Privacy Policy
How General Technologies collects, uses, discloses and retains information when you use the ChartAI app, our website and related services.
This Privacy Policy explains how GENERAL TECHNOLOGIES ("we", "us" or "our") collects, uses, discloses, and retains information that you provide or which we otherwise collect when you access and use our website, the ChartAI app, and other services (collectively, the "Services"). The terms of this Privacy Policy are incorporated into our Terms of Service. To the extent of any conflict between this Privacy Policy and the Terms of Service, the Terms of Service will apply; however, if the parties have entered into a Business Associate Agreement (BAA) and/or Data Processing Agreement (DPA), the BAA/DPA will govern regarding PHI, special category data, security safeguards, breach notification, retention, or permitted uses and disclosures.
BY ACCESSING AND USING THE SERVICES, YOU AGREE TO BE BOUND BY THIS PRIVACY POLICY. IF YOU DO NOT AGREE, PLEASE DO NOT ACCESS AND USE THE SERVICES.
Contacting us
If you have questions or complaints about how we handle your information, or wish to:
- ask questions
- update or delete your account
- change user preferences
- register a concern
- opt out of marketing
- exercise any of your data rights
You may contact us at privacy@generaltech.io. We will respond to all inquiries within 30 days. You may be asked to verify your identity.
About us
We provide the ChartAI Platform to licensed dental professionals to assist with ambient clinical documentation and related services. The Services support charting, patient communication, AI-powered automation, and enhanced clinical workflows.
Definitions
- "you" refers to the user of our Platform and Services.
- "your information" includes your personal, professional, or health information.
- "privacy laws" includes PIPEDA and PIPA (British Columbia) applicable health information laws, and any other jurisdictional laws that apply to us.
Types of information we collect
We collect the following types of data:
| Category | Details |
|---|---|
| General Personal Information | Name, contact details, age/date of birth, gender, education, professional qualifications, etc. |
| Payment and Claim Information | Credit card details, bank account, and insurance/claims data. |
| Sensitive Health Information | Clinical notes, health history, test results, diagnoses, medications. |
| Device and Log Information | Device ID, type, IP address, geolocation, usage stats, cookies. |
| Customer Feedback or Surveys | Information submitted voluntarily for product or service improvement. |
| De-Identified Data | Used for analytics, performance improvements and AI training purposes as set out in this agreement. |
| Recruitment Data | If you apply for a job with us, we collect standard employment and reference data. |
Patient information
Our application only collects personal information that is either:
- directly entered by authorised healthcare practitioners, or
- captured during their use of the application.
The collection of this data, including device metadata, is essential for improving the user experience, optimising performance, and enforcing strong security protocols. For patient/clinical information processed through the Services, the healthcare practitioner/clinic generally acts as the data controller (or equivalent under applicable law), and General Technologies acts as a processor/service provider processing such information on the controller's documented instructions. Where GDPR applies, processing of data concerning health requires an applicable Article 9 condition in addition to an Article 6 lawful basis. Where Canadian private-sector laws apply (including PIPEDA and provincial regimes), the clinic/practitioner is responsible for obtaining any required patient consent and providing appropriate notices for collection, use, and disclosure of sensitive information.
As part of its core functionality, the application can generate summaries of clinical discussions. This means the entire conversation between a healthcare provider and their patient may be recorded, including sensitive personal health information. Audio recordings are used to generate a text-based transcript (the "Transcript") and to support additional clinical workflows that aid documentation and care delivery.
Transcripts
General Technologies uses advanced machine learning and artificial intelligence technologies to analyse Transcripts in order to deliver core functionality and continuously improve our services. Processing these Transcripts is essential: without it, the application cannot function as intended.
We do not disclose Transcripts or audio recordings to third parties except (a) to contracted service providers operating the Services on our behalf under confidentiality and security obligations and only to the minimum extent necessary, (b) where you authorize disclosure (including via integrations), or (c) as required by law.
We rely on healthcare practitioners to obtain any necessary patient consent prior to using the application. If a practitioner does not have the patient's consent to collect and use their personal information in this way, the application must not be used with that patient.
Voice data
By accessing or using the Voice Service, you agree to the collection and processing of voice data. This "Voice Data" may include information such as audio recordings from the microphone during your use of the Service. When you use our voice services, we collect and use your voice input and other information to respond to your requests, provide the requested Service to you, and improve our services. We obtain your express consent to collect and process voice data and reaffirm consent periodically, especially when dealing with sensitive information. The collection and processing of voice data comply with all applicable privacy laws in British Columbia, including requirements for consent, purpose limitation, and data security.
Log data
We may also collect information that your browser or mobile device sends whenever you visit our Service ("Log Data"). This Log Data may include information such as your computer's Internet Protocol ("IP") address, browser type, browser version, the pages of our Service that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers, and other statistics.
How we collect information
We collect information:
- directly from you during registration or usage of the Platform
- through communications (email, chat, calls)
- through cookies and analytics
- from your employer (for employees)
- from public and third-party sources (for verification or recruitment)
- via authorized integrations or services
How we use this information
| Purpose | Details |
|---|---|
| Access | Enable use of our Services. |
| Service Performance | Improve user experience, AI features, analytics. |
| Healthcare Services | Facilitate clinical services through the ChartAI Platform. |
| Support | Notify you of updates, bugs, changes, and respond to queries. |
| Marketing | Share offers and updates only if consented. No health info used for marketing. |
| Legal Compliance | Respond to requests from regulators or law enforcement. |
| Employment | Evaluate job applications. |
AI training and development
We may use de-identified or pseudonymized information, including clinical and operational data, to improve and train our artificial intelligence (AI) models, but only where permitted by law and with the necessary consent.
When we process personal information for the purpose of AI model development:
- We apply data minimization and pseudonymization techniques to reduce re-identification risk.
