Identify information, access and responsibilities
List the types of information processed and the people or providers who may access them. Review permissions, staff access reviews, account recovery and how support requests are handled. Ask which party is responsible for each control and incident response step.
Request useful evidence
Discuss audit history, encryption, backup restoration, vulnerability management and incident notification. Check the scope and date of any assessment or certification offered. Do not assume that an infrastructure provider’s certification automatically covers every application or operating process.
Keep the public website separate from clinical care
Flor’s marketing forms and public assistant accept product questions and business contact details. They are not patient-record systems. Clinical privacy, security, contracts and operational readiness remain release-review items. No HIPAA, PIPEDA or provincial compliance certification is claimed here.
Privacy questions for Canadian clinics
Ask which privacy laws and professional obligations apply to your clinic, where information is processed, who can access it, and how records can be exported and recovered. Federal and provincial requirements can overlap; evaluate your specific circumstances.
Read the guidance from Office of the Privacy Commissioner of Canada ↗
Ask for service-specific evidence
Start with the actual information your practice would process and identify each service that handles it. Ask who can access the records, how access is removed, what recovery has been tested and which agreement assigns responsibilities. Keep evidence tied to the named product and environment. General statements about encryption or a cloud provider are not a complete answer to your clinic’s operational and legal questions.
| Check in the demonstration | Evidence to record |
|---|---|
| Product and service scope clearly named | Describe the observed result using fictional data. |
| Access and recovery evidence reviewed | Record the role, exception and any manual work required. |
| Contract responsibilities matched to the workflow | Agree on pass, follow-up or unavailable before rollout. |
Continue with patient portal software for connected care and clinical notes and documentation workflows to test the connected steps. The interactive Flor demo provides fictional examples for the discussion.
Questions for a Canadian clinic
Build the evaluation around your province, disciplines and funding arrangements. Ask for quotes in CAD and inspect the receipt fields your clinic requires. Where guardians or third-party recipients are involved, separate the client record, relationship and access decision. Confirm any payer connection individually.
Privacy obligations depend on the circumstances; federal and provincial rules can interact. The Office of the Privacy Commissioner of Canada explains the provincial context. Use that guidance to frame a service-specific review, without assuming that a Canadian domain establishes data residency.
A few common questions
Is Flor HIPAA compliant?
Flor does not make a general HIPAA compliance claim on this site. Where HIPAA applies, review the exact services, business associate agreements and safeguards with the team.
Does Flor guarantee Canadian data residency?
No patient-data residency promise is made here. Hosting and processing locations must be confirmed for the actual clinical service and contract.
Prepared for clinic owners in Canada. Updated . These guides support product evaluation and do not replace professional or legal advice.