# Transcribe Health > Transcribe Health is a HIPAA-compliant B2B healthcare AI platform that automates clinical documentation for clinicians. Core products: real-time medical transcription with diarization, AI-generated clinical notes, a standalone Assistant chat with evidence-based citations to public medical literature, and a Chrome extension that captures encounters in-browser and inserts notes into supported EHRs (Epic, Cerner, AllScripts, AthenaHealth, NextGen, DrChrono, PracticeFusion, eClinicalWorks). The company is incorporated under the federal laws of Canada; data is processed in Canada with the only PHI transit being to contracted AI sub-processors under zero-retention BAAs. ## Product - [Home](https://transcribe.health/): Product overview and entry point - [Pricing](https://transcribe.health/en-us/pricing): Plans, free trial, and per-seat tiers - [Compliance](https://transcribe.health/en-us/compliance): Cross-framework compliance posture (HIPAA, GDPR, PIPEDA, Quebec Law 25, BC PIPA, Alberta PIPA, CCPA, SOC 2, ISO 27001) - [Specialties](https://transcribe.health/en-us/specialties): Specialty-specific feature pages - [Locations](https://transcribe.health/en-us/locations): Province/state-specific landing pages with jurisdictional compliance notes - [Compare](https://transcribe.health/en-us/compare): Side-by-side comparisons with other medical-scribe products - [What's new](https://transcribe.health/en-us/whats-new): Recent product changes ## Legal - [Privacy Policy (markdown)](https://transcribe.health/privacy.md): Plain-markdown variant of the Privacy Policy for agent consumption - [Privacy Policy (rendered)](https://transcribe.health/en-us/privacy): HTML version of the Privacy Policy - [Terms of Service (markdown)](https://transcribe.health/terms.md): Plain-markdown variant of the Terms of Service for agent consumption - [Terms of Service (rendered)](https://transcribe.health/en-us/terms): HTML version of the Terms of Service - [Business Associate Agreement (markdown)](https://transcribe.health/legal/baa.md): Plain-markdown variant of the BAA for agent consumption - [Business Associate Agreement (rendered)](https://transcribe.health/en-us/legal/baa): HTML version of the BAA - [Data Processing Agreement (markdown)](https://transcribe.health/legal/dpa.md): Plain-markdown variant of the DPA for agent consumption (sections + Schedules A/B/C inlined) - [Data Processing Agreement (rendered)](https://transcribe.health/en-us/legal/dpa): HTML version of the DPA - [Trust Center / Subprocessor List](https://trust.transcribe.health/subprocessors): Canonical public subprocessor list ## Content - [Blog](https://transcribe.health/en-us/blog): Long-form articles on AI scribes, clinical documentation workflows, regulatory updates, and product deep-dives - [Knowledge base](https://transcribe.health/en-us/kb): How-to guides, troubleshooting, and feature documentation - [Careers](https://transcribe.health/en-us/careers): Open roles (Toronto-based team) ## Contact - Email: hello@transcribe.health - Demo bookings: https://cal.transcribe.health/fatih/demo ## Optional - [Sitemap (XML)](https://transcribe.health/sitemap.xml): Machine-readable index of all canonical URLs across all supported locales (en-us, en-ca, fr-ca) - [Robots policy](https://transcribe.health/robots.txt): Crawl rules --- # Privacy Policy --- **PRIVACY POLICY** **Transcribe Health Corporation** **Effective Date: December 1, 2024** **Last Updated: December 1, 2026** ## 1. INTRODUCTION AND ACCEPTANCE This Privacy Policy ("Policy") constitutes a legally binding agreement between you and Transcribe Health Corporation, a corporation incorporated under the federal laws of Canada ("Transcribe Health," "Company," "we," "us," or "our"), governing the collection, use, disclosure, and protection of information through our AI-powered medical transcription and clinical documentation platform, including all associated services, software, applications, APIs, and websites (collectively, the "Services"). **BY ACCESSING OR USING THE SERVICES, YOU EXPRESSLY ACKNOWLEDGE THAT YOU HAVE READ, UNDERSTOOD, AND AGREE TO BE LEGALLY BOUND BY THIS POLICY. IF YOU DO NOT AGREE, YOU MUST IMMEDIATELY DISCONTINUE ALL USE OF THE SERVICES.** ## 2. SCOPE, APPLICABILITY AND COVERED ENTITY RELATIONSHIPS > **This Privacy Policy is NOT a Notice of Privacy Practices (NPP).** When Transcribe Health processes Protected Health Information, it does so as a **Business Associate** on behalf of a healthcare provider (the Covered Entity). The HIPAA Notice of Privacy Practices that describes how medical information about a patient may be used and disclosed, and how a patient can access that information, is issued by the patient's own healthcare provider, not by Transcribe Health. **Patients should obtain the NPP from their healthcare provider.** This Policy explains how Transcribe Health, as a service provider to those providers, handles information. ### 2.1 Scope of Application This Policy applies to all interactions with our Services by: * Licensed healthcare providers and medical professionals * Healthcare organizations, clinics, hospitals, and medical facilities * Patients whose information is processed through our Services * Business associates and third-party integrators * Visitors to our websites and applications * Employees and contractors of covered entities ### 2.2 HIPAA Business Associate Status When we process Protected Health Information ("PHI") on behalf of Covered Entities or other Business Associates, we function as a Business Associate under HIPAA. We maintain executed Business Associate Agreements ("BAAs") with all applicable clients, which supersede this Policy to the extent of any conflict regarding PHI handling. ### 2.3 Jurisdictional Coverage This Policy applies globally, with specific provisions for: * United States: HIPAA, HITECH Act, state medical privacy laws * European Union/EEA: GDPR compliance * Canada: PIPEDA and provincial privacy legislation * Other jurisdictions: Local data protection laws as applicable ## 3. DEFINITIONS For purposes of this Policy: * **"AI Systems"** means our proprietary and licensed artificial intelligence, machine learning, and natural language processing technologies * **"Aggregate Data"** means data that has been combined and analyzed in a way that individual patients cannot be identified * **"Business Associate"** has the meaning defined under HIPAA * **"Clinical Documentation"** means medical notes, transcriptions, summaries, and related healthcare records * **"Covered Entity"** has the meaning defined under HIPAA * **"De-identified Data"** means data that has been processed to remove all 18 HIPAA identifiers * **"PHI"** or **"Protected Health Information"** has the meaning defined under HIPAA * **"Personal Information"** means any information relating to an identified or identifiable natural person * **"Voice Data"** means audio recordings, voice patterns, and acoustic characteristics ## 4. INFORMATION WE COLLECT ### 4.1 Healthcare Provider Information * Professional credentials (NPI numbers, DEA numbers, medical licenses, board certifications) * Practice information (specialty, affiliations, hospital privileges) * Authentication credentials and security tokens * Voice recordings for transcription * Usage patterns and preferences * Billing and payment information ### 4.2 Patient Health Information * Demographic information (name, date of birth, contact details) * Medical record numbers and identifiers * Clinical encounter audio recordings * Medical history, diagnoses, treatments, and medications * Laboratory results and imaging reports * Insurance and billing information * Care plans and clinical notes ### 4.2.1 Online Appointment Booking (Collected Directly From Patients) Where a healthcare practice enables online appointment booking, we collect a patient's first and last name, date of birth, and email address or phone number directly from the patient, through the practice's public booking page or a booking link the practice sends to the patient. We collect this information solely to schedule the requested appointment with that practice, and it becomes part of the patient record that practice controls; we process it only as the practice's service provider (and, where it constitutes PHI, as its HIPAA Business Associate). The booking surface is protected against abuse (per-visitor rate limits and per-practice booking caps), and contact details are hashed in our audit logs rather than recorded there in cleartext. Each practice controls whether online booking is available; the feature is disabled unless the practice enables it. ### 4.2.2 Patient Forms and Questionnaires (Collected Directly From Patients) Where a healthcare practice uses our patient forms feature, the practice sends a patient a secure link so the patient can fill in intake forms, consent forms, screening questionnaires, or the practice's own forms before or outside a visit. The practice decides which forms to send and to whom, and it writes or chooses every question, including when it starts from one of our templates. We collect the answers directly from the patient on the practice's behalf, only as its service provider (and, where the answers are PHI, as its HIPAA Business Associate). The practice, not Transcribe Health, decides why the information is collected and is responsible for having a lawful basis to collect it. **What we collect through a form:** * **Answers.