Data Processing Agreement

2.1. Purpose Limitation

Transcribe Health processes Personal Information solely for the purpose of providing the Services described in the Terms of Service. This processing is limited to: (a) receiving and temporarily storing audio recordings of healthcare consultations; (b) transcribing audio recordings into text using artificial intelligence; (c) generating clinical documentation from transcriptions; (d) storing transcriptions and generated documents for the retention period configured by the Customer; (e) operating Dorvi, our AI assistant, through its standalone chat feature, which receives clinical questions submitted by Authorized Users (which may include patient context), retrieves relevant excerpts from public medical literature sources, generates AI-authored answers with literature citations, persists the resulting conversations server-side, supplies prior messages within a conversation to the AI provider as context for subsequent turns, and, where the Customer has turned on conversation links, hosts a copy of a conversation without patient information that an Authorized User chooses to share under Section 4.6(e); (f) operating Patient Forms on the Customer's behalf: hosting the form builder and the Customer's published form versions, sending form links to patients through the Services' patient messaging channels, verifying the patient's date of birth before a form is shown, collecting and storing the patient's answers, drafts, signatures and completed PDFs, calculating scores and flags, making responses available to the Customer's Authorized Users, and, where a form is linked to a visit, including its answers and scores in the context used to generate that visit's clinical documentation; (g) operating Dorvi's next steps: generating suggested follow-up actions and drafts from a visit's transcript, note and patient record (such as patient instructions, referral, clinical and prior authorization letters, filled PDF forms, staff tasks, booking invitations and replies to patient messages), showing the cited source passages, recording the review, edits, approvals and dismissals of the Customer's Authorized Users, and carrying out only the actions an Authorized User approves; (h) on the Customer's instruction, delivering approved documents and messages through the Customer's own fax account, the Customer's connected EHR, or the Services' secure patient messaging, and retrieving, reading, classifying and summarizing faxes the Customer receives through its own fax account and suggesting a patient match for the Customer to confirm; and (i) operating Ask, which answers Authorized Users' questions about a visit or a patient using the visit record, published literature, clinical guidelines and the Customer's knowledge-base documents, and proposes edits to the note that the Authorized User accepts or rejects.

Transcribe Health shall not process Personal Information for any purpose other than those specified in this Agreement and the Terms of Service, unless required to do so by applicable law. In such a case, Transcribe Health shall inform the Customer of that legal requirement before processing, unless the law prohibits such notification on important grounds of public interest.

2.2. Nature of the Processing

The processing consists of automated transcription of audio recordings containing doctor-patient consultations using artificial intelligence models, storage of audio files, persistent storage of transcription text, and generation of structured clinical notes. By default, and regardless of any optional retention policy, audio recordings are automatically and permanently deleted ninety (90) days after transcription is completed, and transcript and session records are retained for seven (7) years (subject to a six-year HIPAA minimum) and then automatically deleted. These default windows apply to every Customer organization and are enforced automatically by the platform. Separately, the Customer may optionally enable an earlier automatic-deletion policy, configurable in 1-day to 30-day windows and disabled by default; when enabled, it deletes Content earlier than the default windows.

The processing also includes operation of the standalone Dorvi chat feature. For each user turn, the Customer's Authorized User submits a free-text clinical question (which may contain Personal Information about a patient if the user chooses to include such context); Transcribe Health retrieves relevant excerpts from public medical literature sources; the question, retrieved excerpts, and prior messages from the same conversation are transmitted to a contracted AI sub-processor under zero-retention terms for inference; and the AI-generated response together with its literature citations is returned to the user and persisted in Transcribe Health's Canadian infrastructure. Dorvi conversations are scoped to a single Authorized User within a single Customer organization. Transcribe Health does not combine their content across users, conversations, or organizations, and does not make it available to other users or other organizations. An Authorized User may choose to create a link to a conversation that contains no patient information, as set out in Section 4.6(e); a conversation that contains patient information, including Protected Health Information, cannot be shared. Dorvi conversations persist until the Authorized User deletes them, the Customer deletes the user's account, or the Customer terminates the Agreement.

Retrieval of literature citations relies on a local index of de-identified literature metadata hosted inside Transcribe Health's Canadian infrastructure (queried using the raw user question, which does not leave Transcribe Health's infrastructure) and on parallel calls to public, non-PHI-receiving medical-research APIs. External calls carry only PHI-scrubbed query variants derived from the user's question (for example, a generic drug name or symptom phrase); they do not carry user identifiers, organization identifiers, conversation identifiers, patient identifiers, or any other Personal Information. Because no Personal Information is transmitted to these public research APIs, they are public data sources rather than Sub-processors of Personal Information under this Agreement and are therefore not listed in Schedule C.

Where the Customer's Authorized Users install the Transcribe Health Medical Scribe Chrome extension, the processing additionally includes a browser-side capture path. The Extension captures consultation audio in the browser and, before any data leaves the user's device, encrypts that audio using a per-session symmetric key generated and scoped client-side to the active browser session. The Extension transmits ciphertext (not plaintext audio) to Transcribe Health's backend; the backend decrypts the audio only inside Transcribe Health's Canadian processing environment for transcription and clinical-note generation, and the decrypted audio is then subject to the same retention rules described above. The Extension also generates non-content telemetry (a recording session identifier, the detected EHR system, the extension version, capture and insertion timestamps, and integrity hashes) used to maintain a tamper-evident audit log retained locally for a limited rolling window and mirrored to Transcribe Health's server-side audit log. The Extension introduces no new Sub-processor: it communicates only with Transcribe Health's existing Canadian backend, which then engages the Sub-processors listed in Schedule C on the same terms as the rest of the Services.

