on their care, and withdraw consent at any time: the physician then withdraws the confirmation in the application, which immediately deletes the encounter audio and leaves a trace in the log.

The physician’s consents are separate and managed one by one, from their settings: each carries its status, the date of the decision and the version of the accepted text, and can be withdrawn in one click in the same place.

Explicit consent. Every optional consent is unchecked by default. Service emails, verification codes and security notices are handled independently of these consents.

Section 5

Use of artificial intelligence

AtomicMD transcribes the dictation, structures the note, suggests a differential diagnosis, prepares documents and formats the billing. This processing uses language models run in Québec, in the Montréal region, by our cloud hosting provider.

AtomicMD makes suggestions without making a diagnosis, prescribing or directing anyone’s care. Each suggestion is subject to the physician’s review and signature; it is therefore not an automated decision within the meaning of Law 25.

Your data is excluded from model training, both at Technologies AtomicMD inc. and at its suppliers.

Records of AI requests and responses. Each call to a model leaves a trace: what was sent to it, after identifiers are removed, and what it answered, with the version of the instructions, the model and the duration. This trace makes it possible to reconstruct a suggestion and check its quality (section 3). It follows the retention of the visit’s clinical content (section 7).

Human intervention. Any comment about clinical content is addressed to the treating physician, who reviewed and signed it and can correct it. The person in charge of the protection of personal information receives and handles comments about the application.

Section 6

Who processes what, and where

We work with a limited number of infrastructure subcontractors, each with a specific role, all in the Montréal region:

The public site, which processes no clinical or account data, is delivered by a global network.

Fee-for-service billing is intended for the Régie de l’assurance maladie du Québec, as provided by law. The solution’s certification by the Régie was obtained in September 2026, in its test environment, with substituted identities. Technologies AtomicMD inc. has been registered with the Régie as a billing agency since October 2026. For the physician who entrusts it with their billing, once their authorization is confirmed by the Régie, AtomicMD submits to the Régie the claims the physician has validated, with the information it requires, and receives its responses. A physician who keeps their agency exports their billing: AtomicMD then submits nothing on their behalf.

Each subcontractor is bound by contract and processes your data only to provide the service, excluding its own purposes and the training of a model. The Supplier management document and its register describe the requirements imposed on them and the evidence obtained.

Section 7

How long

AtomicMD limits the data kept and how long it is kept.

Purges are automatic and periodic: each piece of data carries its expiry date, calculated when it is written, and a sweep deletes whatever has passed it.

What these periods are based on. Clinical information is held on behalf of the physician, in the practice of their profession and under their ethical responsibility; the official record remains that of their institution. The health insurance number is held only because the Régie requires it for billing. Fee-for-service billing is kept for the physician’s professional and tax obligations. Everything else is destroyed when its class expires.

Section 8

Your rights

The physician exercises most of their rights directly on screen: consulting and exporting their records, correcting their note, deleting a record or their account. The account export provides, in open and common formats readable without special software, the structured data of your account and of each visit (JSON), the documents (HTML) and the access log concerning you (CSV); a visit export provides its documents. It is available directly, without prior request or dependence on Technologies AtomicMD inc. The audio and the raw text of a triage sheet are not included: they can be obtained by written request to the person in charge, as long as they are kept (the audio for forty-eight hours, the triage sheet with the visit). The identity information read from the card appears in the header of the exported documents.

For everything else, access, correction, withdrawal of a consent, deletion, de-indexing, complaint or a simple question: write to the person in charge, at confidentialite@atomicmd.ca.

Handling of the request. We acknowledge receipt, we verify your identity by means proportionate to what is requested, and we answer no later than thirty days after the request, as the law requires. A refusal is explained in writing, with the provision on which it is based and the recourse available to you. Each request and how it was handled are recorded.

For a patient : the person able to review what was written about them is their physician, and the documents placed in the institution’s record follow that institution’s rules.

Ceasing dissemination and de-indexing. Clinical content is kept in the application and is neither published, disseminated nor indexed on the public site. A de-indexing request is therefore handled as a destruction request, subject to legal retention obligations. Any restriction is explained to the requester.

After a death. The spouse and close relatives of a deceased person may receive information about them when the law permits, and the person may object in writing during their lifetime. The solution does not hold the patient’s record: such a request is handled with the institution, and we assist with whatever is held by us.

If you are not satisfied with our answer, you can file a complaint with the Commission d’accès à l’information du Québec.

Section 9

Security measures

Your data is encrypted in transit and at rest. Passwords are stored in a protected form and every account requires a second authentication factor. Partitioning ties each record to its physician and prevents one account from accessing another’s records. A tamper-proof log keeps track of sensitive actions.

Section 10

In case of an incident

Every confidentiality incident is recorded in a register. If an incident presents a risk of serious injury, the Commission d’accès à l’information and the persons concerned are notified, as the law provides.

Section 11

The person in charge

The person in charge of the protection of personal information is Charles Kalash, who can be reached at confidentialite@atomicmd.ca.

Section 12

The account and the public site

The physician’s account holds the email address, the name, the licence number if they choose to provide it, and their consents, recorded with the date and the version of the accepted text.

Our site measures its own audience, without cookies, third-party measurement tools or profiling. For each page view, it records the page, the site you came from, the time spent and how much of the page was read, the buttons used, display errors, the type of device, operating system and browser, and the region and city inferred by our hosting provider. Your IP address is neither read nor kept, and none of these records is linked to another or to a person. This data is hosted in Quebec and deleted after twelve months.

When you create an account, the source of your sign-up (for example the link or QR code that brought you) is kept with your account, so we know which channels make us known.

The application sets your session cookie (sixty minutes of inactivity in the browser, seven days in the mobile app); temporary authentication cookies lasting a few minutes (waiting for the code, second-factor enrolment, passkey, sign-in notice), which open no data; and, if you ask for it by checking “don’t ask again on this device”, a thirty-day trusted device cookie that you revoke from your account screen. The source address of your requests is kept in the security log for three years. No audience measurement, advertising or third-party cookie is used.

Session and authentication cookies are necessary for the service: they are used only to recognize you from one page to the next and to protect your connection, and the law does not require consent for them; this policy informs you of them. The trusted device cookie is set only if you ask for it. None of these cookies is used to track you or build a profile.

Section 13

Minors

The solution is intended for physicians and accounts are reserved for adults. A minor patient may be documented by their physician under the same retention and protection rules as other patients.

Section 14

Updates

Any change to this policy carries its date at the top, and the version in force is published here.