** These can include health history, symptoms, medications, allergies, answers to mental health screening questionnaires (for example the PHQ-9, PHQ-2 and GAD-7, which include questions about mood and, in the PHQ-9, about thoughts of self-harm), and anything else the practice's own questions ask for. * **Scores and flags.** For standard screening questionnaires we calculate a total score and a severity band. We also flag answers that match rules built into a questionnaire or set by the practice. Any answer above zero to the PHQ-9 question about thoughts of self-harm is always flagged for the practice to review. Scoring is done on our servers when the form is submitted. See § 5.6. * **Consent and signature records.** When a form asks for consent or a signature, we record the consent wording shown, the signer's name and drawn signature, the date and time, the version of the form, and one-way hashes (not the raw values) of the IP address and browser details used to sign. * **Completed PDFs.** Where the practice uses its own PDF form, we fill the practice's PDF with the patient's answers and store the completed copy. * **Draft answers.** Answers are saved automatically while the patient fills in a form, so the patient can close the page and finish later from the same link. * **Security records.** We record when the link was opened, the result of each date-of-birth check that protects the link, and when each form was started and submitted. These records never contain the answers. **How it is protected.** Before any form is shown, the patient must confirm their date of birth. Five wrong attempts lock the link until the practice reopens it. Answers, drafts, signer names, drawn signatures and completed PDFs are encrypted at rest with a key specific to the practice. The message that carries the link names only the practice; it never includes the patient's name, the names of the forms, or any health details, and answers are never sent by email or text message. Messages respect the patient's messaging consent, opt-outs and the practice's quiet hours; a link sent outside a booked visit requires the patient's express consent to be contacted on that channel. The forms page is not indexed by search engines, sets no tracking cookies, and does not store answers in the patient's browser. Once a form version is published it cannot be changed, so the exact wording a patient saw can be shown later. **How the answers are used.** Submitted answers, scores, flags and completed PDFs go into the practice's patient record in the Services, where authorized staff of that practice can see them. Viewing and exporting a response are recorded in our audit log. Where a form is linked to a visit, its answers and scores are also included in the information our AI features use to draft the clinical note for that visit. That use follows the same AI processing, subprocessors and per-organization data-residency setting described in § 5 and § 8.2.1, and every AI-drafted note is reviewed by a clinician (§ 5.6). We do not use form answers to train AI models, for marketing, or for any purpose of our own, and we do not sell or share them. **Payment card information.** The forms feature is not designed or secured for payment card information, and practices may not use it to collect card numbers, security codes or other payment card data. **Patient requests.** Because the practice controls this information, a patient who wants to see, correct or delete their form answers, or to withdraw a consent given on a form, should contact the practice. See § 12.6. The practice's own Notice of Privacy Practices or privacy notice governs how it uses the information. ### 4.3 Voice and Audio Data * Real-time audio streams from clinical encounters * Recorded consultations and medical dictations * Voice characteristics for speaker separation * Acoustic metadata (quality, duration, timestamps) * Environmental audio context (with consent) * **Browser-extension audio capture**: where you install our Chrome extension, clinical-encounter audio is captured in the browser, encrypted in the browser before any data leaves your device, transmitted as ciphertext to our backend, and decrypted only inside our Canadian processing environment. Encryption keys are scoped to your active session and never leave your device. Any locally buffered audio is purged once upload to our backend is confirmed; we do not maintain a persistent on-device store of the audio outside the active session. * **Global dictation**: when you dictate into a text field in the web app, desktop app, or Chrome extension, we collect the audio of your dictation (up to 3 minutes), the text it produces, and a record of the dictation (for example, the app you dictated from and whether it succeeded). To make the transcription more accurate, we also collect up to 1,000 characters of the text already in that field around your cursor. That text may include patient information (PHI). We use it only to help our speech models transcribe your dictation correctly; we never keep it in your dictation history, and we delete it when transcription finishes (in all cases within about 20 minutes). Dictation is processed by speech models we run in our own Canadian infrastructure. How long each of these is kept is set out in Section 10.1. ### 4.4 AI Processing Data * Transcription outputs and confidence scores * Clinical insights and suggested diagnoses codes * Natural language processing results * Model training feedback and corrections * Quality assurance annotations * **Assistant conversation data**: questions you submit through the standalone Assistant chat (which may include patient context entered as free text and constituting PHI), the AI-generated responses returned to you, the public medical literature citations attached to those responses, conversation titles, timestamps, and the ordered message history within a conversation. Assistant conversations are persistent and remain accessible to you across sessions until you delete them or your account is closed. ### 4.5 Technical and Usage Data * Device identifiers and hardware information * IP addresses and network information * Browser type and operating system * Session recordings (with consent) * Feature usage and interaction patterns * Performance metrics and error logs * Integration logs with EHR/EMR systems * **Chrome extension telemetry and audit metadata**: where the extension is installed, we collect non-content metadata associated with each capture or insertion event, including a recording session identifier, the detected EHR system, the extension version, capture and insertion timestamps, inactivity-timeout events, and integrity hashes used to maintain a tamper-evident audit log. Audit-log entries are retained locally on your device for a limited rolling window and mirrored to our server-side audit log on the same retention basis as other PHI-access logs. ### 4.6 Third-Party Integration Data * EHR/EMR system data from supported integrations * Practice management system information * Laboratory and imaging system interfaces * Pharmacy and prescription data * Insurance eligibility and claims data ## 5. AI-SPECIFIC DATA PROCESSING ### 5.1 AI Model Training and Improvement We employ the following approaches to AI model training and improvement: * **Third-Party AI Processing**: We use established AI providers (such as Google Cloud Vertex AI and Amazon Bedrock) under Business Associate Agreements for transcription processing, clinical note generation, and Assistant chat responses * **Data Minimization**: Only the minimum necessary data is sent to AI providers for processing, and no PHI is retained by AI providers beyond the processing session * **No Persistent Training on PHI**: Your patient data is not used to train general-purpose AI models * **De-identified Data Only**: Any aggregate analysis or model improvement uses fully de-identified data in accordance with HIPAA safe harbor requirements * **Assistant Conversation Context**: To generate coherent multi-turn answers, the Assistant feature transmits the current question together with prior messages from the same conversation (the conversation-history context window) to the third-party AI provider on each request. Conversation history is stored on our infrastructure in Canada and is sent to the AI provider only at the moment of processing — providers under our zero-retention contractual terms do not retain it. Only the messages from the specific conversation you are currently using are included; we do not concatenate or share content across separate conversations, across users, or across organizations. * **Medical Literature Retrieval**: To produce evidence-based citations alongside Assistant answers, we maintain a local index of de-identified medical literature metadata inside our Canadian infrastructure, queried using your raw question (which never leaves our infrastructure), and we supplement that index with calls to public, non-PHI-receiving medical-research APIs. Calls to those public APIs carry only **PHI-scrubbed query variants** derived from your question (for example, a generic drug name or symptom phrase) — never the raw question, patient context, user identifiers, organization identifiers, conversation identifiers, or any other Personal Information. ### 5.2 Voice Processing * Voice data is processed using advanced acoustic models for accurate transcription * Speaker diarization to distinguish between multiple speakers * Acoustic data retained only for the minimum necessary period ### 5.3 Clinical Intelligence Generation Our AI systems generate: * Automated clinical documentation and SOAP notes * ICD-10 diagnosis code and HCPCS Level II procedure/supply code suggestions * Clinical decision support insights (not medical advice) * Quality measure tracking and reporting * Population health analytics (aggregate only) * **Evidence-based Q&A with literature citations**: through the standalone Assistant chat, AI-generated answers to clinical questions, accompanied by citations to public medical literature sources. Citations are surfaced so you can independently verify the source material. As with all AI output we generate, these answers are informational, are not medical advice, and must be reviewed by a qualified healthcare professional before being relied upon in patient care. ### 5.4 De-identification and Anonymization * Automated removal of all 18 HIPAA identifiers * Expert determination method for complex cases * Synthetic data generation for model training * K-anonymity and l-diversity techniques * Regular audits of de-identification effectiveness ### 5.5 Model Transparency and Explainability * Audit logs of all AI-generated content * Confidence scores and uncertainty quantification * Explainable AI features showing decision rationale * Human-in-the-loop review options * Regular bias testing and fairness audits ### 5.6 Automated Decision-Making and Artificial Intelligence (ADMT) This section provides the information required by GDPR Article 13(2)(f), Quebec Law 25 § 12.1, and applicable California automated-decision-making rules. It describes how we use AI and automated processing, the logic involved, and the consequences for you. **Where we use AI.** The Services use artificial intelligence and automated processing in four places: * **Speech-to-text transcription** of clinical-encounter audio into text; * **Clinical-note and document generation**, including structured SOAP-style notes from a transcript and, where a practice uses patient forms, the patient's submitted form answers and scores for that visit; * **Medical-coding suggestions** (for example, suggested ICD-10 diagnosis codes and HCPCS Level II procedure/supply codes); and * **The standalone Assistant**, which answers clinical questions and returns AI-generated responses, and may surface citations to source material. **The logic involved (plain-language).** Audio is converted to text by automatic speech-recognition models. The resulting text is then processed by large language models, operated by our AI subprocessors under Business Associate Agreements and zero-retention contractual terms (see § 5.1 and § 8.2), to draft notes, suggest codes, or answer Assistant questions. Our AI providers do not retain your data after a request is processed and do not train their models on it. **Significance and consequences for you.** These features are **clinical-documentation and decision-support aids; they do not make decisions about any individual and do not replace professional judgment.** Every AI output (transcript, note, code suggestion, or Assistant answer) is informational and must be reviewed and validated by a qualified healthcare professional before it is relied upon in patient care. Human review is a contractual requirement under our Business Associate Agreement (human-in-the-loop). **No solely-automated decisions with legal or similarly significant effect.** We do not make decisions about you that produce legal effects or similarly significantly affect you (such as eligibility, denial of care, or pricing) based solely on automated processing without human involvement, within the meaning of GDPR Article 22. The AI features above are advisory and are always subject to professional human review. **Form scores and flags.** Scores, severity bands and flags on patient forms (§ 4.2.2) are produced by fixed scoring rules, not by AI. They help a practice decide which responses to look at first. They do not diagnose and do not decide anything about the patient. A flagged response stays marked "Needs attention" until a member of the practice's staff reviews it, and who reviewed it and when is recorded. Patient forms are not monitored around the clock and are not an emergency or crisis service. **Your right to be informed and to submit observations (Quebec Law 25 § 12.1).** Where a decision affecting you is based on automated processing of your personal information, you have the right to be informed of that fact, to be informed of the personal information used and the principal factors that led to the decision, and to submit observations to a member of our personnel who is able to review the decision. To exercise this right, or to request human review of any AI-assisted output that concerns you, contact our privacy contact using the details in § 23. ## 6. LEGAL BASIS AND LAWFUL PROCESSING ### 6.1 HIPAA Permitted Uses We process PHI under HIPAA's permitted uses for: * Treatment activities as directed by healthcare providers * Healthcare operations including quality improvement * Payment activities including claims processing * As required by law or court order * Public health activities as permitted * Health oversight activities * Research with appropriate authorization ### 6.2 GDPR Legal Bases For EU/EEA residents, we process data based on: * Performance of contract (service delivery) * Legal obligations (regulatory compliance) * Vital interests (emergency medical situations) * Legitimate interests (security, fraud prevention) * Explicit consent (marketing, optional features) * Special category data processed under Article 9(2)(h) for healthcare ### 6.3 Consent and Authorization * Informed consent obtained for voice recording * HIPAA authorizations for uses beyond treatment, payment, and