PHIPA Alignment
Smile Konnect equips Ontario dental groups with the controls they need to protect personal health information. This statement maps our safeguards to the administrative, technical, and physical standards required by the Personal Health Information Protection Act (PHIPA).
Last updated: November 17, 2025
Audit trails / year
100% captured
Data residency
Canada-only
Security incidents
0 reportable to date
Governance, policy, and onboarding controls designed for multi-clinic deployments.
Only verified clinics receive tenant spaces. Each user is tied to a clinic, role, and least-privilege permission set before activation.
Consent definitions, export reason codes, and notification templates are versioned so clinics can demonstrate policy lineage during inspections.
Every user interaction flows through AuditLoggingInterceptor, capturing user, IP, device metadata, and action context.
Encryption, RBAC, and service hardening built directly into the platform.
Backend secrets live in environment files resolved via resolveEnvFilePaths(). AES-256 encryption protects data at rest, while TLS 1.3 secures traffic.
Guards in backend/src/guards ensure JWT validation, throttling, and role-based permissions on every controller.
API responses default to least-privilege projections and strip unnecessary identifiers from notifications and exports.
Canadian infrastructure, backups, and network segmentation keep PHI contained.
Primary databases, object storage, and messaging queues run inside Canadian regions with redundant availability zones.
Encrypted backups execute every 24 hours with 35-day retention and quarterly restore drills.
Production networks isolate public endpoints from data stores; only hardened bastion hosts can reach database nodes.
Operational workflows ensure privacy-by-design at every step.
EnhancedConsentDialog enforces explicit consent for chat, file, and media actions. Consent records embed timestamps, staff IDs, and custom clinic text.
Export Center requires users to specify purpose (patient request, IPC inquiry, legal) before generating files. Every export is logged with checksum and download status.
Audit logs capture success/failure, payload hashes, and follow-up tasks so privacy officers can quickly respond to IPC reviews.
Documented breach management aligned to IPC expectations.
Alerting rules watch for abnormal login velocity, bulk downloads, or consent bypass attempts. Alerts fan out to on-call engineering and clinic privacy contacts.
If a breach occurs we isolate affected tenants, rotate credentials, and notify impacted clinics within 24 hours. Clinics receive templated guidance for notifying patients and regulators.
Lessons learned are recorded in the data-lifecycle service with remediation owners, deadlines, and links to updated playbooks.
Need a formal attestation or security questionnaire? Contact privacy@smilekonnect.ca with your clinic name, requested documents, and deadlines.