Data Processing Agreement

1.1 What this Schedule D is

This Schedule D to the Data Processing Agreement (the "DPA", transcribe.health/legal/dpa) sets out the terms on which Transcribe Health Corporation ("Transcribe Health"), a corporation incorporated under the federal laws of Canada with its office in Toronto, Ontario, handles health information on behalf of a health care provider located in Ontario, Alberta or British Columbia. For such a Customer it is:

• (a) in Ontario, the written terms on which the Customer permits Transcribe Health to act as its agent under section 17 of the Personal Health Information Protection Act, 2004 ("PHIPA") (Section 5);
• (b) in Alberta, the information manager agreement required by section 66(2) of the Health Information Act ("HIA") and section 7.2 of the Health Information Regulation, Alta. Reg. 70/2001 (the "HIR"), and the agreement required by section 8(4) of the HIR for health information stored or used outside Alberta (Section 6); and
• (c) in British Columbia, and for Alberta organizations that are not HIA custodians, the service provider terms through which the Customer meets its duty to make reasonable security arrangements under the Personal Information Protection Act of British Columbia ("BC PIPA") or of Alberta ("Alberta PIPA") (Sections 6.16 and 7).

Section 4 contains the terms that apply in every Covered Province. Sections 5, 6 and 7 add what each provincial law requires. Annex A is the plain-language description of the Services, the artificial intelligence they use and their safeguards. Annex B contains template patient notice and consent text.

1.2 When this Schedule D applies

This Schedule D applies only when, and only to the extent that, the Customer is located in Ontario, Alberta or British Columbia. The Customer is "located" in a Covered Province if it provides health services from a practice location in that province, and this Schedule D then applies to Custodian Health Information collected in connection with health services provided from that location. If the Customer is not located in a Covered Province, this Schedule D does not apply and creates no rights or obligations for either party.

The Customer must give its correct country and province when it creates its organization in the Services, and must tell support@transcribe.health in writing if either changes. Transcribe Health cannot assign agreements to a province automatically, so the Customer's acceptance of the DPA, read with this Section 1.2, is what makes this Schedule D apply. On request, Transcribe Health will confirm in writing, within ten (10) business days, that this Schedule D applies to the Customer.

Transcribe Health will ask every existing Customer whose organization is recorded in a Covered Province to accept the DPA version that includes this Schedule D. For a Customer located in Alberta that has not accepted it within thirty (30) days of that request, Transcribe Health will stop processing new Custodian Health Information for that Customer until it does.

1.3 Precedence, the Business Associate Agreement, and liability

This Schedule D forms part of the DPA. For Custodian Health Information, it prevails over the Terms of Service, the rest of the DPA (including its Schedules A to C) and the Privacy Policy to the extent of any conflict, despite Section 15.6 of the Terms of Service and Section 8 of the DPA. In particular, it prevails over Sections 6.3 and 7.4 of the Terms of Service and Sections 5.3, 5.4, 7.4, 10.1, 15.3, 17.1 and 19.1 of the Privacy Policy. Annex A is the description of the safeguards that apply to Custodian Health Information; Section 3.3 and Schedule B of the DPA apply to it only to the extent they are consistent with Annex A.

The Business Associate Agreement does not apply. For a Customer to which this Schedule D applies, the DPA, including this Schedule D, replaces the Business Associate Agreement (the "BAA", transcribe.health/legal/baa). The BAA does not apply to the Customer or to Custodian Health Information, even if the Customer has accepted it through the Services, and nothing in the BAA, or in any other document that refers to the BAA, permits Transcribe Health to use, disclose, de-identify or aggregate Custodian Health Information.

References in this Schedule D to the Terms of Service, the DPA and the Privacy Policy are to the versions identified in the acceptance record under Section 1.4. A later version prevails over this Schedule D only as Section 11 allows.

This Schedule D does not prevail over, expand or reduce the limitations of liability, exclusions and indemnities in Section 10 of the DPA and Sections 10 and 11 of the Terms of Service, or the fees in Section 8 of the Terms of Service except as stated in Section 4.18. All liability of Transcribe Health arising out of or relating to this Schedule D or Custodian Health Information, whether in contract, tort (including negligence), under an indemnity or otherwise, is subject to Section 10 of the Terms of Service as one aggregate amount shared with the DPA and the Terms of Service (the general cap in Section 10.1 or, for indemnity obligations under Section 11 of the Terms of Service, the cap in Section 10.2), including liability for the costs of breach notification, investigation, regulator inquiries and remediation that the Customer incurs. It is not liability for breach of confidentiality obligations under Section 10.2 of the Terms of Service. The obligations in this Schedule D are performance obligations; none of them is an indemnity, a guarantee or a warranty of result. The indemnity in Section 10.2 of the DPA applies to a breach of this Schedule D only where the third-party claim results from Transcribe Health's negligence, wilful misconduct or failure to comply with Applicable Health Privacy Law.

This Schedule D is governed by Section 12.1 of the DPA (the laws of Ontario), and disputes under it are resolved under Section 13 of the Terms of Service, except as stated in Section 4.16(e). Nothing in this Schedule D limits liability that cannot be limited by law, or a party's obligations under Applicable Health Privacy Law that cannot be limited by contract.

1.4 Acceptance and the parties

This Schedule D is accepted when an owner or administrator of the Customer accepts the DPA through the Services. Transcribe Health keeps a record of that acceptance, including the accepting person's name and the title they give, the date and time, and the version accepted, and it keeps an unchangeable copy of each published version. That record and this Schedule D together form a written agreement between the parties.

Where more than one Custodian practises through the Customer's organization in the Services (for example, several physicians who are each a custodian under the HIA or a health information custodian under PHIPA), the person accepting must identify each Custodian on whose behalf they accept, by writing to privacy@transcribe.health before that Custodian's patients' information is first handled through the Services, and represents that each identified Custodian has authorized them in writing to do so. Each identified Custodian is a party to this Schedule D as a Custodian from the time it is identified. A Custodian who is not identified is not a party, and the Customer must not use the Services for that Custodian's patients until that Custodian, or a representative it has authorized, has been identified in the same way. Transcribe Health will send each identified Custodian, at the email address given for it, a copy of this Schedule D and confirmation that it is a party. Any Custodian may withdraw its representative's authority by written notice to Transcribe Health. The Customer must keep the list of Custodians current. For a Customer already using the Services when it accepts this Schedule D, the identification is made within thirty (30) days of acceptance.

On request, Transcribe Health will provide, within ten (10) business days, a copy of this Schedule D countersigned by Transcribe Health, and will countersign an unmodified copy signed by any individual Custodian. Changes to this Schedule D bind Transcribe Health only if made in a separate written agreement signed by Transcribe Health.

3.1 The Custodian keeps control

The Custodian has custody or control of Custodian Health Information at all times and remains responsible for it under Applicable Health Privacy Law. Transcribe Health handles Custodian Health Information only on behalf of the Custodian, for the purposes in Section 4.1. Transcribe Health does not become a custodian of, and acquires no right in, Custodian Health Information by providing the Services. Custodian Health Information is not an asset of Transcribe Health.

3.2 The Services are not the Custodian's medical record

The Services are a clinical documentation and practice support service. They are not the Custodian's medical record system (Section 5.3 of the Terms of Service). The Custodian keeps its medical record in its own record system and transfers finalized Service outputs into that system.

3.3 Role in each Covered Province

This Schedule D is governed by the laws of Ontario under Section 12.1 of the DPA. References to the law of the Custodian's province describe the statutory duties that apply to the handling of Custodian Health Information. They do not change the law governing this Schedule D as a contract.

4.1 Purpose limitation and no use for Transcribe Health's own purposes

(a) Transcribe Health collects, uses, retains, discloses and disposes of Custodian Health Information only: to provide the Services described in Sections 2.1 and 2.2 of the DPA; on the Custodian's documented instructions under Section 3.1 of the DPA, which include the Custodian's configuration of the Services; to protect and secure the Services and investigate Privacy Breaches; and as required by law.

(b) Despite anything in the Terms of Service, the rest of the DPA or the Privacy Policy, including Sections 5.3, 5.4, 7.4, 10.1, 15.3 and 19.1 of the Privacy Policy, Transcribe Health does not:

• (i) use Custodian Health Information, or any information de-identified, anonymized, aggregated or synthesized from it, to train, fine-tune, evaluate or otherwise improve any artificial intelligence or machine learning model, whether its own or a third party's (Section 6.1 of the DPA);
• (ii) de-identify, anonymize or aggregate Custodian Health Information for its own purposes, including management, administration, analytics, benchmarking, population health analytics, quality measure reporting, product development or research, or provide data aggregation services with it;
• (iii) combine Custodian Health Information with information from any other customer or source, except to provide the Services to the Custodian;
• (iv) sell, rent, license, market or otherwise commercialize Custodian Health Information; or
• (v) attempt to re-identify any individual from information derived from Custodian Health Information.

(c) Features that adapt to the Custodian, such as transcript correction suggestions drawn from the Custodian's own users' corrections, use only the Custodian's own information, within its account, at the time they run. They change no model and are not shared with any other customer (Section 6.1 of the DPA).

4.2 Usage and billing records

To apply the Custodian's AI allowance and bill usage, Transcribe Health records for each AI request the organization, the user (where there is one), the feature, the AI provider and model, the time, and the cost (Section 2.2 of the DPA). These records contain no clinical content and no patient identifiers, and are not Custodian Health Information. Section 4.14(e) applies to them after the term ends.

4.3 Minimum necessary information and personnel access

(a) The Services are designed to send to each processing step only the Custodian Health Information reasonably needed for that step. For example, raw audio is transcribed on Transcribe Health's own servers and is never sent to an AI Subcontractor. AI Subcontractors receive only the text a request needs, such as the transcript, the current note, form answers or patient context, and, for fax reading, the received fax document.

(b) Transcribe Health personnel access Custodian Health Information only where necessary: to provide support the Custodian requests, to operate, maintain and secure the Services, to investigate a Privacy Breach or security event, to carry out a written request of the Custodian under this Schedule D, or as required by law. They access the least information needed for that purpose.

(c) Every person Transcribe Health authorizes to access Custodian Health Information is bound by a written confidentiality agreement that includes the restrictions in this Schedule D, receives privacy and security training before access and refresher training each calendar year, and has access removed when it is no longer needed. At the date of this Schedule D, the only such person is the Security Officer.

