1. Keep the demonstration at process level
Use blank forms, fictional examples, role labels and approved aggregate operational information. Do not show or upload patient records, identifiable images, patient screens, case narratives or small groups that could identify an individual. Removing names alone does not establish anonymity. The public AI tool excludes personal data as well as patient data.
2. Record the jurisdiction and authority
Identify the deployment country and province/state, contracting parties, responsible organization, privacy owner, information categories, permitted purpose and authority. Establish the actual custodian/controller/service-provider roles. Vendor headquarters and an NDA do not, by themselves, establish the applicable law or authority to process health information.
Record approved tools and subprocessors, hosting and access countries, access controls, storage restrictions, retention/deletion dates and the incident contact. Unresolved requirements stay pending. A checklist does not certify compliance.
3. Agree call capture before it starts
Recording and transcription are off by default. Explain the narrow purpose, tool/provider, storage and access locations, who can access the result and how long it will be kept. Obtain participant permission and provide an unrecorded discussion with minimal written notes. Capture decisions, owners and next steps; an exploratory call does not establish scope acceptance.
Permission to record a participant does not authorize patient information processing. Raw recordings and transcripts do not go into the public AI tool or the public evidence library.
4. Keep client work private
The pilot workspace has no upload, autosave, recording or AI processing. Exported notes and JSON remain private working files under the preparer's control. Store them only in the agreed location and complete the agreed retention review. Publication of a client example requires separate permission; it never happens automatically.
The beta AI tool is different: it sends acknowledged public/synthetic/process-only inputs to Clinopilot's hosted service and Groq. Its feedback feature stores submitted ratings and text in Clinopilot's database. Review the privacy notice before using it.
5. Stop if the boundary changes
If patient information is needed, pause for a separate written scope, verified authority, deployment-specific privacy/legal review, appropriate data agreements and agreed security controls. If it appears unexpectedly, stop collection or screen sharing, restrict access to any copy and notify the responsible client privacy contact promptly. Assess notifications with that contact under the applicable law.
Official guidance used in this process
Reviewed 14 October 2026. These sources support process design; they are not an assessment of a particular client's legal position. Other jurisdictions and sector-specific obligations require their own review.
- Ontario IPC: PHIPA, agents, service providers and minimization and privacy handbook.
- Canada OPC: call recording purposes, consent and retention.
- Canada OPC: accountability for cross-border processing; this does not replace provincial or public-sector rules.
- India: phased DPDP Act commencement. The retrieved November 2025 instruments use phased dates; do not assume all substantive provisions were in force by October 2026. Check subsequent notifications and other applicable laws for the deployment.
Contact main@clinopilot.com before sending sensitive material.