operations * Granular consent for optional features * Parental consent for minors where required * Opt-in consent for marketing communications ## 7. USE OF INFORMATION ### 7.1 Primary Service Delivery * Real-time medical transcription and documentation * Clinical note generation and structuring * Medical coding assistance and validation * Integration with healthcare IT systems * Provider workflow optimization * Quality assurance and accuracy improvement * **Standalone Assistant chat**: answering clinical questions you submit through the persistent Assistant chat surface, retrieving relevant excerpts from public medical literature sources, returning AI-generated responses with literature citations, persisting the resulting conversations so you can list, resume, and review them later, and providing the conversation-history context required to generate coherent multi-turn answers within a conversation ### 7.2 AI and Machine Learning * Training and improving transcription models * Enhancing medical terminology recognition * Developing clinical intelligence features * Reducing bias and improving fairness * Creating specialty-specific models * Generating aggregate insights (fully de-identified) ### 7.3 Security and Compliance * Identity verification and authentication * Fraud detection and prevention * Security incident investigation * HIPAA compliance auditing * Regulatory reporting obligations * Risk assessment and mitigation ### 7.4 Business Operations * Billing and payment processing * Customer support and service * Product development and improvement * Analytics and performance monitoring * Legal compliance and dispute resolution * Corporate transactions (with appropriate safeguards) ## 8. DISCLOSURE AND SHARING ### 8.1 Healthcare Ecosystem Sharing We share information within the healthcare ecosystem solely as permitted by HIPAA and applicable law: * Referring and consulting physicians * Healthcare facilities and hospitals * Laboratories and imaging centers * Pharmacies (for medication-related information) * Health information exchanges (HIEs) * Accountable care organizations (ACOs) ### 8.2 Service Provider Disclosures We engage carefully vetted service providers under strict contractual obligations: * Cloud infrastructure providers (Google Cloud Platform) * AI/ML processing services (Google Cloud Vertex AI, Amazon Bedrock - with BAAs where applicable) * Content delivery and security services (Cloudflare) * Payment processors (Stripe - PCI-DSS Level 1 compliant) * **Demo scheduling**: Cal.com (open-source, self-hosted on Transcribe Health infrastructure in Canada). When you book a product demo via our `/demo` page, your name, email address, optional booking responses, and selected meeting time are stored on this self-hosted instance. * **Calendar synchronization**: Google Workspace and Google Calendar API (United States). Demo meeting events are synced to a Transcribe Health staff member's Google Calendar so they can host the meeting; Google receives the attendee name, email, and meeting time. * **Authentication and Sign-In Services**: Google Identity Services / Google Sign-In (United States). When you visit our sign-in or sign-up pages, we may display a Google "One Tap" prompt if you are signed into a Google account in your browser. Loading this prompt involves loading code from `accounts.google.com`; Google receives your IP address, user-agent, and the fact that you visited our authentication page. We load Google Identity Services only on `/signin` and `/signup` — not on any other page of our site. The same applies if you click the "Sign in with Google" button. You can disable Google One Tap in your Google account settings or by signing out of your Google account in this browser. * **Transactional email delivery**: Purelymail (United States). Booking confirmations, password reset emails, and similar service messages are routed through this SMTP relay. * Customer support and live chat: Chatwoot (open-source, self-hosted on Transcribe Health infrastructure in Canada). * Security and monitoring services * Professional service firms (under confidentiality) ### 8.2.1 Subprocessors For the canonical, continuously-maintained list of our subprocessors under GDPR Art. 28(2) and the equivalent obligations under PIPEDA Principle 4.8 and HIPAA Business Associate arrangements, please refer to our public Trust Center: [trust.transcribe.health/subprocessors](https://trust.transcribe.health/subprocessors) The Trust Center is the source of truth; the list in § 8.2 is a non-exhaustive summary that may lag the Trust Center between policy revisions. Material changes (adding a new subprocessor that processes ePHI or personal data of EU/Canada/California residents) trigger an advance notice through the agreement-update process described in § 24. **AI-inference subprocessors and cross-border processing.** Our AI inference, transcription, clinical-note generation, and Assistant features transmit content to two AI subprocessors at the moment of processing: **Google Cloud (Vertex AI)** and **Amazon Web Services (Amazon Bedrock)**. Both process Protected Health Information under a Business Associate Agreement and under zero-retention terms (they retain nothing after a request completes and do not train on your data). Amazon Bedrock inference runs exclusively in the AWS Canada (Central) region (ca-central-1); Bedrock never transmits your content outside Canada. The Claude AI models offered through the Services are accessed exclusively through Amazon Bedrock, which isolates your content from the underlying model provider: we have no direct Anthropic API relationship, and Anthropic does not process your data and is not a subprocessor. To the extent this AI-inference flow involves processing of Quebec residents' personal information outside Quebec, it is among the cross-border flows covered by the Privacy Impact Assessment we maintain under Quebec Law 25 (see § 8.2.2). This naming of the AI-inference flow is consistent with our Trust Center and with Schedule C of our Data Processing Agreement. **Per-organization AI residency (your choice).** Cross-border AI inference is a per-organization setting, not an automatic default. By default, each organization's clinical AI inference stays in the country where the organization operates. For organizations in Canada, clinical AI runs on models hosted within Canada (Google Cloud Vertex AI in its Montréal region, or models we host on our own Canadian infrastructure), and content is not sent to a United States region. For organizations in the United States, clinical AI runs on Google Cloud Vertex AI in a United States region (see § 11.1.1). An organization owner or administrator may opt in to **enhanced cross-border AI**, which allows clinical inference to be served by Google Cloud Vertex AI in the other country (for a Canadian organization, a United States region) when the in-country service cannot serve a request, under the Google Cloud Business Associate Agreement and Standard Contractual Clauses. This election is recorded (with the version of this disclosure that was accepted) and is reversible at any time; the transfer is governed by the Business Associate Agreement and Standard Contractual Clauses described above and is assessed under our Quebec Law 25 privacy-impact-assessment process (§ 8.2.2). Where a Canadian organization has not enabled cross-border AI, its clinical inference stays in Canada. ### 8.2.2 Cross-Border Data Transfers Our primary infrastructure resides in Canada. Some of the service providers listed above process limited personal information in the United States — specifically Google Workspace (calendar synchronization), Google Identity Services (authentication / Sign in with Google / One Tap), and Purelymail (transactional email delivery). For these transfers, we rely on the providers' published Data Processing Addenda and Standard Contractual Clauses where applicable. For Quebec residents, we maintain a Privacy Impact Assessment under Quebec Law 25 (§ 3.3 and § 17) covering these flows. You may request a summary by contacting our Security Officer. ### 8.3 Legal and Regulatory Disclosures We may disclose information when required by: * Court orders, subpoenas, or