(d) Access through the Services and Transcribe Health's administrative tools is recorded in the audit log described in Section 4.8. Access to Custodian Health Information directly through the underlying infrastructure, such as a database administration session, is not recorded record-by-record in that audit log; changes made to the database in such a session are logged automatically and kept for at least thirty-one (31) days; read-only access is not logged automatically, so the register is the record of it. Transcribe Health therefore records each such access session in a written access register stating the date, the person, the purpose, the Customer and, as far as practicable, the records or categories of records involved. At least monthly, Transcribe Health checks the register against the automatic database change logs. It includes the relevant register entries when it provides records of access under Section 4.8.

4.4 Safeguards

(a) Transcribe Health maintains administrative, technical and physical safeguards that are reasonable in the circumstances and appropriate to the sensitivity of health information, to protect Custodian Health Information against theft, loss and unauthorized access, collection, use, disclosure, copying, modification and disposal, as required of it by PHIPA sections 12(1) and 17, HIA sections 60 and 66(5), BC PIPA section 34 and Alberta PIPA section 34. Those safeguards are described in Annex A.

(b) Transcribe Health assesses the threats, vulnerabilities and risks to Custodian Health Information, and how the Services may affect the privacy of the individuals concerned, at least once in each calendar year and before making a change to the Services that it considers material to those risks, and updates its safeguards to address the risks it identifies. It provides a written summary of the most recent assessment under Section 4.12(b). Transcribe Health will have an independent, qualified third party perform a penetration test of the Services, including the paths by which Custodian Health Information reaches AI processing, within twelve (12) months after this Schedule D first takes effect for any Customer, and at least once in each twelve (12) months after that. On request, it provides the Custodian with an executive summary of the most recent test, the findings rated high or critical, and their remediation status.

(c) The Services let the Customer require every user to set up and use multi-factor authentication at sign-in. The Customer agrees to turn this requirement on before it first uses the Services with Custodian Health Information and to keep it on (Section 4.17(g)). The requirement applies from each user's next sign-in, which is within twelve (12) hours. A user who has set up multi-factor authentication and signs in from a device they have marked as trusted is not asked for the second factor again on that device for up to thirty (30) days.

4.5 Location of processing and handling outside the Custodian's province

(a) Storage. Custodian Health Information held in the Services' databases, file storage and backups is stored only in Ontario, Canada, on servers owned by Transcribe Health or its owner and operated by Transcribe Health, at a single site, in a locked room or cabinet to which only the Security Officer has physical access. Backups are kept on a separate backup server at the same site; there is no copy at a second site. The exceptions are information held transiently by Cloudflare while it passes it on, email held briefly in Montréal, Quebec, by Amazon Web Services Canada, Inc. while it delivers it, and short-lived caching by Google, described in Sections 4.5(b) and 4.5(c) and Annex A, Section A5.

(b) Processing. Speech-to-text runs on models Transcribe Health hosts in Ontario, and visit and dictation audio does not leave Canada. Clinical AI inference for a Canadian Customer runs on Google Cloud Vertex AI in its Montréal, Quebec region (northamerica-northeast1), or on models Transcribe Health hosts in Ontario. For a Customer covered by this Schedule D, Transcribe Health uses only Vertex AI regional endpoints in northamerica-northeast1, only with models that Google's documentation states are processed in that region, and never a global or multi-region endpoint, unless the Customer has made the election in Section 4.5(d). If no such model is available, Transcribe Health uses only the models it hosts in Ontario. Google's terms do not permit it to use the information to train its models. Unless and until Transcribe Health notifies the Customer that caching is turned off for its Google Cloud project, Google may hold prompts in its cache, in memory or encrypted on disk within the Montréal region, for up to twenty-four (24) hours to serve repeated requests, and may log prompts for abuse monitoring as its terms allow.

(c) In transit and messaging.

• (i) Cloudflare, Inc. (United States) provides DNS, network security and delivery services for the Services, as a Subcontractor under its standard Data Processing Addendum with Transcribe Health. Connections from users and patients to the Services are encrypted to Cloudflare, which decrypts them at the Cloudflare location that serves the user or patient, inspects them for security, and re-encrypts them to Transcribe Health's servers in Ontario. That location is normally the one nearest to the user or patient; for users and patients in Canada it is normally in Canada; otherwise it is in the country of the Cloudflare data centre nearest them, which may be the United States or another country (Annex A, Section A5). Cloudflare holds the content of these connections only transiently, in memory, to pass it on. Transcribe Health configures the Services so that pages and API responses that contain patient information are excluded from Cloudflare's caching, and Cloudflare does not cache or store Custodian Health Information.
• (ii) Amazon Web Services Canada, Inc. delivers the email the Services send through Amazon Simple Email Service in its Canada (Central) region (ca-central-1) in Montréal, Quebec, and may hold an email briefly while delivering it. Emails to patients contain the patient's email address, the practice name and a secure link; a recording-consent request also says that the practice asks to record the visit with an AI scribe. Emails to patients do not state the clinician, date, time or location of a visit, and the Services do not put clinical notes or the content of secure messages in emails; those details are shown only after the patient follows the link. Amazon Web Services Canada, Inc. is a subsidiary of a United States company (Annex A, Section A6).

(d) Optional cross-border AI. Custodian Health Information is processed for AI inference outside Canada only if the Customer turns on enhanced cross-border AI in the Services. The setting can be changed by an owner, an administrator, or another user to whom the Customer has given organization-settings permission (Section 4.17(o)). The election is the Customer's written instruction under Section 3.1 of the DPA. It is recorded with the version of the Privacy Policy disclosure in force when it is made, applies only to the AI inference described in Section 5.2 of the DPA, and can be withdrawn at any time in the Services; if Transcribe Health has, at the Customer's request, pinned an AI model outside Canada for the Customer, it removes the pin within two (2) business days of the request so that the withdrawal can take effect. Transcribe Health personnel will not turn on cross-border AI, pin a model outside Canada, or otherwise change the Customer's AI residency setting except on the Customer's written instruction, which Transcribe Health keeps on file. Transcribe Health reviews new elections recorded in the Services at least once a week and confirms each one by email to the Customer's privacy contact and owners. Before making the election, the Customer is responsible for any patient notice and privacy impact assessment it requires. For an Alberta Customer, Section 6.17(a) also applies. With the election, a request may be served in the United States by Google LLC (Vertex AI). Anthropic PBC will not receive Custodian Health Information until its Business Associate Agreement is executed, Transcribe Health's privacy impact assessment of that transfer is approved, and Transcribe Health has given the notice in Section 4.10(b).

(e) Changes. Transcribe Health will give the Customer at least thirty (30) days' written notice before any change that would cause Custodian Health Information to be stored outside Ontario, or processed outside Canada other than as described in this Section 4.5, and the Customer may then terminate the affected Services under Section 4.16(h) before the change takes effect. Where an urgent change is needed to keep Custodian Health Information secure or the Services available, Transcribe Health may make it on shorter notice, gives notice as soon as practicable, and returns to the processing described in this Section 4.5 when it reasonably can, but no urgent change stores or processes Custodian Health Information outside Canada.

(f) Phone and text messaging. The SMS and phone features that use Twilio Inc. (United States), including Dorvi's phone line, are not enabled for a Customer covered by this Schedule D. Transcribe Health enables these features for an organization only through its own staff tools, and will not do so for such a Customer until it has updated Annex A and Schedule C of the DPA and given the notice in Section 4.10(b).

4.6 Retention during the term

(a) Default settings. During the term, Custodian Health Information is retained under the Services' default retention settings described in Annex A, Section A8. These are default settings, not periods required by law, and no retention minimum in the Terms of Service, the rest of the DPA or the Privacy Policy applies to Custodian Health Information. The Customer may turn on earlier automatic deletion of visits, from 1 to 24 hours or 1 to 30 days after the visit; this deletes the whole visit, including its recording, transcript and notes. The Customer may ask in writing under Section 4.6(c) for any other information to be erased earlier. Transcribe Health plans to introduce the Canadian default settings described in Annex A, Section A8; it will give at least thirty (30) days' written notice before they take effect, and they will apply to information that already exists only from the date they take effect. Retention in the Services does not replace the Customer's own record retention duties (Section 4.17(h)).

(b) Instructions and consent. The Customer's acceptance of this Schedule D, its retention settings, its deletions in the Services and its written requests are its express written instructions and consent for Transcribe Health to: retain Custodian Health Information for those periods; make the copies needed to provide and protect the Services, including backup copies; and destroy Custodian Health Information at the end of those periods. Transcribe Health does not otherwise copy, retain or destroy Custodian Health Information except as required by law.

(c) Erasure on request. Some deletions in the Services remove information from use but do not permanently erase every copy. Deleting a visit removes it from the Custodian's view, its audio is permanently erased later by the audio retention process, and its transcript and notes are not erased until the end of the term or a written request under this Section; a completed visit cannot be deleted in the Services. To have specific information permanently erased, the Customer may make a written request identifying the Custodian Health Information concerned. Transcribe Health will then permanently erase it from active systems within thirty (30) days, or within sixty (60) days where the request covers more than one patient's full record or requires work outside the Services' standard tools and Transcribe Health tells the Customer so within ten (10) business days, and will confirm in writing when that is done. Backup copies expire within ninety (90) days of erasure from active systems.

(d) Legal holds. If the Customer instructs Transcribe Health in writing to preserve specified visits beyond their retention period, for example because they are the subject of an access request or a legal proceeding, Transcribe Health will, within five (5) business days, suspend the scheduled deletion of those visits and confirm in writing what is preserved. The Services can preserve visits in this way; for other information, the Custodian should export a copy to its own systems, and Transcribe Health will tell the Customer what it can preserve. A hold ends when the Customer withdraws it or at the end of the Export Window under Section 4.14, whichever is earlier, unless the parties agree otherwise in writing. Transcribe Health is not responsible for information deleted by the Customer's own actions or settings, or before it confirms the hold.

(e) Retention required of Transcribe Health by law. If the law requires Transcribe Health to retain any Custodian Health Information longer than this Schedule D allows, Transcribe Health will tell the Customer what is retained and why (unless the law prohibits it), extend the protections of this Schedule D to it, use it only for the purpose that requires retention, and destroy it when that requirement ends.

4.7 Access, correction and other patient requests

(a) Individuals exercise their rights of access and correction against the Custodian, under PHIPA Part V, HIA Part 2, BC PIPA sections 23 and 24 and Alberta PIPA sections 24 and 25. Transcribe Health does not respond to these requests itself.