Where the Customer uses Patient Forms, the processing also includes collecting Personal Information directly from patients on the Customer's behalf. Each published form version is stored unchanged so the wording a patient saw can be shown later. A patient must confirm their date of birth before any form is displayed, and repeated failed attempts lock the link until the Customer reopens it. Answers are saved as encrypted drafts while the patient works and are replaced by the submitted response on submission. Answers, drafts, signer names, drawn signatures and completed PDFs are encrypted at rest under a key specific to the Customer's organization. Scores and flags are calculated by fixed rules on Transcribe Health's servers at submission, not by artificial intelligence. Form link messages identify only the Customer's practice and contain no patient name, form name or health information, and they are subject to the patient's messaging consent, opt-outs and the Customer's quiet hours. Where a form is linked to a visit, its answers and scores are included in the content sent for AI inference for that visit under Section 5.2 and the Customer's AI residency setting; Patient Forms introduces no new Sub-processor.

Where the Customer uses Dorvi, the processing also includes sending the relevant parts of a visit's transcript, note and patient record to a contracted AI Sub-processor under zero-retention terms to generate suggestions and drafts, storing the suggestions, drafts, cited passages and review history in Transcribe Health's Canadian infrastructure, and, after an Authorized User approves an action, rendering the document (for example as a PDF with the Customer's letterhead) and delivering it as the Authorized User directed. No action is carried out without an Authorized User's approval; there is no automatic sending mode. Fax credentials supplied by the Customer are stored encrypted and used only to send and retrieve the Customer's faxes. Ask conversations and proposed note edits are stored in Transcribe Health's Canadian infrastructure and are processed for AI inference on the same terms.

Transcribe Health also records, for each AI request, the Customer organization, the Authorized User (if any), the feature, the AI provider and model, and the cost, with no clinical content, to apply the Customer's AI allowance and budget and to bill AI usage beyond the allowance.

2.3. Categories of Personal Information

The Personal Information processed under this Agreement includes: patient names and identifiers mentioned during consultations; health information including symptoms, diagnoses, treatment plans, medications, and medical history discussed during consultations; healthcare provider names and professional identifiers; and any other personal information verbally communicated during recorded consultations.

Through the Dorvi chat feature, the categories of Personal Information further include: free-text questions and any patient context an Authorized User chooses to include in those questions (which may constitute Protected Health Information, including symptoms, diagnoses, treatments, medications, dates, ages, and other clinical details); the AI-generated answers returned in response, including any health information they reproduce or summarize; the literature citations and excerpts attached to those answers; conversation titles (typically authored by the user or auto-summarized from the first question); the ordered history of messages within a conversation; the identifier of the Authorized User who created the conversation; and timestamps.

Through Patient Forms, the categories of Personal Information further include whatever the Customer Form Content asks for, which may include: identification and contact details; date of birth (also used to verify the patient before a form is shown); health history, symptoms, medications, allergies and review-of-systems answers; answers to mental health screening instruments (such as the PHQ-9, PHQ-2 and GAD-7, including the PHQ-9 item on thoughts of self-harm) and the scores, severity bands and flags derived from them; consent statements accepted, signer names and drawn signatures; completed PDF forms; information about family members or other individuals that a patient chooses to provide; and security records of link access, date-of-birth checks, starts and submissions, together with one-way hashes of the IP address and user agent used to submit or sign.

Through Dorvi, the categories of Personal Information further include: the suggested actions, drafts and cited passages of the visit record; the letters, forms, instructions and messages an Authorized User approves, which may contain health information about the patient; recipient details taken from the Customer's contacts directory (names, organizations, fax numbers and addresses of other healthcare providers, laboratories, pharmacies and payers); patient contact details and messaging consent status used for delivery; faxes the Customer receives and the AI summary, document type and suggested patient match; Ask questions, answers, citations and proposed note edits; and the names of the Authorized Users who reviewed, approved or dismissed each action.

2.4. Categories of Data Subjects

Data Subjects whose Personal Information is processed under this Agreement include: patients whose healthcare consultations are recorded and transcribed; healthcare providers (physicians, nurses, specialists) who participate in recorded consultations; and other individuals whose information may be incidentally captured during recorded consultations.

Through Patient Forms, Data Subjects also include patients to whom the Customer sends forms, parents, guardians or other persons who fill in or sign a form on a patient's behalf, and individuals about whom a patient provides information in a form.

Through Dorvi, Data Subjects also include healthcare providers, payers and other recipients to whom the Customer sends letters or forms, and the senders of, and individuals described in, faxes the Customer receives.

3.1. Compliance with Instructions

Transcribe Health shall process Personal Information only on documented instructions from the Customer, including with regard to transfers of Personal Information outside of Canada. The Terms of Service, this Agreement, and the Customer's configuration of the Services constitute the Customer's complete instructions for the processing of Personal Information. Any additional or alternative instructions must be agreed upon separately in writing.

