Last updated 15 August 2026.
This policy explains how PaidSmile handles your personal and health information when you use our service to find and book a dentist in Ontario.
1. Who we are
1001711679 Ontario Inc., operating as PaidSmile, an Ontario corporation with its registered office in Ancaster, Ontario, operates this service. Business name registered under the Business Names Act (Ontario).
PaidSmile (1001711679 Ontario Inc.) helps you find a dental practice, book an appointment, and receive a reward for attending. We are not a dental practice. We do not provide dental care, advice, or diagnosis, and we do not employ or supervise the dentists listed on our site.
This policy covers our website, our booking service, and our reward program. It does not cover what a dental practice does with your information once you become their patient — that is governed by the practice's own obligations as a health information custodian.
2. Our role under PHIPA
Ontario's Personal Health Information Protection Act, 2004 ("PHIPA") governs personal health information in this province. PaidSmile operates as a service provider and information manager to the dental practices in our network. We are not a health information custodian. Practices remain responsible for your dental record; we handle the information needed to introduce you to them and to administer your reward.
The federal Personal Information Protection and Electronic Documents Act ("PIPEDA") also applies to our handling of your information. We comply with both.
3. What we collect
We collect the minimum we need. We ask for the first three characters of your postal code rather than your home address, because that is enough to find practices near you.
Information you give us: your name, email, and phone number if you provide one; your postal code; whether you have private insurance, CDCP, a provincial program, or no coverage; what you told us you need to see a dentist about and when you are available; and receipts you upload to claim a reward.
Information we collect automatically: IP address, browser and device type, pages viewed, and referring links.
Information from practices: whether you attended an appointment booked through us.
Some of this — your dental needs, your coverage, and the fact you attended a dental appointment — is personal health information under PHIPA and is treated accordingly.
4. Why we collect it
- To match you with practices near you that are accepting new patients.
- To book and confirm appointments.
- To administer the reward, including confirming your visit and issuing payment.
- To prevent fraud, including detecting duplicate or altered receipt claims.
- To bill participating practices for patients they actually saw.
- To improve the service and meet our legal obligations.
Automated matching
Which practices you see is decided automatically, based on your postal code, the practice's availability, whether it is accepting new patients, and what you told us you need. No practice can pay to appear higher. If you would rather see a wider list, or want a person to look at your case, ask us and we will do it.
Receipts you upload
Receipt images are used only to verify a visit happened, and are checked against the appointment we already hold. We do not use them for any other purpose and do not share them with the practice or anyone else, except where legally compelled.
5. Your consent
We ask for your express consent before sharing your details with a dental practice. You give it by ticking the consent box on our booking form. The box names what is shared — your contact details and the dental needs and coverage you described — and states that some of it is health information.
You can withdraw consent at any time by contacting us. Withdrawing stops future matching and booking. We cannot undo a disclosure already made. Withdrawing consent does not forfeit a reward you have already earned for a completed and verified visit.
6. Who we share it with
- The dental practice you choose — your name, contact details, what you need, and your availability, so they can confirm and prepare for your appointment.
- Our reward processor — your name and email, to issue your prepaid card.
- Our hosting and infrastructure providers — to run the service.
- Law enforcement or regulators — only what is legally required.
- An acquirer — if PaidSmile is sold or merged, subject to this policy continuing to apply.
We require every service provider handling your information to protect it to a standard at least equal to this policy and to use it only for the purpose we engaged them for.
7. What we never do
- We never sell your personal information. Not your contact details, not your health information, not in aggregate, not to lead generators.
- We never let a practice pay for better placement.
- We never share your health information for advertising.
- We never ask a practice to change your care or your price because of your reward.
8. Where it is stored
Our platform and service providers store information on servers in Canada and the United States. Information stored outside Canada may be accessible to foreign courts and authorities under the laws of that country. By using PaidSmile you acknowledge this transfer.
9. How long we keep it
- Account and contact details — while your account is active, then 24 months.
- Booking and attendance records — 7 years.
- Uploaded receipts — 24 months after the reward is paid.
- Reward payment records — 7 years.
- Website analytics — 26 months.
10. Your rights
- Access. Ask what we hold about you and get a copy. We respond within 30 days.
- Correction. If something is wrong we will fix it, or note your disagreement on the record.
- Withdraw consent. At any time, with the limits in section 5.
- Deletion. We may need to keep some records for legal and accounting obligations — we will tell you what and why.
- Complain. To us first, and to the Information and Privacy Commissioner of Ontario if we do not resolve it.
For information held by a dental practice about your care, contact that practice — they are the custodian of your dental record, not us.
11. How we protect it
Our platform runs on Shopify, which encrypts information in transit and at rest. Access to your information is limited to the people who need it to run the service. No system is perfectly secure and we do not claim otherwise.
If your personal health information is stolen, lost, or used or disclosed without authority, we will notify you at the first reasonable opportunity and tell you that you may complain to the Information and Privacy Commissioner of Ontario. Where a breach creates a real risk of significant harm we will additionally report it as PIPEDA requires. We aim to notify within 72 hours of becoming aware.
12. Children
PaidSmile is intended for adults. A parent or guardian may book on behalf of a child and is responsible for the information they provide.
13. Cookies and analytics
We use cookies to keep you signed in, remember your preferences, and measure how the site is used. You can block cookies in your browser, though parts of the service may stop working. We do not place advertising cookies on pages where you provide health information.
14. Changes
If we change this policy we will update the date at the top. If a change materially affects how we handle your information, we will tell you before it takes effect.
15. Contact and complaints
Our Privacy Officer is responsible for our compliance with this policy and will answer access requests and complaints.
Privacy Officer, PaidSmile
privacy@paidsmile.ca
If you are not satisfied with our response, you may complain to:
Information and Privacy Commissioner of Ontario
2 Bloor Street East, Suite 1400, Toronto ON M4W 1A8
1-800-387-0073 · ipc.on.ca