(b) The Custodian can locate, view and correct Custodian Health Information in the Services, including editing notes (earlier versions are kept), viewing and exporting a patient's form responses, and exporting the clinic's records archive. The Services do not offer a per-patient export or erasure. Where the Custodian cannot do what a request requires through the Services, Transcribe Health will, on the Custodian's written request identifying the individual and the information:

• (i) provide a copy of the Custodian Health Information about that individual that the Services hold and that Transcribe Health can locate using the identifiers the Custodian provides, in a commonly used, machine-readable format, within fifteen (15) business days;
• (ii) make any correction or annotation the Custodian directs to the corresponding Service outputs within the same period; and
• (iii) erase the individual's Custodian Health Information that Transcribe Health can locate in that way, under Section 4.6(c).

Where a request involves an unusually large volume of information, Transcribe Health may extend these periods by up to fifteen (15) further business days by telling the Custodian before the first period ends. If the Custodian tells Transcribe Health that its statutory deadline requires a shorter time, Transcribe Health will use reasonable efforts to meet it. Information that a user has typed into free text without linking it to the individual's record in the Services may not be locatable, and the Custodian is responsible for searching its own users' content where needed. The Custodian records any statement of disagreement in its own record system.

(c) If an individual or any other person sends Transcribe Health a request about Custodian Health Information, including a request for access or correction, a complaint, a withdrawal of consent or an expressed wish about disclosure, Transcribe Health will forward it to the Custodian promptly, and normally within two (2) business days of identifying the Custodian, will tell the requester that it has done so, and will take no other action on the request except as the Custodian instructs in writing or the law requires.

4.8 Records of access and records of AI input

(a) Audit log. The Services keep an electronic audit log of access to Custodian Health Information through the Services and through Transcribe Health's administrative tools, including views of visits, notes, patients, conversations and forms, list and search views, exports, changes and deletions. Views of a transcript on its own, and views of the appointment schedule, are not yet recorded; Transcribe Health will tell the Customer when they are. Each entry identifies who acted, the record (and, where the record is a patient record, the patient) by identifier, the type of action and record, and the date and time. Entries contain no clinical content. The log is protected against undetected alteration (Annex A, Section A7). Transcribe Health keeps entries on the Custodian's behalf for at least six (6) years from creation, and for at least ten (10) years for a Customer located in Alberta, including after the end of the term, and then destroys them within twelve (12) months, unless the Custodian asks in writing for them to be returned or kept longer or the law requires them to be kept.

(b) Self-serve review. The Customer's users with audit permission can review the audit log in the Services.

(c) Reports on request. On the Custodian's written request, Transcribe Health will provide, within ten (10) business days, or within twenty (20) business days for a request covering more than one patient or more than twelve (12) months, a report of the records of access to the Custodian Health Information the Custodian specifies, identifying individuals by name where the Services hold the name, together with relevant entries from the access register under Section 4.3(d) and the delivery records still held of documents sent by fax, to an EHR or to patients through the Services.

(d) Records of AI input. The Services do not keep a separate log of each input of an individual's information into the AI features. On the Custodian's written request, Transcribe Health will provide, within ten (10) business days, or twenty (20) business days for a request covering more than one patient or more than twelve (12) months, the records the Services hold of the occasions on which Custodian Health Information linked to a specified individual's record in the Services was sent to the AI features, showing for each, to the extent the records show it, the date and time, the feature, the user and the visit or record concerned. The Custodian may view the related visit, note or form in the Services. This supports, but does not replace, the Custodian's own record-keeping duty under HIA section 27.1 (Section 6.13).

(e) At the end of the term, Section 4.14(b) applies to these records.

4.9 Notice of a Privacy Breach

(a) Timing. Transcribe Health will notify the Custodian of any Privacy Breach, and of any suspected Privacy Breach it cannot promptly rule out, at the first reasonable opportunity and as soon as practicable, with a preliminary notice no later than twenty-four (24) hours, and a full written notice no later than seventy-two (72) hours, after Transcribe Health first knows, or by exercising reasonable diligence would have known, of facts that confirm the Privacy Breach or give reasonable grounds to suspect it. Transcribe Health updates the Custodian as further facts become known, at reasonable intervals until the Privacy Breach is resolved.

(b) Recipients and form. The notice goes to the Custodian's designated privacy contact and to its owners and administrators in the Services. It does not contain patient health information in the body of an email; details that identify patients are provided through the Services or another secure channel. Where the Custodian has given Transcribe Health reasonable written requirements for the form and content of such a notice that Transcribe Health has accepted in writing, the notice meets them; for an Alberta Custodian, Section 6.9(d) applies instead.

(c) Content. The full written notice states, to the extent known: a description of the circumstances; the date or period of the Privacy Breach and the date it was discovered; a description of the Custodian Health Information involved; the number of the Custodian's patients and users affected and their identifiers in the Services; whether the information was encrypted or otherwise protected; the steps taken to contain the Privacy Breach and reduce the risk of harm and of recurrence; Transcribe Health's assessment of the risk of harm; and the name and contact details of the person handling it.

(d) Response. Transcribe Health takes reasonable steps, promptly and on an ongoing basis, to contain and mitigate the Privacy Breach, preserves relevant evidence and logs, reasonably cooperates in the Custodian's investigation, and keeps a record of every Privacy Breach for at least twenty-four (24) months.

(e) Notices to patients and regulators. The Custodian decides whether to notify affected individuals, its regulator and any other body. Transcribe Health does not notify the Custodian's patients or regulator about a Privacy Breach of Custodian Health Information except as the Custodian directs or the law requires. On request, Transcribe Health gives the Custodian the information it holds that the Custodian reasonably needs for its own notices and reports, including its annual statistical report under O. Reg. 329/04, and will comment on draft notices the Custodian prepares, so far as they describe the Services.

4.10 Subcontractors

(a) Transcribe Health engages Subcontractors only under Section 3.4 of the DPA. Before a Subcontractor handles Custodian Health Information, Transcribe Health assesses it and puts in place written terms, which may be the Subcontractor's standard terms, that, having regard to the information it handles, limit its use of the information to providing its services, require it to protect the information with reasonable safeguards, and, where the Subcontractor provides AI inference, prohibit it from using the information to train models. Transcribe Health configures the Services so that Subcontractors that handle Custodian Health Information only in transit or for immediate processing are not instructed to store it. Transcribe Health remains responsible to the Custodian for the acts and omissions of its Subcontractors as if they were its own, subject to Section 1.3.

(b) Transcribe Health will give the Customer at least thirty (30) days' written notice before engaging a new or replacement Subcontractor that will handle Custodian Health Information, or materially changing what an existing one receives, except where an urgent replacement is needed to keep the Services secure or available, in which case Transcribe Health gives notice as soon as practicable and no later than the date of the change; an urgent replacement never moves Custodian Health Information outside Canada. The Customer may object on reasonable privacy or security grounds within the notice period. If Transcribe Health cannot reasonably accommodate the objection, the Customer may terminate the affected Services under Section 4.16(h).

(c) The current Subcontractors that handle Custodian Health Information, what each receives and where, are listed in Annex A, Section A5.

4.11 The AI in the Services: description, changes and accuracy

(a) Description. Annex A, Section A3 describes the AI the Services use: what each model does, where it runs, what it receives, its known limitations, and the human review the Services require.

(b) No automated decisions. The Services draft; they do not make decisions about patients. Every AI output is a draft for review by a qualified member of the Custodian's staff, and no Dorvi action in the Services is carried out without approval by one of the Customer's users (Sections 6.2, 6.3 and 4.6 of the DPA). Dorvi's phone line, which can change a verified caller's appointments within rules the clinic sets, is not enabled for a Customer covered by this Schedule D (Section 4.5(f)).

(c) Notice of changes. Transcribe Health will give at least thirty (30) days' written notice to the Customer's privacy contact and owners before any change that uses Custodian Health Information in a new way, adds an AI capability that uses it, changes an AI provider or where AI processing happens, or that it expects to materially change the quality of outputs. A new AI capability that uses Custodian Health Information in a new way is made available to the Customer only when an owner or administrator turns it on in the Services or, where the Services offer no setting for it, asks for it in writing; for an Alberta Custodian, Section 6.15 also applies. Routine model version updates by an existing provider in the same location that do not change what information is used are announced in the release notes, in advance where Transcribe Health controls the timing. Where an urgent change is needed to protect Custodian Health Information, notice is given as soon as practicable.

(d) Declining performance. If Transcribe Health identifies a systematic problem that it reasonably believes materially reduces the accuracy of AI outputs, it will notify affected Customers within a reasonable time, describe the problem and any steps users should take, and tell them when it is fixed.

(e) Reporting inaccurate output. The Custodian may report inaccurate, incomplete or inappropriate AI output to support@transcribe.health, identifying the visit by its identifier in the Services rather than by patient details. Transcribe Health aims to acknowledge the report within two (2) business days, reviews it, and within a reasonable time, normally fifteen (15) business days, tells the Custodian what it found and what it will do, such as correcting a defect, changing a prompt or configuration, or explaining the limitation. These are service targets; missing one is not a breach of this Schedule D if Transcribe Health completes the review within a reasonable time. Transcribe Health does not use the reported content for any purpose other than investigating and fixing the problem, no prompt, configuration, test case or rule changed in response to a report contains Custodian Health Information, and personnel access to the reported visit is recorded under Section 4.3(d). Section 4.1 continues to apply.

(f) Ongoing evaluation. Before it changes the model or materially changes the prompt used to draft clinical notes, and at least twice in each calendar year, Transcribe Health evaluates the AI features against a set of synthetic and public clinical encounters, including varied accents and speech patterns, and measures omissions, fabricated content, speaker-attribution errors and medication or dose errors. It does not use Custodian Health Information for this. It does not deploy a version that performs materially worse than the version it replaces, except where the provider withdraws the version in use, in which case Transcribe Health deploys the best-performing available alternative, tells affected Customers under Section 4.11(c) or (d), and shares the evaluation result on request. It provides the Customer with a summary of the most recent evaluation and its method within fifteen (15) business days of a request.

4.12 Monitoring compliance, audits, privacy impact assessments and regulators

(a) Documentation. Transcribe Health keeps Annex A current, publishes it with this Schedule D, and gives the Customer an updated copy, with notice, when it changes materially.

(b) On request, once in each twelve (12) months and at no charge, Transcribe Health will provide: a written summary of its most recent threat and risk assessment under Section 4.4(b); the penetration test summary under Section 4.4(b); written answers to one reasonable privacy and security questionnaire; the current list of Subcontractors; and, once issued, its SOC 2 Type II report under a non-disclosure agreement. Transcribe Health does not hold a SOC 2 report or ISO 27001 certification at the date of this Schedule D, and its threat and risk assessments are not performed by an independent third party.