3.2. Confidentiality

Transcribe Health shall ensure that all persons authorized to process Personal Information have committed to confidentiality obligations or are under an appropriate statutory obligation of confidentiality. Access to Personal Information is restricted to personnel who require access to perform the Services, in accordance with the principle of least privilege.

3.3. Security Measures

Transcribe Health implements and maintains appropriate technical and organizational measures to protect Personal Information against unauthorized or unlawful processing, accidental loss, destruction, or damage. These measures are described in Schedule B to this Agreement and include, without limitation: AES-256 encryption for data at rest; TLS 1.2 or higher for data in transit; multi-factor authentication for all user accounts; role-based access controls with the principle of least privilege; comprehensive audit logging of all access to Personal Information; automated session timeouts; regular vulnerability assessments; and documented incident response procedures.

Transcribe Health shall regularly test, assess, and evaluate the effectiveness of these technical and organizational measures and shall update them as necessary to maintain an appropriate level of security, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risks to Data Subjects.

3.4. Sub-processing

The Customer provides general authorization for Transcribe Health to engage Sub-processors for the purposes of delivering the Services. The current list of Sub-processors is set out in Schedule C to this Agreement and is available at transcribe.health/legal/dpa. Transcribe Health shall provide at least thirty (30) days' advance written notice before engaging any new Sub-processor or replacing an existing one. The Customer shall have thirty (30) days from receipt of such notice to object on reasonable grounds. If the Customer objects and Transcribe Health cannot reasonably accommodate the objection, the Customer may terminate the affected Services without penalty.

Transcribe Health shall impose on each Sub-processor, by way of a written contract, the same data protection obligations as those set out in this Agreement, in particular providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the processing meets the requirements of applicable data protection law, including GDPR Article 28(4). Where a Sub-processor fails to fulfil its data protection obligations, Transcribe Health shall remain liable to the Customer for the performance of that Sub-processor's obligations, subject to the limitations of liability in §10.

3.5. Assistance with Data Subject Rights

Transcribe Health shall assist the Customer, by appropriate technical and organizational measures and insofar as this is possible, in fulfilling the Customer's obligation to respond to requests from Data Subjects exercising their rights. Given the nature of the Services, the Customer retains direct control over session, transcript, clinical-document, and Dorvi-conversation data through the platform interface and may locate, export, correct, restrict, or delete Personal Information without requiring Transcribe Health's intervention. Where a request cannot be satisfied through self-service tooling, Transcribe Health shall provide reasonable assistance upon the Customer's documented request.

The rights with respect to which Transcribe Health provides assistance include: under PIPEDA and applicable provincial legislation (including Quebec Law 25, BC PIPA, and Alberta PIPA) — access to and correction of Personal Information; withdrawal of consent; deindexation and the cessation of dissemination under Quebec Law 25 §7; and information about automated decision-making under Quebec Law 25 §12.1. Under the GDPR and UK GDPR (for EU/UK data subjects): the right of access (Article 15) — satisfied through export of a Data Subject's records; rectification (Article 16) — satisfied through in-platform editing of transcripts and clinical notes; erasure (Article 17) — satisfied through deletion tooling and the deletion procedures in §3.7, subject to the mandatory retention periods set out in §3.7 and to Transcribe Health's and the Customer's overriding legal-retention obligations; restriction of processing (Article 18); data portability (Article 20) — satisfied through export in a commonly used, machine-readable format; objection (Article 21); and rights relating to automated individual decision-making, including profiling (Article 22). For clarity, where a Data Subject requests erasure of Personal Information that Transcribe Health or the Customer is required by law to retain (including audio and transcript records subject to the retention periods in §3.7), the data will be restricted from active processing and deleted only upon expiry of the applicable mandatory retention period, in accordance with GDPR Article 17(3)(b) and equivalent provisions of Canadian law.

Automated decision-making (Article 22; Quebec Law 25 §12.1; for EU/UK data subjects and Quebec residents where applicable). The Services apply automated processing to generate draft transcriptions, clinical documentation, and Dorvi-chat responses. None of these constitutes a decision based solely on automated processing that produces legal effects concerning a Data Subject or similarly significantly affects them. All AI-generated output is a draft intended for review, correction, and approval by a qualified healthcare professional before it is relied upon or entered into a medical record; a human is in the loop at the point of every clinically significant decision. Transcribe Health does not make solely automated decisions about Data Subjects on the Customer's behalf. Transcribe Health shall provide the Customer with reasonable information about the logic involved and the categories of input used, to the extent such information is available to Transcribe Health from its AI Sub-processors and necessary for the Customer to respond to a Data Subject's Article 22 or §12.1 request.

Transcribe Health shall also provide reasonable information and assistance to support a Privacy Impact Assessment that the Customer is required to conduct, including any assessment required under Quebec Law 25 §17 in respect of the transfer of Personal Information of Quebec residents outside Quebec, and any Data Protection Impact Assessment under §3.5b.

