Social Response Privacy Policy — Virus Santé Communication

1. Who We Are

Virus Sante Communication (« Virus Sante », « we », « our ») is a healthcare marketing agency based in Montreal, Quebec, Canada. We provide social media management services to dental clinics, medical practices, and healthcare professionals in Quebec.

Contact Information:

Legal name: Virus Santé Communication inc.
Address: 3684 rue Hochelaga, Montréal (Québec) H1W 1J3, Canada
Email: jeff@viruscomm.ca
Website: https://virussantecommunication.ca

Privacy Officer (Quebec Law 25):
Jeff Proteau, jeff@viruscomm.ca

2. Scope

This policy applies to personal data processing performed by Virus Sante in the context of:

Managing the Facebook Pages and Instagram Business accounts of our healthcare clients
Reading and responding to comments, reviews, and direct messages received on those pages/accounts
Operating our internal social response dashboard

It does not apply to Meta’s own practices (Facebook, Instagram, Messenger) — Meta has its own separate privacy policy.

3. Data We Collect

3.1 From Meta Platforms (Facebook, Instagram, Messenger)

When you publicly interact with a Facebook Page or Instagram Business account managed by Virus Sante, or when you send a direct message to those pages/accounts, we receive and process:

Your public name as displayed on Facebook or Instagram
Your public profile picture
The text content of your comment, review, or message
The timestamp of your interaction
The numerical identifier of your account as provided by Meta
The star rating (1 to 5) if you leave a review on a Facebook Page
Visibility metadata (public comment vs private message)

We do not collect:

Your private email address
Your phone number
Your friend or contact list
Your browsing history outside the relevant page
Information about other Meta accounts unrelated to the interaction

3.2 From Our Internal Team

For authentication to our internal dashboard, we use Google Workspace authentication (viruscomm.ca). We collect:

Professional email address of the Virus Sante team member
User name
Google Workspace identifier (OIDC sub)

4. How We Use Your Data

Your data is used exclusively to:

Allow our team to respond to you on behalf of the relevant clinic client, within the mandate that client has entrusted to Virus Sante
Classify your interaction by category (thank-you, question, complaint, etc.) to route it to the appropriate team member or to an appropriate automated response
Generate reply suggestions via an AI assistant (Claude, provided by Anthropic) — these suggestions are systematically reviewed by a human before publication, except for trivial cases described in section 7
Maintain a history of past replies to ensure tone consistency and quality
Document audit trail of our actions for legal traceability

We never use your data for:

Advertising targeting
Resale to third parties
Building personal profiles beyond what is necessary to respond
Analysis outside the direct context of your interaction

5. Legal Basis for Processing (Quebec Law 25)

Our processing of your personal data is based on:

Legitimate interest of the clinic client (our principal) in professionally responding to its social interactions
Implicit consent that you give by publishing a comment, review, or message on a public page managed by that clinic
Performance of the service contract between Virus Sante and the clinic client

6. Sharing of Your Data

Your data is accessible to:

Authorized internal team of Virus Sante (Jeff Proteau, Hadjer, Julie, and other designated responders) — subject to contractual confidentiality
The relevant clinic client when we forward your interaction for their decision (option to « transmit to client » available for sensitive reviews)
Anthropic (Claude API) within the limited scope of classification and reply suggestion — Anthropic acts as a sub-processor and does not retain data beyond what is strictly necessary for processing (see Anthropic’s Privacy Policy)

We never share your data with:

Third-party advertisers
Data brokers
Other Virus Sante clients besides the one directly involved

7. Automated Replies (AI’s Role)

A minority of trivial cases may receive an automatically published reply without immediate human review. These cases are strictly limited to:

Thank-you replies to generic 5-star reviews (with no specific content)
Acknowledgments to messages of the form « thank you », « great job », etc.

All other cases — questions, complaints, specific requests, 1-4 star reviews, medical or financial content — are subject to mandatory human review before any reply is sent. A sample of automated replies is reviewed retrospectively for quality control.

8. Data Retention

Data type	Retention period
Direct messages (Messenger, Instagram DM)	30 days after last interaction
Public comments and reviews	1 year after last interaction
Audit log (who replied, when, what)	7 years (legal proof)
System backups	90 days, then permanent deletion

Beyond these periods, your data is irreversibly deleted from our systems (but may remain on Facebook/Instagram, which have their own independent retention policies).

9. Security

We protect your data through:

Encryption at rest (FileVault on our internal servers, AES-256 database encryption)
Encryption in transit (mandatory HTTPS/TLS 1.3)
Role-based access control (only authorized Virus Sante team members can access)
Strong authentication via Google Workspace (mandatory 2FA)
Comprehensive logging of all actions (who, when, what)
Hosting in Canada (secure Mac mini at our Montreal headquarters)
No access from unauthorized personal devices

10. Your Rights

In accordance with Quebec’s Law 25 and international best practices, you have the right to:

Access the data we hold about you
Correct inaccurate data
Request deletion of your data (see section 11 and our data deletion request page)
Object to the processing of your data on legitimate grounds
Withdraw your consent at any time (without retroactive effect)
File a complaint with Quebec’s Commission d’accès à l’information (cai.gouv.qc.ca)

To exercise these rights, contact us at jeff@viruscomm.ca with subject « Law 25 Request ». We respond within 30 days.

11. Data Deletion

You can request the deletion of all your data in our systems by emailing jeff@viruscomm.ca with subject « Data Deletion Request ».

See our complete data deletion instructions page for details on the procedure and timelines.

12. Transfers Outside Quebec

Our primary servers are located in Quebec, Canada. However:

Anthropic (Claude API) is a US-based company — your message content may transit through their servers in the United States for AI processing
Meta hosts its own data according to its own rules (consult Meta’s Privacy Policy)

In accordance with Law 25, these transfers are subject to documented Privacy Impact Assessments (PIAs), reviewed annually.

13. Cookies

Our internal dashboard uses a session cookie (vsc_session) strictly necessary for our team’s authentication. No cookies are placed on the devices of external users (patients, page subscribers).

14. Minors

Our services involve public interactions on Facebook/Instagram pages of dental and medical clinics — potentially including pediatric clinics. If you are a minor and publish a comment, we process your interaction in the same manner as an adult (courteous and professional public reply). No additional data is collected based on your age.

Parents/guardians may at any time request the deletion of data concerning their child via the procedure in section 11.

15. Changes to This Policy

We may modify this policy to reflect changes in our practices or legal requirements. Any significant change will be announced via a visible update to the « Effective Date » at the top of this page. Affected users will be notified through usual channels when relevant.

16. Contact Us

For any question regarding this policy or the processing of your personal data:

Virus Sante Communication
Jeff Proteau, Privacy Officer
Email: jeff@viruscomm.ca
Website: https://virussantecommunication.ca