(c) Audit. Once in any twelve (12) months, the Custodian, or an independent auditor it appoints who is not a competitor of Transcribe Health and who signs a confidentiality agreement with Transcribe Health, may verify Transcribe Health's compliance with this Schedule D by document review and written questions, followed if needed by one remote meeting of up to two (2) hours with knowledgeable personnel. The Custodian gives at least thirty (30) days' written notice and a written scope. The audit takes place during business hours and is completed within ten (10) business days of starting. Transcribe Health may satisfy the audit, in whole or in part, by providing the items in Section 4.12(b) or a current independent report covering the matters in scope. Further audits, and on-site audits, are available only (i) where a regulator with jurisdiction requires them, (ii) following a Privacy Breach caused by Transcribe Health or its Subcontractors that affects the Custodian's information, or (iii) for an Alberta Custodian, as set out in Section 6.17(b). Each party bears its own costs of an audit, and audits beyond the first in any twelve (12) months are charged under Section 4.18 unless they follow a Privacy Breach caused by Transcribe Health or are required by a regulator. Audits must not give access to other customers' information, to security-sensitive details whose disclosure would weaken the Services, or to privileged material. Audit findings and all information disclosed are Security Information under Section 4.20.

(d) Questions. Transcribe Health will answer the Custodian's reasonable written questions about its handling of Custodian Health Information within a reasonable time, normally fifteen (15) business days. Questions that are substantially answered by Annex A, the items in Section 4.12(b) or an earlier answer may be answered by reference to them.

(e) Privacy impact assessments. Transcribe Health provides the information the Custodian reasonably needs to prepare a privacy impact assessment. For an Alberta Custodian, Section 6.15 applies.

(f) Regulators. Transcribe Health will cooperate with any review, investigation, inspection, inquiry or order of the Information and Privacy Commissioner of Ontario, the Information and Privacy Commissioner of Alberta, the Information and Privacy Commissioner for British Columbia or the Privacy Commissioner of Canada that concerns Custodian Health Information, as required by law, and will provide the Custodian with information it holds that the Custodian reasonably needs to respond to such a matter. Transcribe Health bears its own costs of complying with its legal obligations. Other assistance the Custodian requests in connection with a regulator's matter, such as preparing submissions, attending meetings or producing analyses, is provided at no charge where the matter arises from a Privacy Breach or non-compliance caused by Transcribe Health, and otherwise under Section 4.18. Unless the law prohibits it, Transcribe Health will tell the Custodian promptly if a regulator contacts it about Custodian Health Information.

4.13 Demands from governments and courts

Section 7 of the DPA applies to any demand for Custodian Health Information. Transcribe Health discloses Custodian Health Information in response to a subpoena, warrant or order only where it is legally binding on Transcribe Health in Canada, discloses only what the demand requires, and, unless the law prohibits it, first notifies the Custodian so that it can respond or object. For an Alberta Custodian, Transcribe Health will not disclose health information to which the HIA applies in response to a subpoena, warrant or order issued or made by a court, person or body having no jurisdiction in Alberta to compel the production of information, or under a rule of court that is not binding in Alberta, as HIA section 107(5.1) provides. Transcribe Health does not disclose Custodian Health Information in response to a demand from a court or authority outside Canada unless a Canadian court orders it to.

4.14 Return and destruction at the end of the term

(a) Export Window. When the term ends, the Customer has thirty (30) days (the "Export Window") to export its Custodian Health Information. Transcribe Health opens the closure of the Customer's organization in the Services within five (5) business days after the Customer's subscription or the Terms of Service end for any reason, and immediately when an owner deletes the Customer's organization in the Services' settings, which is treated as a closure by the Customer. The Export Window begins when Transcribe Health opens the closure and sends the Customer's owners and administrators written notice stating the date the Export Window ends; if no owner or administrator can be reached, Transcribe Health also sends the notice to the Customer's privacy contact and does not begin destruction until at least thirty (30) days after it has sent it. During the Export Window, owners and administrators who have access to all of the clinic's records can create the Services' records archive, which contains the Custodian's records, including visits, transcripts, notes and their earlier versions, letters, forms, faxes, patient messages and the recordings still held, in commonly used, machine-readable formats with a manifest and checksums. The archive does not include Dorvi and Ask conversations or dictation text. On written request made during the Export Window, Transcribe Health will use reasonable efforts to provide, within the Export Window or within fifteen (15) business days of the request if later, any Custodian Health Information held in the Services that the archive does not include, other than audio already deleted under the retention settings. If the Customer's users no longer have access to the Services, including after an owner deleted the organization, the Customer may write to support@transcribe.health during the Export Window to ask Transcribe Health to restore its owners' access for export or to cancel the closure. A format other than the standard archive can be agreed in writing, and is charged under Section 4.18 if it requires custom work.

(b) Records of access. On request made before the end of the Export Window, Transcribe Health will provide the Customer, within fifteen (15) business days of the request and in any case before destruction, with a copy of the audit log entries relating to its Custodian Health Information, with patients' names shown where the Services hold them, and the records of AI input described in Section 4.8(d), so that the Customer can keep them. For a Customer located in Alberta, Transcribe Health provides these records before destruction under Section 4.14(c) whether or not they are requested.

(c) Destruction. After the Export Window, Transcribe Health destroys all Custodian Health Information from active systems within thirty (30) days by deleting it from the Services' databases and file storage, and residual copies on encrypted backup storage expire within ninety (90) days after the end of the Export Window. If a subscription for the Customer is back in force when destruction would begin, Transcribe Health asks the Customer before continuing. No retention period in the DPA, the Terms of Service or the Privacy Policy authorizes Transcribe Health to keep Custodian Health Information after the Export Window. The Customer's acceptance of this Schedule D is its express written consent to destruction on this schedule.

(d) Certificate. When destruction from active systems is complete, Transcribe Health provides the Customer with a written certificate of destruction stating what was destroyed and when, together with a written statement of the date by which backup copies expire and confirmation that Transcribe Health has not instructed any Subcontractor to keep Custodian Health Information. The certificate is available to the Customer's owners and administrators in the Services or, where they no longer have access, is sent to them by email. On request, Transcribe Health confirms in writing when backup copies have expired.

(e) Records kept after destruction. After destruction, Transcribe Health keeps only the following records: audit-log entries, which contain identifiers and metadata but no clinical content; records of AI input; records of Privacy Breaches and privacy requests, which may identify the individuals concerned; the certificate of destruction; billing and AI usage records, which contain no Custodian Health Information; the record of agreements accepted; and the minimal account record needed to link them. It keeps the records that relate to Custodian Health Information on the Custodian's behalf and under its control, only for the Custodian's purposes of audit, responding to access requests and complaints and regulatory reporting, and for Transcribe Health's legal obligations, for the periods in Section 4.8(a) and Section 4.9(d), and then destroys them. On the Custodian's written request at any time, Transcribe Health returns a copy of them within fifteen (15) business days and, if the Custodian asks, then destroys its own copy, except records it must keep by law.

(f) Legal requirements. Section 4.6(e) applies to any Custodian Health Information that the law requires Transcribe Health to keep after the Export Window.

4.15 Sale, merger, insolvency and abandonment

(a) Transcribe Health may transfer Custodian Health Information to a successor in a merger, acquisition, reorganization or sale of its business only if the successor agrees in writing to be bound by this Schedule D. Transcribe Health will give the Customer at least thirty (30) days' written notice before the transfer, unless the law or a confidentiality obligation in the transaction prevents it, in which case it will give notice as soon as it is allowed. If the successor does not agree in writing to be bound by this Schedule D, the Customer may terminate the Services under Section 4.16(h), and Section 4.14 applies.

(b) If Transcribe Health becomes bankrupt or insolvent, or decides to stop providing the Services, it will, to the extent it remains able to do so, give the Customer notice and an Export Window under Section 4.14 and then destroy Custodian Health Information under Section 4.14, and it will tell any trustee, receiver or purchaser that Custodian Health Information is held on behalf of the Custodians, is not an asset of Transcribe Health, and must not be sold, assigned or used to satisfy any creditor.

(c) If Transcribe Health holds health information to which the HIA applies and cannot identify or locate the responsible Custodian, it will notify the Alberta Minister of Health as soon as practicable and follow the Minister's direction, as HIA section 60.2 contemplates for records whose custodian cannot be located.

4.16 Term, termination and remedies

(a) Term. This Schedule D takes effect when the Customer accepts it and remains in effect until Transcribe Health no longer holds any Custodian Health Information.

(b) Termination by the Customer. The Customer may end this Schedule D, with the Services, at any time by ending its subscription or deleting its organization in the Services, or under Section 12.1 of the Terms of Service. The Customer may also terminate on written notice, with immediate effect, if a regulator with jurisdiction orders or directs it in writing to stop using the Services, if a change in Applicable Health Privacy Law after the Customer accepted this Schedule D makes continued use of the Services unlawful for the Customer and Transcribe Health cannot offer a lawful alternative within thirty (30) days, or if Transcribe Health has not cured a material breach of this Schedule D within thirty (30) days of written notice describing the breach in reasonable detail.

(c) Termination by Transcribe Health. Transcribe Health may terminate this Schedule D only together with the Services, under Section 12.1 of the Terms of Service, or as Section 11 allows.

(d) Remedies for non-compliance. If Transcribe Health does not comply with this Schedule D, it will, at its own cost, promptly take the steps reasonably needed to stop and remedy the non-compliance and prevent recurrence, and tell the Custodian what it has done. The Custodian may also, as applicable: suspend its use of the affected Services; require the return or destruction of Custodian Health Information under Section 4.14 or Section 4.6(c); carry out an audit under Section 4.12(c); terminate under Section 4.16(b); seek an injunction or other interim relief under Section 4.16(e); and recover damages, subject to Section 1.3.

(e) Interim relief. Despite Section 13.2 of the Terms of Service, either party may apply to the Ontario Superior Court of Justice, sitting in Toronto, for an injunction or other interim relief to prevent or stop an unauthorized collection, use, disclosure or retention of Custodian Health Information, pending arbitration. All other claims are resolved under Section 13.2 of the Terms of Service.

(f) Survival. Sections 4.1, 4.3, 4.4, 4.5, 4.6(e), 4.7, 4.9, 4.10, 4.11(e), 4.13, 4.14 and 4.15, Section 5 and Section 6 survive for as long as Transcribe Health holds Custodian Health Information. Sections 4.1, 4.4, 4.8(a), 4.12(f), 4.13 and 4.14(e) apply to the records described in Section 4.14(e) for as long as Transcribe Health holds them. Sections 1.3, 4.16(d), (e), (g) and (h), 4.20 and 4.21 survive for two (2) years after this Schedule D ends, or longer where a claim was notified within that period.