3.5b. Data Protection Impact Assessments and Prior Consultation

Taking into account the nature of the processing and the information available to it, Transcribe Health shall provide the Customer with reasonably necessary information, documentation, and assistance to enable the Customer to (a) carry out Data Protection Impact Assessments under GDPR Article 35 and equivalent assessments under applicable law, including the high-risk processing inherent in AI-assisted clinical documentation; (b) consult with a Supervisory Authority under GDPR Article 36 where the Customer is required to do so; and (c) respond to inquiries, investigations, audits, or orders from a Supervisory Authority. Such assistance is provided at the Customer's reasonable request and to the extent the relevant information is within Transcribe Health's possession or control. Transcribe Health maintains, and makes available through its Trust Center, security documentation, sub-processor information, and Transfer Impact Assessment summaries intended to support these assessments. (Applicable to EU/UK data subjects and Quebec residents where applicable.)

3.6. Breach Notification

In the event of a Security Incident involving Personal Information processed under this Agreement, Transcribe Health shall notify the Customer without undue delay, and in any event within five (5) business days of becoming aware of the Security Incident, and earlier where reasonably feasible given the severity of the incident and the Customer's own notification deadlines under applicable law. A "Security Incident" for this purpose includes a breach of security safeguards under PIPEDA, a confidentiality incident under Quebec Law 25 §3.5, and a personal data breach under GDPR Article 4(12) (where applicable). The initial notification shall include, to the extent reasonably available and consistent with GDPR Article 33(3): (a) a description of the nature of the Security Incident, including where possible the categories and approximate number of Data Subjects concerned and the categories and approximate number of records concerned; (b) the name and contact details of Transcribe Health's designated incident response contact (the Security Officer); (c) a description of the likely consequences of the Security Incident; and (d) a description of the measures taken or proposed to be taken to address the Security Incident, including, where appropriate, measures to mitigate its possible adverse effects. Where it is not possible to provide all of this information at once, it may be provided in phases without further undue delay, and Transcribe Health shall supplement the initial notification as further information becomes available.

This five-business-day notice obligation runs to the Customer and applies in addition to, and is consistent with, Transcribe Health's breach-notification obligations as a Business Associate under the Business Associate Agreement, which likewise require notice to the Customer within five (5) business days of discovery. Nothing in this Section alters the Customer's own obligation, as a Covered Entity or controller, to notify affected individuals and regulators within the timeframes required of the Customer by HIPAA (including the 60-day individual-notification deadline under 45 C.F.R. §164.404), PIPEDA, Quebec Law 25, BC PIPA, Alberta PIPA, the GDPR, or other applicable law. Following the initial notification, Transcribe Health shall provide the Customer with regular status updates at reasonable intervals until the incident is resolved. Transcribe Health shall cooperate with the Customer and take reasonable commercial steps to assist in the investigation, mitigation, and remediation of each such Security Incident, including preserving and providing forensic evidence and logs.

3.7. Deletion and Return of Data

Upon termination of the Services or upon the Customer's request, Transcribe Health shall, at the Customer's election, either return to the Customer all Personal Information in a commonly used, machine-readable format or delete all Personal Information processed on behalf of the Customer, including copies held by Sub-processors and in backup systems. Deletion from active systems shall be completed within thirty (30) days of the request, and from backup systems within ninety (90) days. Independently of any deletion request, the platform enforces mandatory default retention windows on every Customer organization: audio recordings are automatically and permanently deleted ninety (90) days after transcription is completed, and transcript and session records are retained for seven (7) years (subject to a six-year HIPAA minimum) and then automatically deleted. The Customer may also delete Sessions, audio recordings, transcription text, and clinical documents earlier, and — where the Customer has enabled the optional automatic retention policy (configurable in 1-day to 30-day windows and disabled by default) — that policy triggers earlier deletion. Audit logs are retained for at least six (6) years to satisfy HIPAA Security Rule documentation requirements (45 CFR 164.312(b) and 164.530(j)).

Upon completion of deletion, Transcribe Health shall provide the Customer with written certification confirming that all Personal Information has been deleted in accordance with this section, including confirmation that Sub-processors have completed their deletion obligations.

3.8. Audit Rights

Transcribe Health shall make available to the Customer all information necessary to demonstrate compliance with this Agreement and shall allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer. Transcribe Health shall immediately inform the Customer if, in its opinion, an instruction from the Customer infringes PIPEDA or other applicable data protection provisions.

Transcribe Health maintains a Trust Center at trust.transcribe.health where the Customer may review Transcribe Health's current security documentation, compliance status, sub-processor list, and, once available, third-party audit reports. Transcribe Health designs and operates its security controls to the AICPA SOC 2 Trust Services Criteria and is preparing for a SOC 2 Type II examination, and its information security management practices are aligned with ISO/IEC 27001. The Customer's audit and inspection rights under this Section are satisfied by Transcribe Health making available, through the Trust Center and under a non-disclosure agreement, its SOC 2 Type II report and any ISO 27001 certification and Statement of Applicability once issued, together with responses to a reasonable number of the Customer's written security questionnaires. The SOC 2 Type II report and any ISO 27001 certification will be made available through the Trust Center once issued, and the Trust Center reflects their current status. The Customer may exercise an on-site or independent third-party audit right beyond this only (a) where required by a binding order of a Supervisory Authority, (b) following a confirmed Security Incident affecting the Customer's Personal Information, or (c) where applicable data protection law confers a non-waivable audit right that this substitution cannot satisfy. Any such audit shall be conducted on reasonable prior written notice, during business hours, subject to confidentiality obligations, in a manner that does not compromise the security or privacy of other customers' data, and no more than once in any twelve-month period absent a Supervisory Authority order or confirmed Security Incident.