legal process * Government investigations or audits * Public health authorities * Health oversight agencies * Law enforcement (with appropriate legal basis) * National security or intelligence agencies ### 8.4 Business Transfers In connection with any merger, acquisition, or sale of assets: * Due diligence under strict confidentiality * Successor entities bound by this Policy * Notice provided of any material changes * Opportunity to request data deletion where permitted * Continued protection under applicable BAAs ## 9. DATA SECURITY AND SAFEGUARDS ### 9.1 Technical Security Measures We implement industry-leading security including: * **Encryption**: AES-256 at rest, TLS 1.3+ in transit * **Client-side encryption (Chrome extension)**: where our Chrome extension captures clinical-encounter audio, audio is encrypted in the browser before transmission, so ciphertext rather than plaintext crosses the network. Encryption keys are session-scoped and never leave your device. * **Tamper-evident audit log**: extension-side audit log entries are integrity-protected so that local tampering with the audit trail is detectable on upload reconciliation. * **Multi-Factor Authentication**: Required for all PHI access * **Network Security**: Next-generation firewalls, IDS/IPS, DDoS protection * **Endpoint Protection**: Company workstations are enrolled in device management with continuous security posture checks (full-disk encryption, screen lock, firewall, operating-system updates) * **Vulnerability Management**: Continuous scanning and patching * **Secure Development**: SAST, automated dynamic application security testing (OWASP ZAP), dependency scanning ### 9.2 Administrative Safeguards * Security officer designation and responsibilities * Security awareness training for all authorized personnel, scheduled in the compliance calendar * Access management and least privilege principles * Sanction policies for violations * Regular risk assessments and audits * Business continuity and disaster recovery plans * Incident response procedures ### 9.3 Physical Security * Production servers located in a locked, access-controlled server room in Canada, with physical access restricted to authorized personnel * Video monitoring of the server room * Smoke and fire detection, dedicated cooling, and an uninterruptible power supply (UPS) * Production storage encrypted at rest, with encryption keys escrowed separately from the storage they protect * Backups kept on separate, dedicated backup storage with immutable retention * Components hosted on Google Cloud Platform or Amazon Web Services rely on the physical safeguards of those providers' data centers, which the providers have independently audited (SOC 2 Type II, ISO 27001) * Media disposal and sanitization procedures * Workstation security policies ### 9.4 Compliance Program Our compliance program includes: * HIPAA Security Rule and Privacy Rule compliance (active) * SOC 2 Trust Services Criteria (controls designed and operated to the criteria; preparing for a Type II examination, and once issued the report will be made available to customers under a non-disclosure agreement) * PIPEDA and provincial health privacy legislation compliance (active) * NIST Cybersecurity Framework alignment (active) * ISO/IEC 27001 alignment (information security management practices) ## 10. DATA RETENTION AND DELETION ### 10.1 Retention Periods The Services are not a system of record. We retain Personal Information only as long as needed to deliver the Services and meet our legal obligations. The table below states the retention period and the justification for each category. Healthcare providers remain responsible for retaining patient records in their own certified medical-record system per applicable law. | Data category | Retention period | Basis / justification | |---|---|---| | **Audio recordings (clinical-encounter audio)** | Automatically and permanently deleted **90 days** after transcription completes. Your organization may optionally enable earlier auto-deletion in **1-30 day** windows (disabled by default). | Default mandatory window enforced platform-wide; optional earlier window supports data-minimization (GDPR Art. 5(1)(e), PIPEDA Principle 4.5, Quebec Law 25). | | **Transcriptions and session records (contain PHI)** | Retained **7 years**, then automatically deleted (subject to a 6-year HIPAA minimum). | HIPAA documentation floor; provider record-keeping support. | | **AI-generated clinical notes / documents (contain PHI)** | Same as the transcript they derive from (**7 years**, optional earlier deletion as above). | Treated as part of the clinical record produced from the encounter. | | **Assistant conversations** (questions, AI responses, citations, history) | Persist until you delete them or **30 days** after account closure. | Service delivery (you can resume conversations); minimized to the active relationship. | | **Dictations** (global dictation: speech you dictate into a text field in the web app, desktop app, or Chrome extension, the text it produces, and up to 1,000 characters of the text around your cursor) | **Audio:** deleted once transcription finishes, normally within a few minutes and in all cases within about **20 minutes** of recording. **Text around your cursor** (sent only to improve accuracy): deleted when transcription finishes, and in all cases within about **20 minutes**; never kept in your dictation history. **Dictated text:** kept in your personal dictation history for the period you choose: off, **1**, **7**, or **30 days** (default **7 days**), then deleted. Your dictation history is visible only to you, and you can delete a single dictation or clear your whole history at any time. With history off, the text is deleted a few minutes after it is inserted (in all cases within about **20 minutes**). **Dictation record without text** (for example, the app you dictated from and whether the dictation succeeded or failed): deleted after **24 hours**, or at the end of your history period if that is later. Dictation records are deleted when your user account or your organization's account is deleted or when you ask us to erase your data, and stored dictation text is included when you ask for access to or a copy of your data. | Service delivery; data minimization and storage limitation, with the history period under your control (GDPR Art. 5(1)(c) and 5(1)(e), PIPEDA Principle 4.5, Quebec Law 25). Dictation is transcribed by speech models we run in our own Canadian infrastructure; no third party receives dictation audio or text. Dictated text you insert into a clinical note becomes part of that note and follows the note's retention period above. | | **Patient form drafts** (answers saved automatically before a patient submits a form) | Replaced by the submitted answers when the patient submits. If the form is never submitted, deleted **30 days** after the link expires or is cancelled. | Lets the patient finish later; data minimization and storage limitation (GDPR Art. 5(1)(c) and 5(1)(e), PIPEDA Principle 4.5, Quebec Law 25). | | **Submitted patient forms** (answers, scores, flags, completed PDFs) | Kept with the patient's record in the Services until the practice deletes that patient or the practice's account ends. Deleting a patient deletes their answers, drafts and completed PDFs. On termination, return or destruction follows the Business Associate Agreement. | Part of the practice's clinical record. The practice sets its own record-retention period under the law that applies to it and should keep a copy in its own medical record system (see BAA § 1.5). | | **Patient form consent and signature records** (form version, consent wording reference, date and time, hashed IP address and browser details) | Kept after the patient is deleted, **without** the signer's name or drawn signature, as proof that consent was given; deleted when the practice's account data is deleted. | Establishing, exercising or defending legal claims and meeting record-keeping obligations (GDPR Art. 17(3)(b) and (e); Quebec Law 25 s. 23; HIPAA 45 CFR 164.530(j)). | | **Chrome-extension audit / telemetry metadata** (session ID, EHR detected, version, timestamps, integrity hashes) | Server-side: **6 years** on the same basis as other PHI-access logs. On-device: limited rolling window, purged automatically. | HIPAA audit-control requirement, 45 CFR 164.312(b). | | **Account data** (provider profile, credentials, preferences) | Duration of the account; deleted within **30 days** of account closure, except where law requires retention. | Service delivery and contract. | | **Billing data** (via Stripe) | Retained as required by tax / financial-record law (typically **7 years**). | Legal obligation; Stripe processes billing only. | | **Cal.com demo-booking data** (name, email, responses, meeting time) | Retained for **24 months** after the demo, then deleted; deleted earlier on request. | Self-hosted in Canada; pre-sales contact, storage-limitation default. | | **Marketing data** | Until consent withdrawal, plus any period required by law. | Consent (opt-in). | | **CASL suppression list** (unsubscribed recipients) | **Indefinite.