(g) Suspension. If the Services are suspended for any reason, Transcribe Health will, within five (5) business days of the Custodian's written request, restore the access of the Customer's owners to the Services for the purpose of exporting Custodian Health Information and responding to requests from individuals, and will continue to perform Sections 4.7, 4.8, 4.9, 4.12(f) and 4.13. No amount owed to Transcribe Health is a condition of the Custodian's access to its Custodian Health Information for those purposes. This Section applies until the Services are terminated, after which Section 4.14 applies.

(h) Termination without penalty. Where this Schedule D allows the Customer to terminate "without penalty" or under this Section 4.16(h), the Customer may end the affected Services on written notice given before the relevant change takes effect, or, for a right under Section 4.16(b), within thirty (30) days after the event that gives rise to it, and it owes no early-termination charge or fees for periods after termination. Transcribe Health refunds prepaid fees for the unused part of the paid period of the terminated Services only where the Customer terminates under Section 4.5(e), 4.10(b), 4.15(a) or 11, or for Transcribe Health's uncured material breach. No other refund, credit or compensation is payable because of a termination under this Schedule D. Section 4.14 applies to any termination.

4.17 Custodian responsibilities

The Custodian represents that it will meet, and agrees to meet, the following responsibilities:

• (a) having the authority under Applicable Health Privacy Law to collect, use and disclose Custodian Health Information through the Services (Section 4.1 of the DPA and Section 17 of the Terms of Service);
• (b) giving patients any notice, and obtaining any consent, that the law or its regulatory college requires before recording a visit or using the Services, including express consent in British Columbia, written consent in Alberta where HIA section 23 applies, notice under HIA section 22(3)(d) of the intention to input information into an automated system, and notice under Alberta PIPA section 13.1 where it applies; asking any companion present at the visit separately; offering patients who decline the choice to be seen without recording; and recording consent or refusal in its own record. Annex B contains template wording that the Custodian may adapt; it is not legal advice;
• (c) applying any express instruction or expressed wish of a patient to withhold or withdraw consent, including an Ontario consent directive, before using or disclosing that patient's information through the Services;
• (d) permitting only its authorized staff and agents to use the Services, managing their accounts and permissions, and keeping its contacts directory and patient contact details accurate;
• (e) reviewing every AI output before relying on it, correcting it, and approving only what is accurate (Sections 6.2 and 6.3 of the DPA, Section 9.2 of the Terms of Service);
• (f) keeping its medical record in its own record system and transferring finalized outputs into it promptly;
• (g) configuring the Services in line with its own policies, including its retention settings, and turning on and keeping on the requirement that every user use multi-factor authentication (Section 4.4(c));
• (h) meeting its own record retention obligations, including those set by its regulatory college (such as the College of Physicians and Surgeons of Ontario, the College of Physicians and Surgeons of Alberta or the College of Physicians and Surgeons of British Columbia), BC PIPA section 35, HIA section 27.1(3) and HIA section 56.209, by keeping the records it needs in its own systems;
• (i) deciding whether, and giving, any notice of a Privacy Breach to individuals, regulators, the Alberta Minister of Health and any regulatory college, and any annual statistical report;
• (j) its own privacy impact assessments, privacy management program, and any arrangement among several custodians who share information through the Customer's organization in the Services, and keeping the list of Custodians under Section 1.4 current;
• (k) its own vendors, such as its fax provider and EHR, which act for the Custodian and are not Subcontractors (Section 4.6(b) of the DPA);
• (l) naming a privacy contact to receive notices under this Schedule D, by writing to privacy@transcribe.health, and keeping that contact current. Until it does, notices go to its owners and administrators in the Services;
• (m) giving Transcribe Health only instructions that comply with Applicable Health Privacy Law, and telling Transcribe Health promptly in writing of any consent directive, restriction or condition that affects how Transcribe Health may handle Custodian Health Information;
• (n) telling Transcribe Health promptly of any Privacy Breach the Custodian discovers that involves the Services;
• (o) giving organization-settings permission only to persons it authorizes to make the election in Section 4.5(d) and other organization-wide choices; and
• (p) choosing an organization name, and any reminder template wording, that is suitable to appear in messages to patients and reveals no clinical information.

Transcribe Health may rely on the Custodian's acceptance of this Schedule D, its configuration of the Services, its elections (including under Section 4.5(d)), its retention settings and deletions, and its written instructions as lawful and authorized. Transcribe Health is not responsible for, and is not in breach of this Schedule D because of, any collection, use or disclosure that results from the Custodian's or its users' acts, omissions or instructions, or from a failure of the Custodian to meet this Section 4.17. Section 10.2 of the DPA and Section 11.2 of the Terms of Service apply to third-party claims, including claims by patients and regulatory proceedings, arising from the Custodian's failure to meet Section 4.17(a), (b), (c) or (m).

4.18 Fees

Transcribe Health does not charge for carrying out its own duties under Applicable Health Privacy Law or for the following commitments in this Schedule D: Privacy Breach notice; records of access and of AI input; support for access and correction requests; erasure on request; return and destruction at the end of the term; the certificate of destruction; access for export during a suspension; the plain-language description and, for an Alberta Custodian, the technical annex in Section 6.15; information reasonably needed for a privacy impact assessment; the items in Section 4.12(b); the first audit in any twelve (12) months under Section 4.12(c); and cooperation with regulators as described in Section 4.12(f). Transcribe Health may charge under this Section for work that is manifestly excessive, repetitive or required because of the Custodian's own acts or omissions, after telling the Custodian. Work the Customer asks for beyond these commitments, such as additional audits, more than one questionnaire in twelve (12) months, customer-specific documents or assessments, or custom export formats, is charged at Transcribe Health's then-current professional services rates, under a written estimate that the Customer approves before the work starts.

4.19 Contacts and notices

Transcribe Health's person responsible for privacy is its Security Officer (currently Fatih Aktas), privacy@transcribe.health. Privacy Breaches and security matters: security@transcribe.health. AI output reports, export and closure requests: support@transcribe.health. Notices to Transcribe Health under this Schedule D are given in writing by email to privacy@transcribe.health or by mail to the address in Section 14 of the Terms of Service.

4.20 Confidentiality of security information

Information that Transcribe Health provides under Sections 4.4(b), 4.9, 4.11, 4.12 and 6.15, other than Annex A and information the law requires the Custodian to give to an individual, a regulator, the Alberta Minister of Health, a regulatory college or any other person to whom the law requires notice, is Transcribe Health's confidential information ("Security Information"). The Custodian and any auditor will use Security Information only to assess and monitor Transcribe Health's compliance and to meet the Custodian's legal obligations, will disclose it only to their personnel, advisers, insurers and regulators who need it and are bound by confidentiality, and will protect it with at least reasonable care. Nothing in this Section limits disclosure to the Information and Privacy Commissioner of Alberta or any other regulator. This Section survives for five (5) years after this Schedule D ends.

4.21 No third-party beneficiaries; delays outside a party's control

(a) This Schedule D is made only for the benefit of Transcribe Health and the Custodians that are parties to it. No patient or other person has any right to enforce it or to rely on it, and Annex A and Annex B are descriptions and templates, not promises to any individual. This does not affect any right an individual has under Applicable Health Privacy Law.

(b) A time limit in this Schedule D, other than the periods in Section 4.9(a), is extended for as long as, and to the extent that, performance is prevented or delayed by an event beyond Transcribe Health's reasonable control, such as a natural disaster, utility or telecommunications failure, failure of a third-party service, cyberattack despite reasonable safeguards, or government action, provided Transcribe Health tells the Custodian as soon as practicable and resumes performance as soon as it can. The unavailability or incapacity of any person, including the Security Officer, is not such an event. This Section never extends the twenty-four (24) hour and seventy-two (72) hour periods in Section 4.9(a), and never excuses Transcribe Health from maintaining the safeguards in Section 4.4 or from any duty under Applicable Health Privacy Law, including notice of a Privacy Breach at the first reasonable opportunity and as soon as practicable.

5.1 Role

For a Custodian that is a health information custodian under PHIPA, Transcribe Health acts as the Custodian's agent within the meaning of PHIPA section 2 and handles personal health information on the Custodian's behalf under PHIPA section 17. To the extent any feature of the Services only supplies electronic means for the Custodian to collect, use, modify, disclose, retain or dispose of personal health information, Transcribe Health also meets the requirements of O. Reg. 329/04 section 6(1) set out in Section 5.3.

5.2 Permitted handling and the Custodian's conditions

Transcribe Health collects, uses, discloses, retains and disposes of personal health information only where the Custodian is permitted to do so, only as necessary in the course of providing the Services, only as permitted by this Schedule D, and in compliance with any conditions or restrictions the Custodian imposes in writing under PHIPA section 17(1.1). If a condition or restriction would require a change to the Services, Transcribe Health will tell the Custodian within ten (10) business days whether it can comply. If it cannot, Transcribe Health will not handle the affected information contrary to the condition, and may for that reason suspend the affected feature for the Custodian. The Customer may then stop using the affected feature or, if the feature is material to its use of the Services, terminate the Services under Section 4.16(h). Fees for the Services are not reduced while a feature is suspended under this Section unless the parties agree otherwise. The Custodian remains responsible for personal health information handled by Transcribe Health on its behalf (PHIPA section 17(3)).

5.3 Restrictions corresponding to O. Reg. 329/04 section 6(1)

Except as otherwise required by law, Transcribe Health does not use personal health information to which it has access in providing the Services except as necessary in the course of providing them; does not disclose it except, where it acts as the Custodian's agent, as permitted by this Schedule D; and does not permit any employee or person acting on its behalf to have access to it unless that person has agreed to comply with these restrictions.

5.4 Health information network provider duties

Transcribe Health is not a health information network provider, because the Services are not provided primarily to enable custodians to disclose personal health information to one another, and O. Reg. 329/04 section 6(3) does not apply to it. For convenience, the following shows where this Schedule D addresses similar matters; this Section 5.4 creates no obligation beyond those Sections:

• (a) notice to the Custodian of unauthorized access, use, disclosure or disposal: Section 4.9;
• (b) a plain-language description of the Services and their safeguards, suitable for sharing with patients and made public: Annex A and Section 4.12(a);
• (c) records of access to, and transfers of, the Custodian's personal health information: Section 4.8;
• (d) an assessment of threats, vulnerabilities and risks and of privacy impact: Sections 4.4(b) and 4.12(b);
• (e) restrictions and conditions on third parties retained to assist in providing the Services: Sections 4.10 and 5.3; and
• (f) a description of the Services and of the administrative, technical and physical safeguards: this Schedule D and Annex A.

