How we handle your information

Kelligrews Dental Clinic, 615 Conception Bay Hwy, Conception Bay South, NL A1X 7L3. Last updated October 2026.

The short version

• What we collect: what you send us when you request an appointment, use your patient account, chat with Kelli or try the smile preview, and the network address it comes from.
• Why: to arrange and provide your dental care. We never use your information for advertising or marketing.
• Who helps us: service providers in Canada, the United States and Germany.
• How long: your dental record, including your requests, at least 10 years after the last entry; a chat with Kelli, 30 days after its last message.
• Your rights: to see, copy and correct your records, and to complain to the Information and Privacy Commissioner.

Who is responsible

Kelligrews Dental Clinic is the custodian of your personal health information under the Newfoundland and Labrador Personal Health Information Act (PHIA): we are responsible for that information and keep it confidential. What you tell us about your health and your care is personal health information, whether you tell us in person, by phone or through this site.

The federal Personal Information Protection and Electronic Documents Act (PIPEDA) covers the other personal information we handle, and information that leaves the province.

Your privacy contact

Our privacy contact answers your questions about how we handle your information, and your requests to see, copy or correct it:

Privacy Officer, Kelligrews Dental Clinic
615 Conception Bay Hwy, Conception Bay South, NL A1X 7L3
Phone 709-834-3633
Email reception@kelligrewsdental.ca

When you request an appointment

We collect what you type into the request form: your name, mobile phone and email, your date of birth if you give it (used only to match an existing file), whether you have visited us before, the service, dentist or hygienist and times you prefer, your notes, your pain level if you ask for an emergency visit, the name of the person you book for and how you are related, and any photos you attach. We use these to answer your request, confirm or propose a time, and prepare for your visit.

With each request, whether you send it with the form, from your patient account or through Kelli, we also record the network (IP) address it came from and how your browser describes itself (its “user agent”: the browser and device type). They are kept with the request’s entry in our record of changes (below) for 90 days, to protect the form and to look into misuse or a security problem. To keep the form from being flooded, it also counts requests per network address and per email and phone; those counts are stored only under a salted hash, a scrambled code made with a secret key, never as the address or your details themselves.

Booking for someone else

Please request an appointment for someone else only if they have agreed to it, or if you are their parent, guardian or legal representative. The form asks for their name and how you are related. If you book for them while signed in to your patient account, or later sign in with the email you booked with, they become part of your family in the account, which then shows their requests and appointments.

When we propose other times

When the time you asked for is not free, we email you up to three other times with a link that works without signing in, until you answer or the times close: 3 days after we send them, with one reminder after 2 days. The clinic can change these periods, and every email states its deadline.

Anyone who has the link can answer, so please don’t forward the email. If an answer is given through the link, we email you about it (the confirmation of a time picked, or a short note that the request was cancelled or a new time asked for), so you would see an answer you did not give.

The page the link opens shows the service, the time you asked for, the times we offer with the dentist or hygienist, our note and, if you asked to move an appointment, its day and time; once you ask for another time, it shows the request code. It never shows your name or contact details. We keep only a scrambled fingerprint (a hash) of the link’s code, never the code itself, and delete it 30 days after the times close; until then, after you pick a time, the link shows that booked time while it stays booked. When you answer through the link, we record, as with a request, the network address and browser description in our record of changes; an answer in your account is recorded with your account, as your other changes there are. If you pick a time, we tell the clinic so the team can book it.

How we use and share your information

We use your information to arrange and provide your care: to answer your requests, book and prepare for your visits, treat you, keep your dental record, bill for your care, and meet our legal and professional duties.

• We share what is needed with others who care for you, such as a specialist or a dental laboratory, unless you tell us not to.
• We send information to your insurer or benefits plan only when you ask us to bill them.
• We share information without your consent only where the law requires or allows it, for example to prevent a serious risk of harm to someone, or when a court order or another law requires it.
• We never use your information for advertising or marketing, and we ask you before using it for anything new.

You can withdraw your consent, or limit what we share and with whom, by telling our privacy contact. This does not undo what was shared before, and we still keep the records the law requires. It may limit the care we can give you; if so, we explain how.

If we ever use or share your information without your consent in a way this page does not describe, we tell you.

Where it is stored

Requests are stored with our database provider in Canada (Supabase, Canada Central region, in the Montreal area, Quebec), encrypted at rest. Only clinic staff whose role needs it can see them. The developer who looks after the site can also reach them, only to maintain it. The web server that runs this site is in Germany (Frankfurt): what you send passes through it on the way to the database, and it keeps none of it on disk. Its access log notes, for each page or file your browser asks for, the time, your network address, how your browser describes itself and the address asked for, without the security tokens that links carry; the oldest entries are deleted as the log fills up. When the site is unavailable for more than 15 seconds, or a page stops loading part-way, the web server’s error log also notes the full address asked for, with any security token it carries, your network address, how your browser describes itself and the address of the page you came from; its oldest entries are deleted as it fills up too.