4.1. Lawful Basis for Processing

The Customer warrants that it has obtained all necessary consents, authorizations, and legal bases required under PIPEDA, applicable provincial privacy legislation, and HIPAA for the collection and processing of Personal Information through the Services. The Customer is responsible for providing appropriate notice to Data Subjects regarding the use of AI-powered transcription services.

4.2. Instructions

The Customer is responsible for ensuring that its processing instructions to Transcribe Health comply with all applicable data protection laws. The Customer shall not instruct Transcribe Health to process Personal Information in a manner that would violate PIPEDA, HIPAA, or any other applicable law.

4.3. Data Accuracy

The Customer is responsible for the accuracy of Personal Information provided to Transcribe Health and for updating or correcting such information as necessary. The Customer acknowledges that AI transcription may contain inaccuracies and is responsible for reviewing and correcting transcription output before incorporating it into permanent medical records.

4.4. Privacy and Impact Assessments

The Customer is responsible for conducting any Data Protection Impact Assessment, Privacy Impact Assessment, or equivalent assessment required of it as controller under applicable law before initiating processing through the Services, including (a) any Data Protection Impact Assessment required under GDPR Article 35 for high-risk processing (where applicable), and (b) any Privacy Impact Assessment required under Quebec Law 25 §17 in respect of communicating or transferring Personal Information of Quebec residents outside Quebec, including to Transcribe Health's infrastructure or its Sub-processors. Transcribe Health shall provide reasonable cooperation and information to support such assessments in accordance with §3.5 and §3.5b.

4.5. Patient Forms

(a) Roles. For Patient Forms, the Customer decides which forms are used, which questions they ask, which patients receive them and why. The Customer is therefore the controller (GDPR and UK GDPR), the covered entity or, where the Customer is itself a business associate, the upstream business associate (HIPAA), the organization accountable for the information (PIPEDA and the British Columbia and Alberta Personal Information Protection Acts), the enterprise on whose behalf the information is collected (Quebec Law 25), and the business (CCPA/CPRA), for all Customer Form Content and all responses. Transcribe Health acts only as the Customer's processor, business associate and service provider, and processes form data only on the Customer's documented instructions. The Customer's publication of a form, its sending of a form (manually or by turning on automatic sending), and its configuration of scoring and flag rules are documented instructions for the purposes of Section 4.2 and GDPR Article 28(3)(a). Templates in the Services' library are offered as starting points only. Transcribe Health does not warrant that any template is suitable, complete or lawful for the Customer's purposes, and by publishing or sending a template the Customer adopts it as its own Customer Form Content. The library's consent template is not legal advice, and the Customer is responsible for having its wording reviewed before use.

(b) Lawful basis and necessity. Without limiting Section 4.1, the Customer is solely responsible for: (i) having a lawful basis, and any consent or authorization required, for every question it asks, including any question that collects special-category data under GDPR Article 9 (such as health, mental health, sex life or sexual orientation, racial or ethnic origin, or religious belief), sensitive personal information under Quebec Law 25 and PIPEDA, or sensitive personal information under the CPRA; (ii) asking only for information that is necessary for the purposes it has identified, consistent with GDPR Article 5(1)(c), PIPEDA Principle 4.4, sections 4 and 5 of Quebec Law 25, and CCPA section 1798.100(c); (iii) giving patients any notice required at the time of collection beyond the default notice the Services display, including the Customer's identity, purposes, legal basis and contact details where GDPR Article 13 applies, and the notice required by section 13.1 of the Alberta Personal Information Protection Act where the Customer has enabled cross-border AI processing; (iv) obtaining the consent of a parent, guardian or tutor where the law requires it, including for a minor under 14 in Quebec (Quebec Law 25, section 4.1); (v) the content of any consent or authorization wording, including, where a form is used as a HIPAA authorization, the core elements and statements required by 45 CFR 164.508(c), and any consent required by 42 CFR Part 2; (vi) deciding whether an electronic signature captured through the Services meets its legal, regulatory and professional requirements; (vii) the validity, licensing and appropriate clinical use of any screening instrument it uses; and (viii) any privacy or data protection impact assessment Patient Forms requires of it under Section 4.4, including GDPR Article 35 where it screens patients' mental health on a large scale.

(c) Payment card data prohibited. The Customer shall not use Patient Forms to collect, and shall not ask patients to enter, payment card account numbers, card verification codes (CVV, CVC or similar), PINs or PIN blocks, magnetic stripe or chip data, or any other cardholder or sensitive authentication data within the meaning of the PCI Data Security Standard. Patient Forms is not designed or assessed for cardholder data, and Transcribe Health makes no PCI DSS commitment for any such data. If Transcribe Health becomes aware that a form collects such data, it may notify the Customer and require the Customer to change the form and delete the affected responses, and, where necessary to protect patients or the Services, may archive the form after notice so it can no longer be sent. Any such data received remains protected by the security measures in Schedule B as part of the Customer's Personal Information. A breach of this Section 4.5(c) is a breach of the Customer's obligations under this Agreement for the purposes of Section 10.2.

