PIPEDA and Quebec Law 25
Lab software for Canadian labs, built to follow PIPEDA.
Lab Desk is built to follow PIPEDA's privacy principles, and supports Quebec labs with Law 25 requirements such as privacy impact assessments.
Hosting
Your data is stored in the US, and we tell you so.
Canadian labs use app.labdesk.app, with data hosted in secure US data centers. PIPEDA allows this with clear notice and contract safeguards.
Our Data Processing Agreement sets out how your data is protected, who our sub-processors are, and what happens if there is an incident. You can pass that notice on to your patients.
- Encrypted in transit and at rest
- Backups stay in the US with the live data
- Sub-processors listed in the DPA
PIPEDA
Privacy principles, built into daily work.
Consent.
Each patient's consent to email and link delivery is recorded on their record.
Access and correction.
Export a patient's record, fix mistakes and keep a log of every change.
Limited use.
Patient data is used to run your lab's service only, and never used to train AI.
Safeguards.
Encryption, role-based access, MFA, automatic logoff and an audit log.
Breach records.
Every breach of security safeguards is recorded and kept for 24 months.
Accountability.
A DPA that names our safeguards, sub-processors and incident process.
Your lab's reporting duty
When a breach creates a real risk of significant harm, your lab reports it to the Privacy Commissioner of Canada and notifies patients. We notify you without delay and give you the details you need.
Quebec Law 25
Ready for Quebec's stricter rules.
Quebec labs have to assess the risks before their data is stored outside Quebec. Lab Desk gives you a ready pack for that assessment and builds privacy by default into result sharing.
- Privacy impact assessment (PIA) pack: data location, safeguards, sub-processors and contracts
- Confidentiality incident register kept by Lab Desk
- Result links expire and ask for an identity check by default
- Staff approve every AI flag and summary, so no decision is fully automated
French language for Quebec labs
Quebec's Charter of the French language may require French contracts and a French product. Lab Desk is being built so it can be translated. Talk to us about your timeline before you sign up.
Ontario
A note for Ontario labs.
Under Ontario's PHIPA, a provider serving several health information custodians can be a health information network provider, with extra duties such as a plain-language service description and a threat and risk assessment. We are confirming how this applies with counsel. If you are an Ontario lab, talk to us and we will share what we have.
Frequently asked questions
Is Lab Desk PIPEDA compliant?
Lab Desk is built to follow PIPEDA's privacy principles: consent, limited use, safeguards, access and correction, and breach records.
Where is Canadian lab data stored?
In secure US data centers, on app.labdesk.app. We tell you this up front, and our DPA sets out the safeguards.
How long do you keep breach records?
We keep a record of every breach of security safeguards for 24 months, as PIPEDA requires.
We are a Quebec lab. What do you provide?
A privacy impact assessment pack covering data location, safeguards, sub-processors and contracts, plus a confidentiality incident register and privacy by default on result links.
Is Lab Desk available in French?
Not yet. The product is being built for translation. Talk to us about your needs and timeline.
Not legal advice
These pages describe the safeguards Lab Desk provides. They are not legal advice. Please confirm your own obligations with your legal or compliance adviser.
A Canadian lab with privacy questions?
Join early access, or talk to us about our DPA and the Quebec PIA pack.