Information that leaves Newfoundland and Labrador or Canada

These companies store or receive information from this site. All of them are outside Newfoundland and Labrador, and most are outside Canada:

• Supabase, our database provider — Canada (Montreal area, Quebec): your requests and their photos, the times we propose and a scrambled form of their link’s code, patient records and appointments, your patient account and its sessions, a new address’s pending sign-in link (the address and a scrambled form of the link’s code, for its hour, then until the next sign-in request or Continue), a note of each sign-in request from an existing account (the address and the time, for an hour, then until the next sign-in request or Continue), the record and text of the emails we send you, our record of changes, Kelli’s conversations and the salted-hash counts.
• Hostinger, which hosts our web server — Germany (Frankfurt): everything you send passes through it, on its way to our database or to the providers below, and it keeps the logs described above.
• OpenRouter — United States: what you type in the chat or the “in your own words” box, and the details of a request Kelli looks up for you, which it passes only to Anthropic, and your smile-preview photo, which it passes to Google.
• Anthropic — United States: that text and those details, so its Claude model can write Kelli’s replies and fill in the form for you.
• Google — United States: your smile-preview photo, so its image model can compose the preview.
• Resend — United States: the emails about your requests and appointments, your sign-in links, the clinic’s notices of each request, of each cancel from a patient account and of each answer to the times we propose (short notices with the request code and a dashboard link), the team’s email replies to a message you passed on through Kelli, and a short email to the clinic’s managers, with counts only and no names, when work waits unseen.
• Microsoft, which hosts the clinic’s email — North America (Canada or the United States): the clinic’s notices of each request, of each cancel from a patient account and of each answer to the times we propose, and your replies to the team’s emails about a message you passed on through Kelli, which reach the clinic’s Microsoft 365 mailbox like any email you send to reception@kelligrewsdental.ca.
• Cloudflare — United States: your network address and information about your browser and device, for the bot check.
• Google Maps — United States: your network address, how your browser describes itself and the page’s address, when the map on the home page loads.

While your information is in the United States or Germany, the courts, law enforcement and national-security authorities of those countries may be able to access it.

Our record of changes

Each time a request (with the times we propose and your answer to them), an appointment or a patient record is created, changed or deleted, our database writes an entry in its audit log: who made the change (the website, Kelli, a staff member or a patient in their account), when, and a copy of the record as it was before and after the change. It also notes who in the team opened and answered a message you sent us, and when, never the message itself. For a request sent from this site, the entry also holds the network address and browser description above for 90 days; then they are removed from it the next time anyone writes to Kelli or our staff sign in, usually within a day. Only the clinic’s administrators can read the audit log, and the developer who looks after the site, only to maintain it. We keep each entry for accountability for as long as we keep the record it describes; when we delete information that we may delete, we delete its matching entries too. The one exception: when a message passed on through Kelli, or an alert our dashboard shows the team, is deleted by itself at the end of its 90 days, its entries stay; they hold none of the message and none of your details, only what was done, by whom and when.

How we protect it

• Only clinic staff whose role needs it can see your information, and the developer who looks after the site, only to maintain it.
• Staff sign in with a password and a code from an authenticator app, and are signed out after 8 hours without activity.
• Patients sign in to their account with a link we email them, which works once. An account can see and change only its own and its family’s information: our database checks every request from an account against that account.
• Your information is encrypted at rest with our database provider, and on its way between your browser, our server and our providers.
• Our record of changes shows who changed what, and when.
• When we delete information, we delete it from our database and file storage together with its entries in our record of changes, except the ones described there that stay.

How long we keep it

• Your dental record: at least 10 years after the last entry, as Newfoundland and Labrador’s Dental Regulations require.
• What this site keeps about your requests — the requests and their photos, your appointments, the record of the emails we send you, and the entries about them in our record of changes — is part of your record, and is kept for the same period.
• The network address and browser description recorded with a request: 90 days; then they are removed from its entries in our record of changes the next time anyone writes to Kelli or our staff sign in, usually within a day.
• Your patient account: until you ask us to close it. Closing it deletes the account itself and its sessions; the requests, appointments and emails it shows are part of the dental record and are kept as above.
• Kelli’s conversations: 30 days after the last message; after that, a conversation is deleted the next time anyone writes to Kelli or our staff sign in, usually within a day.
• Messages passed on through Kelli: until the team closes them (by itself 14 days after the team’s last reply, when you send nothing more), then 90 days.
• The fingerprints of the links in our emails about proposed times: 30 days after the times were answered or closed.
• The smile preview: your photo and the preview are not stored.
• The web server’s logs: the oldest entries are deleted as the logs fill up.
• The salted-hash counts in our database: each one starts again when its period ends, from 10 minutes to a day; a count is deleted about two days after it began, once new counts arrive. The counts the server keeps only in its memory (Kelli’s usage, and how often signed-in sessions are renewed; a network address only as a salted hash) count only within their period, up to a day, and are all gone when the server restarts.