(d) Clinical review of responses and flags. Scores, severity bands and flags are aids to help the Customer decide which responses to review first. They are not diagnoses and do not replace professional judgment. The Customer is solely responsible for reviewing responses and flags in a timely way and for any clinical follow-up, including follow-up on any answer indicating thoughts of self-harm. Transcribe Health does not monitor responses, does not contact patients about their answers, and does not provide an emergency or crisis service. Patient-facing pages state that forms are not monitored around the clock and direct patients to emergency services. This Section 4.5(d) is in addition to Sections 6.2 and 6.3.

(e) What Transcribe Health does with form data. Transcribe Health processes Patient Forms data only as described in Sections 2.1(f) and 2.2. It does not use form data to train or improve any model (Section 6.1), for analytics about individual patients, for marketing, or for any purpose of its own, and it does not sell or share form data. Transcribe Health personnel do not access response content except to provide support the Customer requests, to investigate a security incident, or as required by law, and every view or export of a response through the Services is recorded in the audit log without the response content.

(f) Retention and deletion of form data. Unsubmitted drafts are deleted 30 days after the form link expires or is cancelled. Submitted responses, scores, flags and completed PDFs are kept with the patient's record in the Services until the Customer deletes that patient or this Agreement ends, and Section 3.7 then applies. When the Customer deletes a patient, the patient's answers, drafts and completed PDFs are deleted, and each signature record is reduced to what proves that consent was given (the form version, a hash of the statement, the date and time, and hashed IP address and user agent), without the signer's name or drawn signature. The Customer remains responsible for keeping any form it must retain as part of its medical record in its own record system, consistent with Section 1.5 of the Business Associate Agreement.

(g) Requests from patients. Requests from patients about their form data are handled under Section 3.5. Transcribe Health will promptly forward to the Customer any such request it receives directly and will not respond to it on the merits except as the Customer instructs or the law requires. The Customer can view, export and delete a patient's responses in the Services.

4.6. Dorvi and Deliveries the Customer Directs

(a) Human approval. The Customer shall ensure that every Dorvi action is reviewed by an appropriate Authorized User before approval, and shall designate as licensed clinicians only Authorized Users who are licensed to approve clinical content. Drafts with clinical content can only be approved by an Authorized User designated as a licensed clinician. The Customer is responsible for the content of every document or message an Authorized User approves.

(b) The Customer's own vendors. Fax delivery uses a fax account the Customer holds with its own fax provider (currently SRFax), and EHR delivery uses the Customer's own EHR. The Customer contracts with those providers directly and is responsible for having in place any Business Associate Agreement or equivalent privacy agreement they require. Those providers act for the Customer and are not Sub-processors of Transcribe Health. Transcribe Health uses the Customer's fax credentials only to send and retrieve the Customer's faxes on the Customer's instruction, and is not responsible for how a fax provider, EHR or recipient handles information after Transcribe Health has delivered it as instructed.

(c) Recipients and lawful basis. Each delivery is a disclosure made by the Customer. The Customer is responsible for having a lawful basis for each disclosure, for keeping its contacts directory accurate (Dorvi addresses letters only to contacts in that directory), and for any consent needed to contact patients. Text messages and emails to patients carry only the Customer's name and a secure link, and are sent only where the patient's recorded consent and contact preferences allow it.

(d) No automated decisions. Dorvi drafts; it does not make decisions about patients. Because every action requires an Authorized User's approval, the Customer remains responsible for each decision, including for the purposes of Quebec Law 25 section 12.1 and GDPR Article 22.

(e) Conversation links. Conversation links are off unless an owner or administrator of the Customer turns them on for the organization. When they are on, an Authorized User may create a link to a Dorvi conversation that contains no patient information. A conversation that is about a patient or a visit, that used a Dorvi tool that can access patient information, or that proposed a care action can never be shared, and any existing link to it is revoked automatically. Before a link is created, the conversation is scanned for personal identifiers, the link is refused if any are found, and the Authorized User must confirm that the conversation contains no patient information. Anyone who has the link can view, without signing in, a copy of the conversation as it was when the link was created, until the link expires (after 30 or 90 days, or never, as the Authorized User chooses) or is revoked. The Authorized User who created a link, and the Customer's owners and administrators, can revoke it at any time, and no link works while the feature is turned off. A link is created on the Customer's instruction and is a disclosure made by the Customer, not by Transcribe Health. The Customer is responsible for its Authorized Users' use of links, including making sure that no patient information is shared through them.

5.1. Data Storage

All persistent data (databases, files, backups) is stored in Canada on infrastructure controlled by Transcribe Health. The Customer's Personal Information at rest does not leave Canadian jurisdiction.