5.5 Notice to the Custodian

As required of an agent by PHIPA section 17(4)(b), Transcribe Health notifies the Custodian at the first reasonable opportunity if personal health information it handled on the Custodian's behalf is stolen or lost or is used or disclosed without authority, in the manner set out in Section 4.9. The Custodian gives any notice to individuals under PHIPA section 12(2) and to the Information and Privacy Commissioner of Ontario under PHIPA section 12(3) and O. Reg. 329/04 section 6.3.

5.6 Retention, transfer and disposal

Transcribe Health retains, transfers and disposes of personal health information in a secure manner, under Sections 4.6 and 4.14 and the Custodian's instructions, so that the Custodian can meet PHIPA section 13. Where the Custodian tells Transcribe Health that information is the subject of an access request under PHIPA section 53, Transcribe Health preserves it under Section 4.6(d).

5.7 Audit logs

PHIPA section 10.1 (electronic audit logs) is not yet in force. The audit log in Section 4.8 records, for access through the Services, the type of record, the date and time, the person, and the record concerned (and, for a patient record, the patient) by identifier, which is intended to support the Custodian when that section comes into force. Transcribe Health will tell the Custodian of any change needed once the requirements are known.

6.1 Agreement and role

For a Custodian that is a custodian under the HIA, this Schedule D, read with the provisions of the DPA it refers to, is the written agreement required by HIA section 66(2) and HIR section 7.2, and the written agreement required by HIR section 8(4). Transcribe Health is the Custodian's information manager because it processes, stores, retrieves and disposes of health information and provides information technology services that require the use of health information (HIA section 1(1)(p.1)). As an information manager it is an affiliate of the Custodian (HIA section 1(1)(a)(iv)). Transcribe Health complies with the HIA, the HIR and this agreement in respect of health information the Custodian provides to it (HIA section 66(5)), and uses and discloses that information only for the purposes this agreement authorizes (HIA section 66(4)). The Custodian remains responsible for compliance with the HIA in respect of that information (HIA section 66(6)). The HIA, and not PIPEDA, Alberta PIPA or United States law, governs the handling of health information to which the HIA applies.

6.2 Objectives and principles (HIR section 7.2(a))

The objective of this agreement is to enable the Custodian to use the Services to document clinical encounters and related care, to collect information from patients, to prepare and send clinical correspondence, and to manage practice communications, while the health information stays under the Custodian's control. The agreement is guided by these principles:

• (a) the Custodian decides the purposes for which health information is collected, used and disclosed, and Transcribe Health acts only on its instructions;
• (b) Transcribe Health handles only the amount of health information essential for each processing step, with the highest degree of anonymity possible, consistent with HIA sections 57 and 58;
• (c) health information is protected by the safeguards in Annex A and is never used for Transcribe Health's own purposes or to train AI (Section 4.1);
• (d) the Custodian can see how its information is handled, through the records in Section 4.8 and the monitoring in Sections 4.12 and 6.17; and
• (e) Transcribe Health is accountable to the Custodian for every person it engages.

6.3 Collection (HIR section 7.2(b))

Transcribe Health does not collect health information for itself. It is permitted to collect health information on the Custodian's behalf, and any such collection is collection by the Custodian (HIA section 62(3)), only through the features the Custodian uses, for the purpose of the Custodian's provision of health services and practice administration:

• (a) from patients and others present at a visit, by recording and transcribing the clinical encounter the Custodian chooses to record;
• (b) from patients, through Patient Forms the Custodian sends and online booking the Custodian enables (identification, contact and registration information, health history and screening answers, and consents and signatures, as described in Section 2.3 of the DPA);
• (c) from other custodians and other persons, only by receiving faxes into the Custodian's own fax account and reading them for the Custodian (diagnostic, treatment and care information about the Custodian's patients sent to the Custodian); and
• (d) from the Custodian's own EHR, to the extent a feature the Custodian uses reads information from it.

Transcribe Health does not otherwise seek to collect health information. Health information that an individual sends to Transcribe Health directly is handled under Section 4.7(c).

6.4 Use (HIR section 7.2(c))

Transcribe Health may use the health information described in Section 6.6 only to provide the Services under Section 4.1(a): to transcribe encounters, draft notes, letters, forms and other outputs for review, answer the Custodian's users' questions, calculate form scores, suggest patient matches for faxes, store and display information to the Custodian's authorized users, protect and secure the Services, and carry out the Custodian's written requests. Every other use is prohibited, including the uses in Section 4.1(b).

6.5 Disclosure (HIR section 7.2(d)) and HIA authorities

Transcribe Health may disclose health information only: to the Custodian and its authorized users; to Subcontractors under Sections 4.10 and 6.12A, to the extent each needs it for the purpose listed in Annex A, Section A5, and only as an affiliate of the Custodian performing the Custodian's information management services; to recipients the Custodian's authorized users approve through the Services (other providers by fax, the Custodian's EHR, and patients through secure messaging), which are disclosures by the Custodian (Section 4.6(c) of the DPA); to the Commissioner as required by law; and as otherwise required by an enactment of Alberta or Canada, subject to Section 4.13. Every other disclosure is prohibited.

The HIA authorities for the flows of health information under this agreement are:

Any collection, use or disclosure by Transcribe Health that is not authorized by this agreement and the HIA is prohibited and may be an offence under HIA section 107.

6.6 Health information covered

The health information covered by this agreement is diagnostic, treatment and care information and registration information within the meaning of HIA section 1, as spoken in a recorded encounter, entered by the Custodian's users, provided by patients through the Services, received by fax or taken from the Custodian's EHR. The categories are listed in Section 2.3 and Schedule A of the DPA, and include personal health numbers and other identifiers, contact details, symptoms, diagnoses, medications, treatment plans, mental health screening answers, and the notes, letters and forms generated from them.

6.7 Access requests (HIR section 7.2(e))

Transcribe Health does not respond to access requests under Part 2 of the HIA. It refers any access request it receives to the Custodian under Section 4.7(c), and supports the Custodian's response under Section 4.7(b), so that the Custodian can respond within the time limit in HIA section 12. This includes requests for access to the Custodian's record of AI input under HIA section 27.1(4), for which Transcribe Health provides the records it holds under Section 4.8(d).

6.8 Correction and amendment requests (HIR section 7.2(f))

Transcribe Health does not respond to requests to correct or amend health information under Part 2 of the HIA. It refers any such request it receives to the Custodian under Section 4.7(c). The Custodian makes corrections in the Services, or Transcribe Health makes the corrections or annotations the Custodian directs under Section 4.7(b)(ii). Transcribe Health does not modify health information except to provide the Services or on the Custodian's written instructions.

6.9 Protection, management, return and destruction (HIR section 7.2(g))

• (a) Protection. Health information is protected by the safeguards in Section 4.4 and Annex A, including access limited to what is necessary (Section 4.3), written confidentiality obligations, training on the duties in this agreement, and Subcontractor terms (Sections 4.10 and 6.12A). Where the Custodian gives Transcribe Health its written privacy and security policies, Transcribe Health follows them so far as they apply to its handling of the Custodian's information in the Services, so that it complies with the Custodian's privacy management program as HIA section 62(2)(b) requires. Within ten (10) business days, Transcribe Health tells the Custodian of any part it cannot follow without a change to the Services, and Section 5.2's process then applies with the necessary changes. Until Transcribe Health has confirmed that it can comply, the Custodian may suspend use of the affected feature, and Transcribe Health will not process the affected information through it while it is suspended. Transcribe Health acknowledges that it is an affiliate of the Custodian for the purposes of HIR section 8(6) and (7). It agrees that the Custodian's sanctions for affiliates may include suspension or termination of the Services, removal of any Transcribe Health person's access to the Custodian's information, a report to the Commissioner, and the remedies in Section 4.16(d), and that a knowing breach of this agreement by an information manager may be an offence under HIA section 107(4).
• (b) Management. Health information is retained and managed under Section 4.6, and no health information is copied, retained or destroyed except as Section 4.6(b) permits.
• (c) Return and destruction. On termination, health information is returned and destroyed under Section 4.14. After that, Transcribe Health keeps no copy of it, other than residual backup copies until they expire under Section 4.14(c), information it must keep by law under Section 4.6(e), and the records described in Section 4.14(e), which it keeps on the Custodian's behalf and which the Custodian consents to by accepting this agreement.
• (d) Breach notice. As an affiliate, Transcribe Health notifies the Custodian as soon as practicable, under Section 4.9, of any loss of, or unauthorized access to or disclosure of, individually identifying health information in the Custodian's custody or control (HIA section 60.1(1)). As HIR section 8.2(1) requires, the notice meets any requirements respecting form and contents that the Custodian has established and given to Transcribe Health in writing, and otherwise is in writing and includes the information that section requires. The Custodian assesses the risk of harm and gives any notice to the Commissioner, the Minister and affected individuals under HIA section 60.1(2).

6.10 Expressed wishes about disclosure (HIR section 7.2(h))

Transcribe Health does not itself decide on disclosures. It refers to the Custodian, under Section 4.7(c), any expressed wish of an individual about the disclosure of their health information that it receives. The Custodian applies an individual's expressed wishes before any disclosure is approved through the Services (Section 4.17(c)), and considers them as HIA sections 58(2) and 56.206 require.

6.11 Termination (HIR section 7.2(i))

This agreement may be terminated as set out in Section 4.16, and Section 4.14 then applies.

6.12 Health information stored or used outside Alberta (HIR section 8(4))

Health information is stored and used outside Alberta as follows: it is stored and processed in Ontario by Transcribe Health; it is processed for AI inference in Quebec by Google LLC (Vertex AI, Montréal region); connections that carry it are decrypted transiently by Cloudflare at the Cloudflare location nearest the user or patient, which is normally in Canada and otherwise in the country of the Cloudflare data centre nearest the user (Sections 4.5(c)(i) and 6.16); email the Services send to patients is delivered from Quebec by Amazon Web Services Canada, Inc. (Amazon Simple Email Service, Montréal region), which may hold an email briefly while delivering it (Section 4.5(c)(ii)); and, only if the Custodian makes the election in Section 4.5(d) under Section 6.17(a), it is processed for AI inference in the United States. For that storage and use, this agreement:

• (a) provides for the Custodian to retain control over the health information (Sections 3.1, 4.1, 4.6, 4.7 and 4.14);
• (b) addresses the risks of storage and use outside Alberta, which are described in Annex A, Section A6, through the safeguards in Annex A, the limits in Section 4.5, and the commitment in Section 4.13 not to disclose health information under orders not binding in Alberta;
• (c) requires Transcribe Health and its Subcontractors to implement and maintain adequate safeguards (Sections 4.4, 4.10 and 6.12A);
• (d) allows the Custodian to monitor compliance (Sections 4.8, 4.12 and 6.17); and
• (e) contains remedies for non-compliance and breach (Section 4.16(d) and (e)).