Your patient account

You can make an account with just your email address: it is made when you open the link we email you and press Continue, and until then we keep only the address you typed and a scrambled form of the link’s code, for the hour the link works, deleting them the next time anyone asks for a sign-in link or presses Continue on one after that. Each time you sign in, you ask for a link on the account’s sign-in page and we email it to you through Resend (United States); it works once, within 1 hour, and only the newest link works: for an hour after you ask, we also keep a note of that request (your address and the time), so that an older link cannot work again, deleting it the next time anyone asks for a sign-in link or presses Continue on one after that hour. Your account and your signed-in sessions are held by our database provider in Canada (Supabase), with your records. To keep the sign-in page and the account from being misused, we count sign-in requests per network address and per email, and changes per account; those counts are stored only under a salted hash.

Signing in sets cookies for this site only: Supabase’s session cookies, which keep you signed in, and kd_patient_seen, which notes when you last used your account on that device (see Cookies and browser storage). Scripts on the page cannot read them. After 30 days without using your account on a device, you are signed out there. Sign out ends your session on the device you are using; Sign out everywhere, on your profile page, signs you out on every phone and computer.

Your account shows the requests and appointments of you and your family (the service, the day and time, the dentist or hygienist, and where each one stands), copies of the emails we sent you about them (under Messages; for an email we sent before we offered patient accounts, only its subject), your family members’ names, dates of birth and how they are related to you, and your own name, date of birth, phone, email, email language and reminder setting. It never shows the clinic’s own notes about you or your visits. When you sign in, earlier requests sent with your email join your account if the name is yours, and the people you booked for become your family; requests under another name wait until you tell us whether they are yours.

Every change made in your account (your details and settings, your family, the earlier requests that join it or that you mark as not yours, the requests you send while signed in, a cancel and a request for another time) is written to our record of changes (above), with your account as the one who made it. Opening a message is recorded only as the time you read it.

To close your account, ask our privacy contact. We then delete the account itself and its sessions; the requests, appointments and emails it shows are part of the dental record and are kept as How long we keep it says.

The smile preview

If you try the smile preview, your photo is shrunk in your browser, passes through our web server, and is sent once through OpenRouter (United States) to Google’s image model, which composes the preview. We do not store the photo or the result, we do not log them, and nobody at the clinic sees them. The preview is an AI illustration only — it is not a diagnosis or advice, and real results vary. OpenRouter’s and Google’s processing is governed by their own terms. To count the three free previews a day, the site keeps a random identifier in your browser’s storage; it contains nothing about you, and clearing your browser data removes it. Our server counts previews per identifier and per network address, stored only as salted hashes.

We ask that only people 16 and older use the smile preview.

The chat assistant (Kelli)

Kelli is an AI assistant, not a person. It cannot see your dental file or give medical advice, and it does not decide anything about your care: clinic staff review every request and message it passes on. It can look up a request only when you give it the request’s code and the email or phone used for it, and then sees only that request’s service, status, times and dentist or hygienist. Please don’t share health details in the chat unless they are needed.

What you type in the chat, and the details of any request Kelli looks up for you, pass through our web server and OpenRouter (United States), which forwards them only to Anthropic’s own servers (United States), whose Claude model writes the replies. We send them with the setting that excludes providers that keep or collect them, and under Anthropic’s commercial terms conversations sent through its API are not used to train its models. The conversation, with those details, is stored with our database provider in Canada for 30 days after its last message, where clinic staff can read it to follow up; after that, it is deleted the next time anyone writes to Kelli or our staff sign in, usually within a day. If you ask Kelli to request an appointment, the details you agree to share become part of that request and are kept as described above. If you ask Kelli to pass a message to the team, your message, name and contact details are kept in our dashboard, in our database in Canada, until the team has dealt with it, and for 90 days after. Once the team has answered, the conversation closes by itself 14 days after the team’s last reply if you send nothing more. The conversation itself is still deleted 30 days after its last message. The team calls or emails you back during opening hours; it cannot reply inside the chat. To limit abuse, the conversation and its usage counts keep your network address only as a salted hash, a scrambled code made with a secret key, not as the address itself. Your browser keeps the conversation’s key and the messages shown in the panel until you close the tab.

The “in your own words” box on the request page sends what you write there once to Anthropic the same way, to fill in the form for you; it is not stored (we only count uses per network address, as a salted hash).