5.2. AI Processing Transfers

Per-organization AI residency. Cross-border AI processing under this Section is a per-organization setting, not an automatic default. Each Customer organization's default is Canada-resident inference: clinical AI runs on models hosted within Canada, and the Customer's Content is not transmitted to a United States region for AI inference. A Customer organization's owner or administrator may opt in to enhanced cross-border AI, which allows clinical inference, when the in-country service cannot serve a request, to be routed to Google Cloud Vertex AI in a United States region or to the Anthropic API (Anthropic PBC, inference in the United States), each under the provider's Business Associate Agreement and Standard Contractual Clauses; this election is recorded together with the version of the disclosure the Customer accepted, and is reversible at any time. Where a Customer organization has not enabled cross-border AI, its clinical inference remains in Canada and no AI-inference transfer under this Section occurs for that organization. For a Customer organization located in the United States, clinical inference runs in the United States on Google Cloud Vertex AI or the Anthropic API.

Where a Customer organization has enabled enhanced cross-border AI, derived transcript text (not raw audio, which is transcribed on models hosted within Canada and remains in Canada) may be transmitted to an AI sub-processor with inference endpoints located in the United States. These transfers are temporary, in-transit only, and subject to the following safeguards: data is encrypted using TLS 1.2 or higher during transmission; AI providers are contractually prohibited from retaining, storing, or using Personal Information beyond the immediate processing request; AI providers are bound by Business Associate Agreements where applicable; and transfers are limited to the minimum data necessary to perform the processing.

Transcribe Health has assessed the cross-border AI-inference transfers to Google Cloud Vertex AI (United States) and to the Anthropic API (Anthropic PBC, United States) in a privacy impact assessment under section 17 of the Quebec Act respecting the protection of personal information in the private sector, which also serves as its Transfer Impact Assessment under PIPEDA Principle 4.1.3 and GDPR Chapter V. The assessment considers the sensitivity of the information, the purposes, the contractual, technical and organizational protection measures, and the legal framework of the United States, including access by public authorities. It is pending final approval by Transcribe Health's Security Officer. For the Anthropic flow its conclusion is conditional: Transcribe Health will not send Personal Information to Anthropic PBC until the assessment is approved and the Business Associate Agreement with zero data retention is executed, and will not send Personal Information of Data Subjects in the European Union or the United Kingdom to it until Standard Contractual Clauses (and the UK addendum) are executed. A summary of the assessment is available to the Customer on request.

Transcribe Health has conducted, and maintains, a dedicated Transfer Impact Assessment for the cross-border processing involved in the standalone Dorvi chat feature, addressing the categories of data transmitted to the contracted AI Sub-processor, the zero-retention contractual terms, the PHI-scrubbing applied to external medical-literature queries, and the residual-risk analysis for the United States endpoint. A summary of this assessment is available to the Customer through the Trust Center on request.

Where the Customer uses Patient Forms, the answers and scores of a form linked to a visit form part of the content transmitted for AI inference for that visit, and are therefore covered by this Section and by the Customer's AI residency setting. Patient Forms does not create any other cross-border transfer.

Content processed by Dorvi and inbound fax processing is transmitted for AI inference on the same terms and follows the Customer's AI residency setting. Fax and EHR deliveries the Customer approves are disclosures by the Customer to its own providers under Section 4.6(b), not transfers by Transcribe Health to a Sub-processor.

5.3. Transparency

The Customer may request information about the specific jurisdictions in which Personal Information is processed. The current list of Sub-processors and their jurisdictions is set out in Schedule C.

6.1. No Model Training

Transcribe Health does not use Personal Information processed under this Agreement to train, fine-tune, or improve any artificial intelligence or machine learning models. All AI processing is performed using pre-trained models provided by Sub-processors who are contractually bound by the same restriction.

6.2. AI Output Accuracy

The Customer acknowledges that AI-generated transcriptions and clinical documentation are produced by automated systems and may contain errors, omissions, or inaccuracies. Transcribe Health does not guarantee the accuracy of AI-generated output. The Customer is solely responsible for reviewing, verifying, and approving all AI-generated content before incorporating it into medical records or relying on it for clinical decision-making.

6.3. Human Oversight

The Services are designed to augment, not replace, the professional judgment of healthcare providers. The Customer shall ensure that qualified healthcare professionals review all AI-generated output before it is finalized. Transcribe Health provides tools within the platform for reviewing and editing transcriptions and clinical notes. Dorvi actions are never carried out without an Authorized User's approval, as set out in Section 4.6.

7.1. Notification

If Transcribe Health receives a request from a government authority or law enforcement agency for access to Personal Information processed on behalf of the Customer, Transcribe Health shall promptly notify the Customer of the request before disclosing any data, unless such notification is prohibited by applicable law. Where notification is prohibited, Transcribe Health shall use commercially reasonable efforts to challenge the prohibition and to redirect the requesting authority to obtain the data directly from the Customer.

7.2. Minimum Disclosure

In the event that Transcribe Health is compelled by law to disclose Personal Information to a government authority, Transcribe Health shall disclose only the minimum amount of information required to satisfy the legal obligation and shall use commercially reasonable efforts to protect the confidentiality of the disclosed information.

10.1. Liability

Each party shall be liable for damages caused by processing that infringes applicable data protection laws. Transcribe Health shall be liable for damages caused by processing that does not comply with this Agreement or that is outside of or contrary to the Customer's lawful instructions.