Transcribe Health is responsible under this agreement for storage and use outside Alberta by its Subcontractors as for its own.

6.12A Subcontractors outside Alberta

Each Subcontractor that stores or uses health information outside Alberta (Google LLC, Cloudflare, Inc. and Amazon Web Services Canada, Inc., as listed in Annex A, Section A5) does so under written terms with Transcribe Health that Transcribe Health has reviewed under Section 4.10(a). Those terms are generally the Subcontractor's standard terms. They are made with Transcribe Health, not with the Custodian, and they do not necessarily contain each of the items in HIR section 8(4) in the same words as this agreement. Transcribe Health therefore:

• (a) is responsible to the Custodian, under this agreement, for each such Subcontractor's storage and use of health information as for its own (Sections 4.10(a) and 6.12);
• (b) does not instruct any such Subcontractor to store health information, and limits what each receives to what Annex A, Section A5 describes;
• (c) enforces its rights under those terms where a Subcontractor's handling of health information does not comply with them, and tells the Custodian what it has done;
• (d) on request, before or after the Custodian accepts this agreement, provides within fifteen (15) business days a summary of the relevant terms of each such Subcontractor, so that the Custodian can assess them and record its assessment in its privacy impact assessment; and
• (e) describes the remaining risks of this arrangement in Annex A, Section A6.

6.13 Automated systems (HIA sections 22(3)(d), 27(1.1) and 27.1)

The AI features of the Services are an "automated system" under HIA section 1(1)(c.3). The Services do not keep an electronic log of each input that would, by itself, meet HIA section 27.1(2). The Custodian therefore keeps the record that HIA section 27.1(1) requires, for example by noting in its own record, for each visit, Dorvi or Ask question about a patient, fax read by the AI features and form filled by them, the date, the purpose and the type of information used, and keeps it for at least one year as HIA section 27.1(3) requires. Transcribe Health supports the Custodian's duties by: providing the records it holds under Section 4.8(d); describing in Annex A what information is input and why; and giving the notice in Section 4.11(c) of changes to the automated system. The Custodian gives the notice under HIA section 22(3)(d). Transcribe Health does not use health information to build or train any automated system (Section 4.1(b)).

6.14 Custodians who share information

Where several custodians practise through the Customer's organization and have access to each other's patients' information in the Services, that information may be shared health information under Part 5.1 of the HIA. The custodians are responsible for their privacy impact assessment under HIA section 56.204 and their arrangements among themselves. Transcribe Health supports their electronic log duty under HIA section 56.209 through the audit log and reports in Section 4.8, which it keeps for at least ten (10) years, and through the records it provides with patients' names under Section 4.14(b). Section 4.8(a) describes what the audit log does not yet record. The Services are not the Alberta EHR and Transcribe Health does not make health information accessible to any custodian outside the Customer's organization.

6.15 Information security description, technical annex and changes to the Services

Transcribe Health has not submitted an information security policy to the Commissioner under HIA section 64.2(2). Annex A is the plain-language description of the functions, capabilities and safeguards of the Services. In addition, Transcribe Health provides to each Alberta Custodian, without request and before the Custodian first uses the Services, a privacy impact assessment technical annex that meets HIA section 64.2(3) and (6): a data-flow diagram for each feature; the components and their hosting; whether each model is static; encryption, key management, authentication and session controls; how each feature can be turned off for the Custodian; and the controls that file outputs to the correct patient in the Custodian's EHR. Transcribe Health keeps the annex current under Section 4.12(a). Security-sensitive details may be marked as Security Information under Section 4.20 but may not be withheld from the Custodian or the Commissioner. If Transcribe Health later submits an information security policy and the Commissioner comments on it, Transcribe Health will provide those comments to the Custodian on request (HIA section 64.2(4)).

Section 4.11(c) governs notice of changes. For an Alberta Custodian, Transcribe Health gives that notice at least thirty (30) days before any change that changes how health information is collected, used or disclosed, so that the Custodian can prepare and submit an amended privacy impact assessment to the Commissioner as HIA section 64(1)(b) requires. The change takes effect for the Custodian thirty (30) days after the notice. If the Custodian has not completed its assessment by then, its remedy is to opt out of, or suspend its use of, the affected feature, where the Services allow that, or to terminate the affected Services under Section 4.16(h) before the change takes effect. A new AI capability remains subject to Section 4.11(c), under which it is available to the Customer only when it is turned on or requested. Where an urgent change is needed to protect health information, Transcribe Health gives notice as soon as practicable.

6.16 Alberta PIPA organizations

For a Customer in Alberta that is an organization under Alberta PIPA rather than a custodian under the HIA, Transcribe Health is a service provider acting on the Customer's behalf, and Section 4 applies. The service providers that may collect, use, disclose or store personal information outside Canada are: Cloudflare, Inc., which decrypts connections transiently at the Cloudflare data centre nearest the user or patient: in Canada normally; otherwise in the country of the Cloudflare data centre nearest the user, which may be the United States or another country, namely any country in which Cloudflare operates a data centre (list at https://www.cloudflare.com/network/) (Section 4.5(c)(i)); and, if the Customer makes the election in Section 4.5(d), Google LLC, in the United States (AI inference). The Customer gives the notice required by Alberta PIPA section 13.1 and includes the information required by section 6(2) in its policies; Annex A, Section A5 lists the countries and purposes. Section 6.17(a) governs the election in Section 4.5(d). Transcribe Health notifies the Customer of a Privacy Breach under Section 4.9 so that the Customer can notify the Commissioner without unreasonable delay under Alberta PIPA section 34.1.

6.17 Additional Alberta terms

• (a) Cross-border election. For an Alberta Customer, the election in Section 4.5(d) may be made only by an owner or administrator of the Customer who confirms in the Services that the Custodian has prepared and submitted its amended privacy impact assessment to the Information and Privacy Commissioner of Alberta (for an Alberta PIPA organization, that its section 13.1 notice covers the election) and, where Section 1.4 applies, who is the Custodian or its identified representative. Until the Services offer that confirmation step, an Alberta Customer makes the election only by written request to privacy@transcribe.health containing that confirmation, the Security Officer sets it, and the Customer must not use the setting in the Services. Transcribe Health checks the cross-border setting of each Alberta Customer at least once each business day. If an election is recorded without the confirmation this Section requires, Transcribe Health may suspend it, and will do so on the Custodian's request, and tells the Customer's privacy contact and owners that it has done so. That suspension is not a change under Section 11.
• (b) Inspection. Once in each twelve (12) months, an Alberta Custodian may also, on reasonable grounds stated in writing and on at least thirty (30) days' notice, inspect the site described in Section 4.5(a), despite Section 3.8 of the DPA, subject to the conditions in Section 4.12(c) other than its limits on on-site audits. Transcribe Health may instead arrange the inspection by an independent inspector the Custodian approves, acting reasonably, or by live video, with the inspector's report given to the Custodian. Each party bears its own costs.

A1. What the Services do

Transcribe Health is an AI platform for clinics. With the Customer's choice of features, it:

• records a visit (in the web app, the desktop app or the Chrome extension) and turns the recording into a written transcript;
• drafts a clinical note from the transcript for the clinician to review, edit and approve;
• lets the clinic send patients intake, consent and screening forms and receive the answers;
• through Dorvi, the AI assistant, answers clinicians' questions with citations to published literature, and drafts follow-up items such as patient instructions, referral letters and replies, which a clinic user must approve before anything is sent;
• sends approved documents through the clinic's own fax account, to the clinic's EHR, or to patients by secure message, and reads faxes the clinic receives; and
• supports scheduling and patient messaging by email and secure message.

Phone and text-message (SMS) features, including Dorvi's phone line, are not enabled for clinics covered by Schedule D.

Clinic users can choose to share Dorvi skills (instructions they write, not patient information) with other clinics. Each skill is screened for patient information and reviewed before it is shared.

The Services are not the clinic's medical record. Clinicians copy finished notes into their own record system.

A2. Where information is kept and processed

• Stored information, including the databases, files and backups, is kept in Ontario on servers owned by Transcribe Health or its owner and operated by Transcribe Health, at a single site. Backups are kept on a separate backup server at the same site; the Services do not currently keep a copy at a second site. The Services are not the clinic's medical record, and the clinic keeps its record in its own system.
• Speech-to-text runs on Transcribe Health's own servers in Ontario. Visit and dictation audio does not leave Canada.
• Note drafting and other AI features run on Google Cloud Vertex AI in Montréal, Quebec, or on an AI model Transcribe Health runs on its own servers in Ontario. Google may hold requests in its cache for up to 24 hours, as described in Section A5.
• Network traffic passes through Cloudflare, which decrypts and inspects each connection at the Cloudflare location nearest the user or patient, holds its content only in memory while passing it on, and does not cache or store clinic information. For users and patients in Canada that location is normally in Canada; otherwise it is in the country of the Cloudflare data centre nearest the user, which may be the United States or another country (Section A5).
• Emails from the Services, including form links and reminders to patients, are sent through Amazon Simple Email Service in Montréal, Quebec, as described in Section A5. Emails to patients name the practice and contain a link; the clinician, date, time and location of a visit are shown only after the patient follows the link.
• AI processing in the United States happens only if the clinic chooses to turn on enhanced cross-border AI.

A3. The artificial intelligence the Services use

How it works and its limits:

• The models are pre-trained. Transcribe Health does not train, fine-tune or improve them with any clinic's information, and the AI providers' terms do not permit them to train on it. Google may hold requests in its cache for up to 24 hours, and may log prompts for abuse monitoring as its terms allow, unless Transcribe Health has told the clinic that these are turned off.
• AI drafts can be wrong. They may omit things that were said, include things that were not said, attribute statements to the wrong speaker, mishear names, drug names or doses, or misread a fax. Every draft must be reviewed and corrected by a qualified clinic user before it is relied on. Dorvi drafts with clinical content, such as patient instructions, letters, forms and message replies, can only be approved by a user the clinic has marked as a licensed clinician. Visit notes are finalized by the clinic users the clinic permits to edit visits.
• The AI does not make decisions about patients. Urgent-message flags combine a fixed list of warning phrases with the AI's own assessment. Risk flags on Dorvi drafts are suggested by the AI. Either way, a person must act; the AI does not act on a flag itself.
• Clinics can report inaccurate output to support@transcribe.health. Transcribe Health evaluates the AI features with synthetic and public test encounters, never clinic information, and announces material AI changes, as set out in Section 4.11 of Schedule D.