- We do not use identifiable patient data for model training unless we have obtained explicit informed consent from the individual or the healthcare provider authorised to provide it on their behalf.
- Where applicable, we ensure training datasets are processed in accordance with provincial and federal privacy legislation, including PIPEDA, PIPA (BC), and Quebec's Private Sector Act.
- We conduct privacy impact assessments and employ technical safeguards to prevent inference or membership attacks and to ensure data is not regurgitated in outputs.
If personal information is used in a manner that could reasonably be expected to impact individual privacy, we will provide clear notice, justification, and opt-out mechanisms where possible.
For clarity, de-identification and anonymization reduce privacy risk, but information will be treated as outside the scope of GDPR only where it is anonymized such that individuals are not identifiable (consistent with Recital 26); pseudonymized information remains personal information under applicable privacy laws and is handled accordingly.
Marketing and opt-out
We may send emails or promotional materials related to our services. You can:
- unsubscribe via any message you receive, or
- email privacy@generaltech.io
We do not use health information for marketing. We do not share information with third parties for their own marketing purposes without your explicit consent.
Data storage
We store personal information of Canadian users in Canada.
We recognise the importance of data sovereignty and are committed to safeguarding personal information. Accordingly, personal information of users located in Canada is stored on servers within Canada. Where Québec law applies, before communicating personal information outside Québec, we conduct a privacy impact assessment and implement appropriate contractual and technical safeguards to ensure the information would receive protection equivalent to that provided under Québec law.
For users located outside of Canada, we store and process personal information in jurisdictions that are appropriate to the delivery of our Services and in accordance with the legal requirements of the applicable region. Where personal information is transferred or processed outside a user's country of residence, we ensure that appropriate safeguards, including data processing agreements and technical protections, are in place to maintain the confidentiality and integrity of that information in compliance with applicable privacy laws.
Information sharing
We may share data with:
- our staff and affiliates
- third-party service providers under contract
- regulators and legal authorities
- parties to a corporate transaction
- anyone you authorize us to share with (e.g., via integrations)
We ensure third parties follow the same or stronger privacy practices via contractual terms.
How and why we share your information with trusted third parties
To operate our website and application effectively, we engage trusted third-party providers to support essential functions such as:
- Fraud detection and prevention
- Payment processing and transaction notifications
- Delivering requested services or information
- Maintaining and improving the functionality of our website and application
- Providing customer support
In the event of a corporate transaction such as a merger, acquisition, reorganisation, or sale of our business, we may transfer personal information as part of that process. In such cases, we will ensure that any transferred data remains protected in a manner consistent with this Privacy Policy.
Except as described above, General Technologies will not use or share any personal information collected from users or patients without proper authorisation.
How we safeguard your information
| Measure | Description |
|---|---|
| Encryption | Bank-grade encryption at rest and in transit. |
| Access Controls | Role-based permissions for all staff and vendors. |
| Staff Training | Continuous privacy and security training. |
| De-identification | Sensitive data is pseudonymized or aggregated. Where appropriate, data is de-identified/anonymized; where anonymization is not feasible, data is pseudonymized and/or aggregated with additional safeguards. |
| Retention | We retain data only as long as necessary or legally required. |
Confidentiality incidents / privacy breaches
We maintain a record (register) of confidentiality incidents/privacy breaches as required by applicable law. Where a breach of security safeguards involving personal information creates a real risk of significant harm, we will notify affected individuals and report to the Office of the Privacy Commissioner of Canada as required under PIPEDA, and we will keep breach records as required.
Where Québec's private-sector law (as amended by Law 25) applies, if a confidentiality incident presents a risk of serious injury, we will notify the Commission d'accès à l'information du Québec (CAI) and affected individuals as required, and maintain the incident register.
Your rights
You have the right to:
- access your information
- correct inaccurate data
- request deletion or anonymization
- request portability in a machine-readable format
- object or withdraw consent (subject to legal exceptions)
- lodge a complaint with the appropriate regulator
Please send your requests to privacy@generaltech.io.
Employees
We collect the following from employees or applicants:
| Category | Example |
|---|---|
| Personal | Name, contact, image |
| Educational | Institutions, certifications, references |
| Sensitive | Health conditions, diversity data (where required or permitted) |
| Financial | Bank info, tax ID, compensation history |
| Work-Related | Work history, professional memberships, performance data |
Children's privacy
Our Service does not address anyone under the age of 13 ("Children"). We do not knowingly collect personally identifiable information from children under 13. If you are a parent or guardian and you are aware that your Children have provided us with Personal Information, please contact us. If we become aware that we have collected Personal Information from children under age 13 without verification of parental consent, we take steps to remove that information from our servers.
Third party sites
Our Services may contain links to external websites. We are not responsible for the privacy practices of those sites. Review their policies independently.
Links to other sites
Our Service may contain links to other sites not operated by us. If you click on a third-party link, you will be directed to that third-party's site. We strongly advise you to review the Privacy Policy of every site you visit. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.
Privacy Officer
We have appointed a Privacy Officer who is responsible for overseeing our compliance with applicable privacy laws, including the Personal Information Protection Act (PIPA) of British Columbia. If you have any questions, concerns, or requests regarding your Personal Information or our privacy practices, please contact our Privacy Officer at privacy@generaltech.io.
General
We may modify this Privacy Policy at any time, so please review it periodically. By continuing to use the Services after any modification, you consent to be bound by the modified Privacy Policy. This Privacy Policy is governed by the laws of British Columbia. If you have any questions about this Privacy Policy, please contact us at: privacy@generaltech.io.
Questions about this document? Email privacy@generaltech.io. For our security posture, certifications and subprocessor list, see the ChartAI Trust Center.
Read the Terms of Service Agreement →