** | Required to honour unsubscribe requests under Canada's Anti-Spam Law (CASL § 6). | | **Audit logs (security / HIPAA)** | Minimum **6 years**. | HIPAA Security Rule documentation retention, 45 CFR 164.312(b) and 164.530(j). | | **De-identified / aggregate data** | May be retained indefinitely. | No longer Personal Information once de-identified to the HIPAA standard. | **Account closure and PHI.** Except for dictation history, closing an account does not shorten any PHI-retention period. The mandatory 90-day audio, 7-year transcript/clinical-note, and 6-year audit-log periods run to completion regardless of account status. Dictation history is personal to each user: it is never kept longer than the period that user chose (at most 30 days), and it is deleted earlier when the user's account or the organization's account is deleted, or when the user's data is erased on request. On termination, final disposition of Protected Health Information (return or destruction) follows the return-or-destroy provision of the applicable Business Associate Agreement, not the account-closure timelines above. HIPAA does not itself prescribe a minimum retention period for PHI in patient records; the record-retention obligations applicable to your practice are set by state, provincial, and professional regulations. The residual-backup treatment in § 10.2 applies to all categories above and does not extend any of these periods; residual encrypted backups age out on a bounded cycle. ### 10.2 Deletion and Disposal * Cryptographic erasure for encrypted data * Physical destruction of storage media * Secure overwriting procedures * Certificate of destruction provided * Audit trail of deletion activities * Third-party verification where applicable When data is deleted from our active systems under Section 10.1 or in response to a deletion request, residual copies may persist in our encrypted backups until those backup sets expire on their normal schedule (object-storage backups within 30 days; database backups within 14 days). Individual records cannot be excised from an encrypted backup snapshot; backups are encrypted, access-controlled, and disposed of using the methods above when they age out. This residual-backup window is the standard treatment for backup media under HIPAA and PIPEDA and does not extend the retention periods described in Section 10.1. ## 11. INTERNATIONAL DATA TRANSFERS ### 11.1 Data Residency Our production environment runs on a single Canadian-resident infrastructure stamp: * All Personal Health Information at rest — Postgres records, MinIO object storage, Redis caches, audit logs — lives on Canadian infrastructure under PIPEDA / Quebec Law 25 * Audio transcription (speech-to-text) runs on self-hosted infrastructure within the Canadian stamp; raw audio never leaves Canada * AI inference jurisdiction is decoupled from at-rest residency and depends on your organization's country and AI residency setting (see Sections 8.2.1 and 11.1.1) US and EU stamps are on our roadmap. They will be deployed when customer demand contractually requires US-only or EU-only residency. Until those stamps exist, US customers may operate on the Canadian stamp under a cross-border Data Processing Agreement (DPA) executed at onboarding. EU residency is not currently available; please contact us if you require it. ### 11.1.1 AI Inference Routing AI inference is routed according to the organization's country of operation and its AI residency setting (§ 8.2.1), independent of where the at-rest data lives. The route is logged on every clinical AI request: * Canadian organizations: clinical AI inference runs on models hosted within Canada (Google Cloud Vertex AI in its Montréal region, or models we host on our own Canadian infrastructure); no cross-border processing unless the organization has opted in to enhanced cross-border AI (§ 8.2.1) * United States organizations: clinical AI inference runs on Google Vertex AI in a US region under the executed Google Cloud Business Associate Agreement; because at-rest data is held in Canada, this is a documented cross-border processing leg covered by the customer's DPA. A United States organization that has opted in to enhanced cross-border AI may also have a request served by Google Cloud Vertex AI in Canada when the US service cannot serve it * Other jurisdictions: clinical AI inference is not routed outside the organization's country, so clinical AI features are available only where an in-country AI service exists; coverage is added per region as it becomes available ### 11.2 Transfer Mechanisms When international transfers occur: * Standard Contractual Clauses (EU Commission approved) * Adequacy decisions where applicable * Binding Corporate Rules for intra-group transfers * Explicit consent for specific transfers * Derogations for vital interests or legal claims ### 11.3 Transfer Safeguards * End-to-end encryption for all transfers * Transfer impact assessments * Supplementary measures per Schrems II * Government access transparency reporting * Enhanced contractual guarantees ## 12. YOUR PRIVACY RIGHTS ### 12.1 HIPAA Rights The rights below derive from HIPAA. **Note:** the formal vehicle for these rights is your healthcare provider's Notice of Privacy Practices, not this Policy (see the callout in § 2). Where Transcribe Health holds your PHI as a Business Associate, we support your provider in honouring these rights: * Access your PHI and receive copies * Request amendments to incorrect PHI * Accounting of disclosures * Request restrictions on uses and disclosures * Confidential communications * File complaints with OCR ### 12.2 GDPR Rights (EU/EEA Residents) * Access (Article 15) * Rectification (Article 16) * Erasure/"Right to be Forgotten" (Article 17) * Restriction of processing (Article 18) * Data portability (Article 20) * Object to processing (Article 21) * Automated decision-making rights (Article 22) — see § 5.6 for our ADMT disclosure ### 12.3 CCPA/CPRA Rights (California Residents) **Transcribe Health does not sell or share personal information, and does not use sensitive personal information for any purpose other than providing the Services and purposes the CPRA exempts from the right to limit.** We nonetheless honour the following rights and provide the controls described below. * Know what information we collect * Delete personal information * Correct inaccurate information * Opt out of the sale or sharing of personal information * Limit the use of sensitive personal information * Non-discrimination for exercising your rights **Opt-out control.** Although we do not sell or share personal information, we provide an opt-out control regardless. If you have a Transcribe Health account, you can set your opt-out preference at any time from your account's **Privacy & Data Rights** settings, using the **"Do Not Sell or Share My Personal Information"** control. When you opt out, we display a confirmation of your opt-out status and the date it took effect; you may opt back in after the 12-month period required by California law. **Limit the use of sensitive personal information.** Because we use sensitive personal information solely to provide the Services and for purposes the CPRA exempts from the right to limit, no separate limitation is required for those uses. We do not use sensitive personal information to infer characteristics about you. **Global Privacy Control (GPC).