This document sells nothing
It is produced by NEXTIWEB, a Montreal web agency that sells the services these findings make necessary. We state it upfront. Each criterion can be checked without us, with free tools, and this page asks for nothing in return.
Open your website in a private browsing window — otherwise your browser shows you a personalized version, and you will not see what a new patient sees.
Answer Yes or No to each question. The rule is simple: if you have to think long and hard to decide, it is No. A patient does not stop to think.
The percentages shown are those of the clinics audited in August 2026, drawn at random from the Ordre's directory. They do not describe all of Quebec, and each carries a margin of error given in the study. The number of clinics is repeated under each criterion: it is 100 everywhere, except for criteria 5 and 7, where an impossible measurement is better than an invented one.
1. Is your privacy policy published?
- How to check
- Open your home page and look at the footer.
- It's Yes if
- a link leads to a privacy policy in a single click.
- It's No if
- you have to search, or the page does not exist.
- Why it matters
- It has been a Law 25 obligation since 2023.
Across the 100 audited clinics: 74% compliant
2. Is the person responsible for the protection of personal information named?
- How to check
- On the policy page, search for "responsible", "protection" or "personal information" (Ctrl+F).
- It's Yes if
- the name or email of a responsible person appears.
- It's No if
- no name, no email. A generic clinic address is not enough to identify a responsible person.
- Why it matters
- Law 25 requires that this person be identifiable from the outside.
Across the 100 audited clinics: 63% compliant
3. Does your cookie banner offer a genuine refusal?
- How to check
- Open your site in a private browsing window, to see what a new visitor sees.
- It's Yes if
- a banner appears, with a "Refuse" button as visible as "Accept".
- It's No if
- no banner, or a "Refuse" hidden behind "Customize", in small print, or in pale grey next to a coloured button.
- Why it matters
- A refusal harder than acceptance is not free consent.
Across the 100 audited clinics: 24% compliant
4. Do you inform the patient at the moment they enter their information?
- How to check
- Open the page that carries your appointment or contact form. Read what surrounds the fields.
- It's Yes if
- a mention, however brief, states what the information will be used for, who is responsible for it and what the person's rights are. It is visible without clicking elsewhere.
- It's No if
- there are only the field labels, or a simple link to the policy in the footer. The law requires informing at the moment of collection, not elsewhere on the site.
- Why it matters
- It is the most severe finding of the study, and the one that touches health data.
Across the 100 audited clinics: 8% compliant
5. Does your site load in under three seconds on a phone?
- How to check
- Go to pagespeed.web.dev, enter your address, Mobile tab.
- It's Yes if
- the value next to "Largest Contentful Paint", in the Metrics section, is under 3.0 seconds.
- It's No if
- it is over 3.0 seconds. Careful: do not take the big coloured number at the top — that is a score out of 100, not a time. And do not take the block at the top about your real visitors either: it is not the same measurement.
- Why it matters
- Beyond three seconds, some visitors have already left.
Across the 99 clinics whose speed could be measured: 4% compliant
One site returned a measurement error: it counts in no percentage.
6. Can someone request an appointment in three clicks or fewer?
- How to check
- Start from your home page and count the clicks to the form or the calendar.
- It's Yes if
- three clicks or fewer.
- It's No if
- more than three clicks, or no appointment path at all.
- Why it matters
- It is the criterion the clinics do best on.
Across the 100 audited clinics: 94% compliant
7. Does the patient see real availabilities?
- How to check
- Follow your own appointment link all the way to the availability screen — without booking.
- It's Yes if
- real time slots appear and the patient can confirm without a person stepping in.
- It's No if
- the path ends in a request form, an email or a phone number. The patient proposes, the clinic calls back.
- Why it matters
- The button exists almost everywhere, the calendar almost nowhere.
Across the 98 clinics whose path could be followed: 6% compliant
Two paths require an identity before showing any availability: they count in no percentage.
8. Can a machine understand that your site is a dental clinic's?
- How to check
- Run your address through Google's Rich Results Test, or search for "application/ld+json" in your page's source code.
- It's Yes if
- markup of type Dentist, LocalBusiness, MedicalBusiness or MedicalClinic is present, with at minimum the name, address, phone number AND opening hours.
- It's No if
- no markup, or only technical markup (WebPage, WebSite, BreadcrumbList) placed automatically by the platform: that does not describe your clinic. Incomplete markup does not count either.
- Why it matters
- This is what Google and assistants like ChatGPT read. The most common gap is forgetting the opening hours.
Across the 100 audited clinics: 14% compliant
9. Have you answered a Google review in the last six months?
- How to check
- Open your listing in Google Maps, Reviews tab, and look at the most recent ones.
- It's Yes if
- at least one review carries an "Owner response" dated less than six months ago.