10.2. Indemnification

Transcribe Health shall indemnify, defend, and hold harmless the Customer from and against any third-party claims, damages, losses, and expenses (including reasonable legal fees) arising from Transcribe Health's breach of this Agreement, its negligent or wrongful processing of Personal Information, or its failure to comply with applicable data protection laws. The Customer shall indemnify, defend, and hold harmless Transcribe Health from and against any third-party claims arising from the Customer's unlawful processing instructions, failure to obtain required consents, or breach of the Customer's obligations under this Agreement.

10.3. Limitation

Except as set out in this Section, the total aggregate liability of either party arising out of or in connection with this Agreement, the Business Associate Agreement, and the Terms of Service shall be subject to, and shall not exceed, the single combined limitation of liability set out in the Terms of Service, which applies as one shared cap across this Agreement, the Business Associate Agreement, and the Terms of Service. For the avoidance of doubt, this Agreement does not establish any separate or higher liability cap specific to Personal Information or Protected Health Information; the Terms of Service cap governs, including in respect of (i) Security Incidents and breaches of confidentiality affecting Personal Information, and (ii) a party's indemnification obligations under §10.2, including claims and administrative fines flowing from a Data Subject or a Supervisory Authority under GDPR Article 82 (where applicable).

The Terms of Service cap shall not apply only to liability that cannot lawfully be excluded or limited under applicable law, including liability for death or personal injury caused by a party's negligence and liability for fraud or fraudulent misrepresentation. Nothing in this Section operates to limit or exclude any liability to the extent such limitation or exclusion is prohibited by the mandatory provisions of applicable data protection law.

11.1. Term

This Agreement shall commence on the date the Customer accepts the Terms of Service and shall continue for as long as Transcribe Health processes Personal Information on behalf of the Customer.

11.2. Termination for Material Security Deficiency

If an audit or assessment reveals a material security deficiency in Transcribe Health's processing of Personal Information, and Transcribe Health fails to remediate the deficiency within thirty (30) days of receiving written notice, the Customer may terminate this Agreement and the related Services without penalty.

11.3. Survival

The following obligations shall survive the termination or expiry of this Agreement for as long as Transcribe Health retains any Personal Information of the Customer and thereafter to the extent required by applicable law: the obligations with respect to the confidentiality and security of Personal Information; the return or deletion of Personal Information under §3.7; assistance with and cooperation in audits and Supervisory Authority inquiries under §3.5b and §3.8; breach notification and incident-assistance obligations under §3.6 with respect to Security Incidents affecting Personal Information processed during the term; the limitations of liability and indemnification under §10; and the provisions of the Business Associate Agreement.

12.1. Governing Law

This Agreement shall be governed by and construed in accordance with the laws of the Province of Ontario and the federal laws of Canada applicable therein, without regard to conflict of laws principles.

12.2. Amendments and Regulatory Changes

Transcribe Health may update this Agreement from time to time to reflect changes in its processing activities, Sub-processors, or applicable law. Material changes will be communicated to the Customer with at least thirty (30) days' advance written notice. Continued use of the Services after such notice constitutes acceptance of the updated Agreement. In the event that new data protection legislation or regulatory guidance materially affects the obligations of either party under this Agreement, both parties shall negotiate in good faith to amend this Agreement to ensure continued compliance.

12.3. Severability

If any provision of this Agreement is held to be invalid or unenforceable, the remaining provisions shall continue in full force and effect.

12.4. Entire Agreement

This Agreement, together with the Terms of Service, Privacy Policy, Business Associate Agreement, and (where applicable) the California Consumer Privacy Addendum in §13, constitutes the entire agreement between the parties with respect to the processing of Personal Information and supersedes all prior agreements, representations, and understandings relating to data processing.

13.1. Service Provider Status

The parties acknowledge that Transcribe Health is a "Service Provider" as defined in CCPA §1798.140(ag), processing Personal Information that the Customer discloses to it for the limited and specified business purpose of providing the Services under the Terms of Service.

13.2. Restrictions on Use

Transcribe Health shall not: (a) sell or share (as those terms are defined in the CCPA) Personal Information; (b) retain, use, or disclose Personal Information for any purpose other than the specific business purpose of performing the Services, or as otherwise permitted by the CCPA; (c) retain, use, or disclose Personal Information outside the direct business relationship between the parties; or (d) combine Personal Information received from or on behalf of the Customer with Personal Information that Transcribe Health receives from or on behalf of any other person, or collects from its own interaction with a consumer, except as permitted under CCPA §1798.140(ag)(1)(D) and its implementing regulations. Transcribe Health certifies that it understands and will comply with the restrictions in this Section.

13.3. Consumer Rights Assistance

Transcribe Health shall provide reasonable assistance to enable the Customer, as the business, to honor verifiable consumer requests to know, access, correct, and delete Personal Information, and to honor requests to limit the use and disclosure of sensitive personal information, in accordance with §3.5.

13.4. Sub-processors

Transcribe Health shall engage Sub-processors that process Personal Information of California residents only under a written contract that binds them to the equivalent restrictions and obligations set out in this Section, as required by CCPA §1798.140(ag)(1).

13.5. Compliance and Notice

Transcribe Health shall comply with its obligations as a Service Provider under the CCPA and shall notify the Customer if it determines that it can no longer meet those obligations. The Customer may, upon notice, take reasonable and appropriate steps to stop and remediate unauthorized use of Personal Information.