** We honour the Global Privacy Control browser signal. If your browser or extension sends a GPC signal (the `Sec-GPC` header), we treat it as a valid request to opt out of any sale/sharing of personal information and reflect your opted-out status accordingly; the status is shown to you so you can confirm it has been applied. To make any CCPA/CPRA request you may also contact us at privacy@transcribe.health (see § 12.5 and § 23). ### 12.4 PIPEDA Rights (Canadian Residents) * Access personal information * Challenge accuracy and completeness * Withdraw consent * Register complaints with Privacy Commissioner * Know about breaches affecting you * For Quebec residents: the right to be informed of, and to submit observations on, automated decisions based on your personal information (Law 25 § 12.1) — see § 5.6 ### 12.5 Exercising Your Rights * Submit requests to: privacy@transcribe.health * Identity verification required * Response within 30 days (45 for complex requests) * No fee for reasonable requests * Appeal process available * Designated agent submissions accepted with authorization ### 12.6 Requests About Information a Practice Collects Through Us For patient forms, online booking, clinical-encounter recordings and other patient information we hold for a healthcare practice, the practice is the organization responsible for that information (the controller under GDPR, the covered entity under HIPAA, and the organization or enterprise responsible under PIPEDA, Quebec Law 25 and provincial law). Patients should send requests to see, correct or delete that information, or to withdraw consent, to the practice. The practice can view, export and delete a patient's form answers in the Services. If you send such a request to us, we will tell you which practice to contact where we can, forward the request to the practice without undue delay, and help the practice respond. Contacting us instead of the practice does not mean your request is lost. You may still contact our privacy officer (§ 23) or a privacy regulator at any time. ## 13. CHILDREN'S PRIVACY ### 13.1 Age Restrictions * The Services are a professional tool for healthcare providers and are **not directed to children**. We do not knowingly collect personal information directly from children for our own purposes. * **United States (COPPA):** we do not knowingly collect personal information from children under 13 for our own commercial purposes. * **EU/EEA/UK (GDPR Art. 8):** where a child's consent is the basis for an online service, the digital-consent age ranges from **13 to 16** depending on the Member State; below that age, consent must be given or authorised by the holder of parental responsibility. * **Quebec (Law 25):** for a minor **under 14**, any collection of personal information requires the consent of the person having parental authority, except where collection is clearly for the minor's benefit. * **California (CCPA/CPRA):** because we do not sell or share personal information, this restriction does not arise in practice; were it to, we would not sell or share the personal information of consumers we know to be under 16 without affirmative authorization (from the minor if 13-15, or from a parent/guardian if under 13). * Patient PHI relating to minors is processed only on behalf of, and under the authority of, the healthcare provider, whose own Notice of Privacy Practices and applicable health-records law govern parental access and adolescent-confidentiality rules. ### 13.2 Parental Rights * Access to minor's information (subject to state law) * Consent management for minor patients * Restrictions on sensitive health topics per jurisdiction * Transition procedures at age of majority ## 14. COOKIES AND TRACKING TECHNOLOGIES ### 14.1 Cookies and Similar Technologies We Use We use a minimal set of cookies. We do **not** use advertising cookies, and we do not load third-party analytics or marketing trackers on our marketing site. The table below lists the cookies set in connection with the Services. | Cookie | Provider | Purpose | Duration | Party | |---|---|---|---|---| | `access_token` | Transcribe Health (auth-service) | Strictly necessary, holds your authenticated session (HttpOnly, Secure). | Session / short-lived | First-party | | `refresh_token` | Transcribe Health (auth-service) | Strictly necessary, renews your session without re-login (HttpOnly, Secure). | Up to session-renewal window | First-party | | `browser_id` | Transcribe Health (auth-service) | Strictly necessary, account security (HttpOnly, Secure, SameSite=Lax). A random value with no personal details, set when you sign in or your session renews. It lets us tell whether two attempts to renew the same sign-in came from the same browser, so a stolen session token used from another browser is detected and the session is ended. It stays after you sign out so this check keeps working the next time you sign in. A hashed copy is held briefly in our session-security records. | 400 days | First-party | | `NEXT_LOCALE` | Transcribe Health | Functionality, remembers your language/region (e.g. en-US, en-CA, fr-CA). | Persistent (until changed) | First-party | | `__cf_bm`, `cf_clearance` | Cloudflare | Strictly necessary, bot-management and security for our CDN/WAF. | Up to ~30 min / as set by Cloudflare | Third-party (infrastructure) | The `browser_id` cookie is set only for people who sign in to the Services. Patients who fill in forms or book appointments through a practice link do not sign in and do not receive it, and the patient forms page sets no cookies of its own. Strictly-necessary cookies do not require consent. Where any non-essential cookie is introduced in the future, we will obtain consent first where required (ePrivacy/GDPR, Quebec Law 25, CPRA). ### 14.2 Your Choices * Cookie consent management platform * Browser-based controls * Global Privacy Control (GPC) signals honored * Do Not Track (DNT) signal response * Opt-out of analytics via hello@transcribe.health ## 15. AI TRANSPARENCY AND ETHICS ### 15.1 AI Principles We commit to: * **Transparency**: Clear disclosure of AI use * **Fairness**: Regular bias testing and mitigation * **Accountability**: Human oversight of AI decisions * **Privacy by Design**: Privacy considered at every stage * **Beneficence**: AI used to improve healthcare outcomes * **Non-maleficence**: Do no harm principle ### 15.2 Clinical Decision Support Disclaimer **IMPORTANT**: Our AI-generated clinical insights are provided for informational purposes only and do not constitute medical advice. Healthcare providers retain full responsibility for clinical decisions. AI outputs must be reviewed and validated by qualified medical professionals before use in patient care. ### 15.3 Research and Development * Research conducted on de-identified data only * IRB approval for research involving PHI * Publication only of aggregate results * Opt-in participation for specific research * Right to withdraw from research uses ## 16. DATA BREACH NOTIFICATION ### 16.1 Breach Response Procedures In the event of a breach: * Immediate investigation and containment * Risk assessment and harm evaluation * Notification within HIPAA required timeframes (60 days for individual notification under 45 C.F.R. §164.404) * GDPR notification within 72 hours where applicable to a supervisory authority * Individual notice via email and certified mail * Regulatory reporting to HHS, state attorneys general * Credit monitoring offered where appropriate **Where Transcribe Health acts as a Business Associate, breach notification to the Covered Entity is governed by the applicable Business Associate Agreement, which requires notice within five (5) business days of discovery.