Privacy Statement

Century Stone Dental (the "Practice", "we", "our") is a dental practice whose health information custodian is Dr. Christopher Sims (the "Custodian"). This Privacy Statement explains how the Practice collects, uses, discloses, and safeguards patients' personal health information.

Personal health information ("PHI") is defined under Ontario's Personal Health Information Protection Act, 2004 ("PHIPA"). It includes identifying information, oral or recorded, about an individual's physical or mental health, health care history, or treatment. Information identifying you as our patient is also PHI.

CONSENT

We collect, use, and disclose your (or your child’s) PHI only with express or implied consent, unless otherwise required or permitted by law. Contact us at any time to withhold or withdraw your consent.

ACCOUNTABILITY

Dr. Sims is the health information custodian of your PHI and is accountable for how the Practice and its staff handle PHI. We protect PHI under professional standards and applicable privacy laws, and do not sell, rent, or disclose your information to third parties without your consent except as described below or as permitted by law.

COLLECTION AND USE OF PERSONAL HEALTH INFORMATION

We may collect personal information and PHI directly from you or an authorized representative, including your name, date of birth, contact information, health and family health history, visit and treatment records, and initial service inquiries.

We may collect your PHI from other sources, including other health care providers, laboratories, insurers, legal representatives, or optional surveys, with your consent or as otherwise permitted by law.

We collect only the information reasonably necessary to provide our services. Information is stored in your patient record and may be accessed by those involved in your care or administration.

ELECTRONIC PATIENT RECORD

The laws and standards that govern our practice require that we keep patient records. These records include the basic information needed to identify and contact the patient, plus a history of visits, calls, concerns raised, assessments, diagnoses, treatment plans, progress notes, services provided, and any services that were started but not finished. It also includes important paperwork connected to the patient’s care, such as reports, letters, consent records, and referrals to other health professionals.

We maintain electronic patient records using Curve Dental, a cloud-based dental practice management platform operated by CD Newco, LLC. Curve Dental has confirmed to us that patient records are stored in an Amazon Web Services data centre located in the United States. While your PHI is stored there, it is subject to the laws of the United States, which may permit access by United States authorities in circumstances that differ from Canadian law. We have accepted this arrangement with contractual privacy and security safeguards in place, and we disclose it here so that you are informed. Additional information about Curve Dental's privacy and data handling practices is available at:

• https://www.curvedental.com/canadian-application-terms-service; and
• https://www.curvedental.com/canadian-privacy-addendum.

We maintain control of and responsibility for PHI collected and used through this system. The information remains subject to confidentiality protections and applicable privacy laws at all times. We require all service providers that handle PHI on our behalf to protect it through contractual privacy and security safeguards designed to meet PHIPA requirements.

EXCEPTIONS TO CONFIDENTIALITY AND PRIVILEGE

Although we are committed to safeguarding your PHI, we may be required or permitted to disclose information if ordered to do so by a court or where we are permitted or required to do so by law.

SAFEGUARDS

We use reasonable administrative, technical, and physical safeguards to protect personal information from theft, loss, improper disposal, and unauthorized access, use, copying, modification, or disclosure. Access to PHI is limited to employees and service providers who require the information for their duties and are bound by confidentiality and security agreements.

Patient records are maintained primarily in secure electronic systems protected by encryption and access controls, with access limited to authorized personnel. Any paper records are stored securely and are disposed of in a secure manner once incorporated into the electronic record.

RETENTION

We retain PHI only as long as is necessary to carry out the purposes discussed in this Privacy Statement or to meet our legal, medico-legal or business requirements. PHI that forms part of your patient record is retained for at least ten (10) years from the date of the last entry in the record or, for a patient who was under 18 years of age at the date of the last entry, for at least ten (10) years after the patient's eighteenth birthday, in accordance with the record-keeping requirements of the Royal College of Dental Surgeons of Ontario.

We may also create and retain de-identified or anonymized PHI for internal use to improve the provision of services and business operations.

DISPOSAL

When PHI is disposed of, we take reasonable steps to ensure its secure and permanent destruction, and we require any third party retained to dispose of PHI on our behalf to do so securely.

ACCESS AND CORRECTION

Subject to limited legal exceptions, you may access your PHI and ask us to correct inaccurate or incomplete information. We may correct the record by updating the information or adding an explanation of your concern.

You may make a request to access or correct your patient records by using the contact information set out at the end of this document. We may ask you questions to verify your identity or for supporting documentation if you ask us to correct information in your records.

PRIVACY BREACH MANAGEMENT

If PHI is stolen, lost, or accessed, used, disclosed, copied, or modified without authorization, we will promptly identify, contain, and manage the breach, involving appropriate staff, experts, or legal counsel. We will investigate, contain, and correct any breach, reduce the risk of recurrence, and notify affected patients at the first reasonable opportunity. We will also advise patients of their right to contact the Information and Privacy Commissioner of Ontario.

INFORMATION ABOUT OUR WEBSITE

Our website, centurystonedental.com, includes contact and appointment request forms for existing and prospective patients. We treat form submissions as PHI and handle them under applicable privacy laws, including PHIPA. Submissions are processed and stored on a secure server in Canada that is under our ownership and access controls. When a form is submitted, our team receives a notification containing no patient details, and the information is then accessed through our private, access-controlled system. Form submissions are deleted within 90 days after the inquiry is resolved, except where the information is added to the patient record.

Third-party website analytics are used on our website to help us understand which areas of the website are visited and to improve the user experience. This may include cookies and other tracking technologies but does not include collecting PHI.

CONTACT US

If you have any questions, concerns, or comments about this Privacy Statement or how we or our service providers handle your personal information, or wish to request access to or correction of your personal information in our records, please contact our Privacy Officer at (905) 545-4833, info@centurystonedental.com, or 684 Main Street East, Hamilton, ON L8M 1K5.

If we are unable to address your privacy concerns, you wish to make a complaint, or if you require further information regarding privacy in Ontario, you may also contact the Information and Privacy Commissioner of Ontario at 1-800-387-0073 or info@ipc.on.ca.

Century Stone Dental

Last Reviewed: October 17, 2026