A4. Safeguards

Administrative

• A designated Security Officer is responsible for privacy and security. At the date of this Annex, the Security Officer is the only person at Transcribe Health with access to clinic information.
• Written confidentiality obligations, privacy and security training before access and each calendar year, documented security policies, a written incident response plan, and an annual risk assessment.
• Written terms with each Subcontractor that handles clinic information.

Technical

• Connections to the Services are encrypted in transit (TLS 1.2 or higher). Connections from the Services' components to the database, cache and file storage are also encrypted.
• Stored files, such as audio and documents, are encrypted at rest by the storage system (AES-256, with a unique key for each object), on encrypted disks. Patient form answers, signatures and completed forms are also encrypted at rest with a key specific to the clinic. Backup storage is encrypted at rest (AES-256); its keys are currently held on the same backup system. Transcript and note text in the database is not separately encrypted by the application.
• Audio that the Chrome extension or web app holds on the user's device while waiting to upload is encrypted on that device.
• Each clinic's information is separated by organization access checks built into the application. Clinics share the underlying database.
• Role- and permission-based access for clinic users. The clinic can require every user to use multi-factor authentication; a user is not asked for the second factor again on a device they have marked as trusted, for up to 30 days.
• Audit logging as described in Section A7. Changes made directly to the database are also logged automatically. Security monitoring and alerting.

Physical

• Servers are owned by Transcribe Health or its owner and are kept in a locked room or cabinet at a single site in Ontario. Only the Security Officer has physical access. The site has physical security and power-protection measures.

A5. Subcontractors and other service providers

Other providers: Stripe (billing) and GitHub (source code) receive no clinic health information. Operational alerts go to Discord and FlareWarden and are not intended to contain health information. If the clinic's users use Transcribe Health's mobile app, the app sends crash and error reports to Sentry (United States) with free text removed before sending. Twilio (SMS and phone) is not enabled for clinics covered by Schedule D. The clinic's own fax provider and EHR act for the clinic and are not Transcribe Health's Subcontractors.

A6. Risks of storage and use outside the clinic's province, and how they are addressed

• Legal access by other governments. Google, Cloudflare and Anthropic are United States companies, and Amazon Web Services Canada, Inc. is a subsidiary of one; each may be subject to United States legal demands. This is addressed by sending them only what each task needs, by their data processing terms, by keeping all stored information with Transcribe Health in Ontario, and by Section 4.13 of Schedule D, which binds Transcribe Health. Those providers are not parties to Schedule D and their terms are their standard terms, not terms made with the clinic (Section 6.12A of Schedule D).
• Transient processing outside the province, and possibly outside Canada. Cloudflare decrypts each connection at its location nearest the user or patient. For users and patients in Canada this is normally in Canada; otherwise it is the country of the Cloudflare data centre nearest them, which may be the United States or another country, where the content is briefly in readable form in Cloudflare's memory. This is addressed by Cloudflare holding the content only in memory to pass it on, by excluding pages and API responses that contain patient information from caching, by encryption on both sides of Cloudflare, and by Cloudflare's data processing terms. Transcribe Health plans to replace this with a connection that is decrypted only in Canada.
• Short-lived copies held by providers. Amazon Simple Email Service holds emails briefly in Montréal, Quebec, while delivering them, Cloudflare holds connection content in memory while passing it on, and Google may cache AI requests for up to 24 hours, in memory or encrypted on disk in Montréal. These copies are outside Transcribe Health's direct control.
• Notice from providers. Google, Cloudflare and Amazon Web Services commit to tell Transcribe Health of a security incident affecting the clinic's information without undue delay, but not within a fixed number of hours. The 24-hour and 72-hour periods in Section 4.9(a) of Schedule D run from when Transcribe Health first knows, or by exercising reasonable diligence would have known, of the facts, so a provider's delay in telling Transcribe Health can delay the clinic's notice. This is addressed by each provider's written commitment to notify and cooperate, and by Transcribe Health passing on what a provider reports within the Section 4.9 periods without waiting for the provider's investigation to finish.
• Interception in transit. Addressed by encryption in transit on every connection.
• Loss of control. Addressed by the clinic's control over retention, export and deletion, and by the return and destruction terms of Schedule D.
• Single site. All stored information and its backups are at one site. A disaster affecting that site could cause loss of information held in the Services, including audit logs. The clinic keeps its medical record in its own system.
• Different privacy laws. The clinic's provincial law continues to govern the clinic's duties for the information. Transcribe Health is bound by Schedule D wherever the information is handled, and holds each Subcontractor to written terms that limit its use of the information and require it to protect it.

A7. Logs and the clinic's access to them

• The audit log records access to clinic information through the Services and Transcribe Health's administrative tools, including views of visits, notes, patients, conversations and forms, list and search views, exports, changes and deletions. Views of a transcript on its own, and of the appointment schedule, are not yet recorded. Each entry records who acted, the record (and, for a patient record, the patient) by identifier, the type of action and record, and the date and time. It does not record clinical content.
• The log is sealed in a cryptographic chain that is anchored daily to write-once storage and checked, so that any alteration or deletion can be detected.
• Entries are kept for at least six years (ten years for Alberta clinics) and are then destroyed within twelve months, unless the clinic asks in writing for them to be returned or kept longer or the law requires them to be kept.
• Clinic users with audit permission can review the log in the Services, under Organization settings, Auditing. Reports for a patient or period, and the records of AI input, are available on request (Section 4.8 of Schedule D).
• Direct infrastructure access by Transcribe Health's Security Officer is recorded in a written access register, as described in Section 4.3(d) of Schedule D.

A8. Retention and deletion

Current default settings (the same for every clinic today; the clinic can shorten them):

Planned Canadian default settings. Transcribe Health plans to change the defaults for clinics in Canada to the following. It will give at least 30 days' written notice before the change takes effect, and the change will apply to information that already exists only from that date:

• visit audio: deleted when the note is finalized, or 30 days after recording, whichever comes first;
• transcript: deleted 30 days after the note is finalized;
• a visit whose note is never finalized: its recording, transcript and draft note are deleted 30 days after the visit is created, and the clinic is warned 7 days before;
• notes: kept until the clinic asks for them to be erased (Section 4.6(c) of Schedule D) or the contract ends.

End of the contract. The clinic has 30 days to export, starting when Transcribe Health opens the closure and sends written notice of the date the export window ends. Information is then destroyed from active systems within the following 30 days, backup copies expire within 90 days after the export window, and the clinic receives a certificate of destruction (Section 4.14 of Schedule D).

B1. Short notice (poster, website or intake form)

We use an AI scribe. With your permission, [Clinic name] records your visit and uses Transcribe Health, an AI service, to write a draft of your visit note. Your clinician reviews and corrects the note before it goes into your medical record, because AI can make mistakes. The recording and draft are used only to prepare your care records. They are stored in Ontario, Canada, and processed by AI services in Ontario and Quebec[, and may be processed by AI services in the United States]. Our emails to you are sent through a provider in Quebec, Canada, and a network security service briefly handles information passing over the internet, normally in Canada but sometimes in the United States or another country. Your information is not used to train AI. [The recording is deleted 90 days after your visit is transcribed. The transcript is kept by Transcribe Health for up to 7 years, and your visit note until we ask for it to be erased or our contract with Transcribe Health ends. / The recording, transcript and note are deleted [X hours / X days] after your visit.] You can say no at any time and your care will not be affected. Anyone with you is asked separately. Ask us if you have questions: [contact name or title, phone, email].

[Alberta: We collect this information under sections 20(b) and 27(1)(a) of the Health Information Act to provide you with health services, and we will enter it into an automated system (artificial intelligence) for this purpose. Questions: [title], [business address], [business phone].]

B2. Verbal consent script (Ontario and British Columbia)

"I'd like to use an AI tool from a company called Transcribe Health to help write my notes today. It records our conversation, turns it into text and drafts a note, which I check and correct before it goes in your chart. The recording and text are stored in Ontario and processed by AI in Ontario and Quebec[, and possibly the United States]. Our emails are sent through a provider in Quebec, and a network security service briefly handles the data in transit, sometimes in the United States or another country. The AI can make mistakes, which is why I review everything. [The recording is deleted 90 days after it is transcribed. The transcript is kept for up to 7 years, and the note until we ask for it to be erased or our contract ends. / The recording, transcript and note are deleted [X hours / X days] after the visit.] Nothing is used to train AI. Is that okay with you[, and with anyone here with you]? You can say no or ask me to stop at any time, and it won't affect your care."

Record in the chart: the date, that the patient (and any companion) was informed, and whether they agreed or declined.

B3. Written consent form (Alberta, where HIA section 23 applies, and any province where the clinic chooses written consent)

Consent to record my visit using an AI scribe

[Clinic name] asks to record my visit using a device that I may not be able to see, and to use Transcribe Health, an AI service, to draft notes from the recording. I understand that:

• the recording and the draft note are used only to prepare my health records, and my clinician reviews and corrects the note because AI can make mistakes;
• my information will be entered into an automated system (artificial intelligence) for this purpose;
• my information is stored in Ontario and processed in Ontario and Quebec[, and may be processed in the United States]; emails are sent through a provider in Quebec, Canada; and a network security service briefly handles my information as it passes over the internet, normally in Canada but sometimes in the United States or another country;
• [the recording is deleted 90 days after it is transcribed; the transcript is kept for up to 7 years, and the note until the clinic asks for it to be erased or its contract with Transcribe Health ends / the recording, transcript and note are deleted [X hours / X days] after the visit;]
• my information is not used to train AI;
• I can refuse or withdraw this consent at any time without affecting my care.

[Alberta: This information is collected under sections 20(b) and 27(1)(a) of the Health Information Act to provide me with health services.]

The person who can answer my questions about this is [title], [business address], [business phone].

I consent / I do not consent (circle one).

Name: ____________ Signature: ____________ Date: ____________

B4. Alberta PIPA organizations: service providers outside Canada

We use service providers outside Canada: a network security provider briefly handles information passing between you and our systems, normally in Canada and otherwise in the United States or another country where it operates a data centre; [and, because we have turned it on, a provider in the United States processes some AI requests]. You can get written information about our policies and practices for service providers outside Canada, and ask questions about how they handle your personal information, by contacting [name or title] at [contact details].