Emails and text messages

Emails about your request (received, confirmed or declined) are sent through Resend (United States), and so is the notice the clinic receives of each request, which gives only its request code and a link to it in our dashboard, with your email as the address a reply goes to; your details stay in our database, where the team reads them. A message you ask Kelli to pass on stays in our dashboard: the clinic’s mailbox gets only a short notice with a link to it, and the team’s reply, if it emails you, goes through Resend from the clinic’s address.

Your patient account’s emails go the same way: the sign-in link; the email that confirms you cancelled an appointment; and the notice the clinic receives when you cancel one, which gives only the request code and a link to it in our dashboard, with your email as the address a reply goes to, so the team can free the time. We keep the text of each email we send you about a request or an appointment with your records, with the request page’s address but not its security code, so that your account can show it under Messages; sign-in emails are not kept.

When we propose other times, the emails go the same way: the times we propose, the reminder, the email when they close, the email if we withdraw them, and the short note after an answer given through the link. The clinic’s notices of your answer carry only the request code and what happened, with a link to our dashboard: not your name, contact details, the times or your note. The copies we keep show your account’s request page in place of the link.

These are service emails about your requests and appointments. We send no promotional emails or texts without your consent. If we add appointment reminders, they will be sent the same way, and each will say who we are and how to stop them; if we add text messages, they will go through Twilio and only to people who opted in.

You can ask us to phone you instead of emailing you. Requests sent through this site need an email address and their emails go out automatically, so in that case please call us to request your appointment.

Bot protection

Cloudflare Turnstile (Cloudflare, United States) tells people from automated scripts in six places: the request form on the home page, as soon as the page loads; the request page, once you reach its last step (“About you”); the account sign-in page and our staff’s sign-in and forgotten-password pages, as soon as they load; and the chat panel, when you open it to start a new conversation. From that moment it runs in your browser, even if you send nothing, so Cloudflare receives your network address and information about your browser and device. When you send, our server also passes your network address to Cloudflare with the check. Turnstile may set a cookie on its own domain for that purpose.

The map

The map at the bottom of the home page comes from Google Maps (United States). When it loads, your browser connects to Google, which receives your network address, how your browser describes itself and the address of the page; Google may also set its own cookies. Google’s processing is governed by its own terms.

Cookies and browser storage

Here is everything this site keeps in your browser, and what Cloudflare and Google may keep there:

This site uses no analytics, advertising or tracking cookies. To remove what it stores, clear your browser data for this site.

Children and young people

If someone is under 16, we ask that a parent or guardian request the appointment for them. We ask that only people 16 and older use the chat and the smile preview.

Your rights: see, copy and correct

You can ask to see your records, to have a copy, and to have anything that is wrong corrected. Ask our privacy contact. We may ask you to confirm who you are, and to put your request in writing; we help you if you need it.

Someone you have authorized in writing, your legal representative, or the parent or guardian of a child who cannot yet understand these rights can also use them for you.

We answer a request to see or copy your records within 60 days (within 30 days for information that is not about your health), and a request for a correction within 30 days. If we need more time, we may extend either once, by up to 30 days, and we tell you why before the time is up.

Copies and corrections are free. We can also send your records to another dentist you choose, and we never hold records back because of an unpaid bill.

If we do not make a correction you ask for, we tell you why, and we attach your requested correction to your record.

If we refuse, or do not answer in time, you can complain to the Information and Privacy Commissioner (see Questions and complaints).

Asking us to delete information

The law gives you the right to see and correct your records, not to have them deleted. If you ask, we delete what the law does not require us to keep, such as a chat with Kelli, and we explain what we must keep and why.

If something goes wrong

If your information is lost, stolen or seen by someone who should not see it, we tell you as soon as we reasonably can, and we report serious cases to the Information and Privacy Commissioner.

Questions and complaints

Please start with our privacy contact, so we can try to put things right. You can also complain to the Office of the Information and Privacy Commissioner of Newfoundland and Labrador:

Office of the Information and Privacy Commissioner
P.O. Box 13004, Station “A”, St. John’s, NL A1B 3V8
Phone (709) 729-6309, toll-free in Newfoundland and Labrador 1-877-729-6309
Email commissioner@oipc.nl.ca
www.oipc.nl.ca
Forms www.oipc.nl.ca/forms/phia/public-forms

To complain about our answer to a request to see, copy or correct your records, or about a request we did not answer in time, write to the Commissioner within 60 days (or later, if the Commissioner allows).

For information that is not about your health, or information handled outside the province, you can also contact the Office of the Privacy Commissioner of Canada at www.priv.gc.ca.

Changes to this page

This page was last updated in October 2026. When we change it, we post the new version here and update the date.

If you would like this notice in another format, such as large print or read aloud, please ask our privacy contact.