- It's No if
- no response, or the last one is more than six months old.
- Why it matters
- It is free and takes two minutes. Half of the clinics do not speak to those who recommend them.
Across the 100 audited clinics: 52% compliant
10. Are your Google hours identical to those on your site?
- How to check
- Open your Google listing and your site side by side, and compare day by day.
- It's Yes if
- the two match exactly.
- It's No if
- at least one day differs. One clinic in the panel was shown closed four days out of five when it was open.
- Why it matters
- It is Google's hours the patient sees first, not your site's.
Across the 100 audited clinics: 39% compliant
Your result
Count your Yeses. That is your score out of 10, calculated exactly like that of the hundred clinics in the study.
None of the 100 audited clinics reaches 8 out of 10. The best tops out at 7, and the average stands at 3.8.
The first four criteria concern Law 25 and require neither budget nor technical skill. If you were to tackle only one, the fourth is the one that touches health data.
Criteria 5 and 8 often depend on the platform your site was built on, sometimes years ago. They are not fixed in an afternoon, and that is not negligence.
Criteria 9 and 10 are free, depend on no one but you, and are settled in half an hour.
The questions we get asked
The answers below describe what was measured on the 100 audited clinics. They do not constitute legal advice.
Does Law 25 apply to my dental clinic?
Law 25 applies to any private enterprise operating in Quebec that collects personal information. A dental clinic collects it the moment a patient fills in an online appointment form — name, phone number, email, and often the reason for the visit.
The first four criteria of this checklist concern what the law requires to be made visible on a site. Across the 100 clinics audited in August 2026, four met all four criteria at once, and twenty-four met none.
What do I need on my site to be compliant?
Four elements were checked: a privacy policy accessible in one click (74% of audited clinics), the name of a person responsible for the protection of personal information (63%), a cookie banner that offers a genuine refusal (24%), and a notice at the moment the patient enters their information (8%).
The first three require neither budget nor technical skill. The fourth is the one that touches health data, and it is the least often present.
Do I have to name a person responsible for the protection of personal information?
The role has existed in every enterprise since September 2022, and it falls by default to the person with the highest authority — in a clinic, the owner-dentist, unless delegated in writing. What can be checked from the outside is that their title and contact details are published on the site.
Across the 100 audited clinics, 63% published an identifiable name or email. A general clinic address was not counted: it designates no one.
Why doesn't my clinic show up when someone asks ChatGPT or Google for a dentist?
A site can be perfectly readable to a human and stay mute to a machine. What lets an engine or an assistant understand it is looking at a dental clinic — its name, address, phone number, hours — is markup placed in the page's code, invisible on screen.
Across the 100 audited clinics, 14% had a complete one. Many others carried markup placed automatically by their platform, which describes a web page but not a clinic.
How do I know if my site is too slow on a phone?
Run your address through PageSpeed Insights, Mobile tab, and read the value next to "Largest Contentful Paint" in the Metrics section. It is the time it takes before the main part of the page appears. The threshold used in the study was three seconds.
Do not take the big coloured number at the top: that is a score out of 100, not a time. Across the 99 clinics whose speed could be measured, 4% came in under three seconds.
Does answering Google reviews actually change anything?
An owner response is visible to every patient who reads the review afterward, including those who read a negative one. It is free and depends on no one but you.
Across the 100 audited clinics, 52% had answered at least one review in the previous six months.
Are my opening hours on Google the right ones?
Open your Google listing and your site side by side and compare day by day. It is the fastest of the ten checks, and the most costly gap: a patient who thinks you are closed calls elsewhere.
Across the 100 audited clinics, 39% showed exactly the same hours in both places. One clinic in the panel was shown closed four days out of five when it was open.
What do I risk if my site is not compliant with Law 25?
The law provides two penalty regimes for an enterprise. First, administrative monetary penalties, imposed by the Commission d'accès à l'information, of up to 10 million dollars or 2% of worldwide turnover, whichever is higher. Then penal fines, by prosecution, from 15,000 dollars up to 25 million dollars or 4% of worldwide turnover, whichever is higher, and doubled for a repeat offence.
These are the maximums provided by law, not automatic fines: their application rests with the Commission and the courts. This is not legal advice — the official reference is the Commission d'accès à l'information du Québec. Across the 100 audited clinics, four met all four Law 25 criteria checked in this checklist, and twenty-four met none.
Is it expensive to fix?
Six of the ten criteria — the four Law 25 ones, answering reviews and matching the hours — require only time and access to your own site. Criteria 9 and 10 are settled in half an hour, with no one.
Criteria 5 and 8, speed and markup, often depend on the platform the site was built on, sometimes years ago. Those are not fixed in an afternoon, and that is not negligence.
The checklist in a printable version, to tick by hand.