** This BA-to-Covered-Entity obligation is separate from, and does not displace, the regulator- and individual-facing notification timelines described above. ### 16.2 Breach Prevention * Continuous security monitoring * Periodic security assessment (an internal white-box assessment was completed; an independent third-party penetration test is planned), scheduled in the compliance calendar * Employee security training * Vendor risk assessments * Incident response drills * Cyber-liability insurance (being procured; no coverage amount stated until a policy is bound) ## 17. LIMITATION OF LIABILITY AND INDEMNIFICATION ### 17.1 LIMITATION OF LIABILITY **TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, AND EXCEPT FOR RIGHTS AND REMEDIES THAT CANNOT BE LIMITED OR WAIVED UNDER APPLICABLE LAW (INCLUDING NON-WAIVABLE RIGHTS UNDER GDPR/UK GDPR, CCPA/CPRA, PIPEDA, QUEBEC LAW 25, BC PIPA, ALBERTA PIPA, AND HIPAA), IN NO EVENT SHALL TRANSCRIBE HEALTH, ITS OFFICERS, DIRECTORS, EMPLOYEES, AGENTS, AFFILIATES, OR LICENSORS BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, PUNITIVE, OR EXEMPLARY DAMAGES, INCLUDING BUT NOT LIMITED TO DAMAGES FOR LOSS OF PROFITS, REVENUE, GOODWILL, USE, DATA, OR OTHER INTANGIBLE LOSSES, ARISING OUT OF OR RELATING TO THIS POLICY OR THE SERVICES, REGARDLESS OF THE THEORY OF LIABILITY AND WHETHER OR NOT TRANSCRIBE HEALTH HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.** **Aggregate cap.** To the maximum extent permitted by applicable law, our total aggregate liability arising out of or relating to this Policy or the Services shall not exceed the total fees paid by your organization to Transcribe Health in the trailing twelve (12) months preceding the event giving rise to the claim. **Protected Health Information.** This aggregate cap does not apply to, and does not govern, liability for Protected Health Information. The handling of Protected Health Information, and the parties' respective liability for it, is governed exclusively by the applicable Business Associate Agreement (which, per BAA v2026.06, applies the general contractual liability cap with no PHI-specific supercap). Nothing in this Policy limits or excludes any liability that cannot be limited or excluded under applicable law, or any statutory privacy right that the law makes non-waivable. ### 17.2 Indemnification You agree to defend, indemnify, and hold harmless Transcribe Health and its affiliates from and against any claims, damages, losses, and expenses (including reasonable attorneys' fees) arising out of or relating to: * Your violation of this Policy * Your violation of applicable laws or regulations * Your use of the Services in a manner not authorized by this Policy * Any content or data you provide through the Services * Your violation of any third-party rights ### 17.3 Healthcare-Specific Exclusions We expressly disclaim liability for: * Clinical decisions made using our Services * Medical malpractice or professional liability claims * Accuracy of AI-generated clinical insights * Integration failures with third-party systems * Compliance with your specific regulatory obligations ## 18. DISCLAIMERS AND WARRANTIES ### 18.1 Service Disclaimer THE SERVICES ARE PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED. WE SPECIFICALLY DISCLAIM ALL WARRANTIES, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. ### 18.2 Medical Disclaimer WE DO NOT PROVIDE MEDICAL ADVICE. THE SERVICES ARE TOOLS TO ASSIST HEALTHCARE PROVIDERS AND DO NOT REPLACE PROFESSIONAL MEDICAL JUDGMENT. WE ARE NOT RESPONSIBLE FOR ANY MEDICAL DECISIONS, DIAGNOSES, OR TREATMENTS BASED ON THE USE OF OUR SERVICES. ### 18.3 Accuracy Disclaimer WHILE WE STRIVE FOR HIGH ACCURACY, WE DO NOT GUARANTEE 100% ACCURACY IN TRANSCRIPTION OR AI-GENERATED CONTENT. ALL OUTPUT MUST BE REVIEWED AND VALIDATED BY QUALIFIED HEALTHCARE PROFESSIONALS. ## 19. QUALITY IMPROVEMENT AND HEALTHCARE OPERATIONS ### 19.1 Quality Improvement Programs We may use de-identified data for: * Improving transcription accuracy * Enhancing clinical documentation quality * Developing specialty-specific models * Benchmarking and performance metrics * Population health management * Healthcare cost analysis ### 19.2 Healthcare Operations Support Our Services support your healthcare operations including: * Quality assessment and improvement * Patient safety activities * Protocol development * Case management and care coordination * Practice management activities * Accreditation and licensing ## 20. DISPUTE RESOLUTION AND GOVERNING LAW ### 20.1 Dispute Resolution Except where prohibited by applicable law, and **excluding any claim or right that applicable law makes non-waivable or non-arbitrable** (including statutory privacy claims and any right to lodge a complaint with a supervisory or data-protection authority), disputes arising out of or relating to this Policy or the Services may be resolved through binding arbitration administered by the ADR Institute of Canada (for Canadian residents) or the American Arbitration Association (for U.S. residents), seated in Ontario, Canada. **Nothing in this Section prevents you from lodging a complaint with a data-protection or privacy regulator** (including the OPC, the Commission d'accès à l'information du Québec, the BC or Alberta OIPC, the CNIL or another EU supervisory authority, the UK ICO, the California Privacy Protection Agency or Attorney General, or HHS/OCR), or from exercising any non-waivable statutory right, regardless of this arbitration provision. ### 20.2 Class Action Waiver To the extent permitted by applicable law, you agree to bring claims against us only in your individual capacity. This waiver does not apply to any claim or representative action that applicable law makes non-waivable (including representative actions available under certain consumer-protection statutes). ### 20.3 Governing Law This Policy shall be governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein, without regard to its conflict of law principles. For international users, local mandatory consumer protection laws may apply. ### 20.4 Venue Exclusive venue for any dispute not subject to arbitration shall be the courts located in Ontario, Canada. ### 20.5 Time Limitation You must bring any claim within one (1) year after the cause of action arises, or such claim is forever barred. ## 21. REGULATORY COMPLIANCE ### 21.1 United States Compliance * HIPAA Privacy, Security, and Breach Notification Rules * HITECH Act requirements * 42 CFR Part 2 (substance abuse records) * State medical records laws * CCPA/CPRA (California) * Biometric privacy laws (Illinois BIPA, Texas, Washington) * State breach notification laws ### 21.2 Canadian Compliance * PIPEDA (federal) * Ontario: Personal Health Information Protection Act, 2004 (PHIPA) * Quebec: the **Act respecting the protection of personal information in the private sector**, as amended by the Act to modernize legislative provisions as regards the protection of personal information (**Law 25**) * Alberta: Health Information Act (HIA) * British Columbia: Personal Information Protection Act (PIPA BC) * Saskatchewan: Health Information Protection Act (HIPA) * Manitoba, New Brunswick, Newfoundland and Labrador: Personal Health Information Acts (PHIA) * Nova Scotia, PEI, Territories: PIPEDA as applicable federal legislation ### 21.3 International Compliance * GDPR (European Union) - applicable when serving EU-based users * UK Data Protection Act - applicable when serving UK-based users * Other applicable national laws as required by jurisdiction ### 21.4 Industry Standards * HL7 FHIR specifications * ONC certification requirements * NIST Cybersecurity Framework * ISO 27001/27799 standards * Cloud Security Alliance guidelines ## 22. PRIVACY PROGRAM GOVERNANCE ### 22.1 Privacy by Design We implement privacy by design principles: * Proactive not reactive * Privacy as default setting * Full functionality with privacy * End-to-end security * Visibility and transparency * Respect for user privacy * Privacy embedded into design ### 22.2 Privacy Impact Assessments We conduct assessments for: * New features and services * AI model deployments * Third-party integrations * International data transfers * High-risk processing activities ### 22.3 Transparency Reporting We publish annual transparency reports including: * Government data requests * Law enforcement requests * Breach statistics (anonymized) * Privacy rights requests * Third-party audit results ## 23. CONTACT INFORMATION ### Person Responsible for the Protection of Personal Information (Quebec Law 25 § 3.1) The person responsible for the protection of personal information at Transcribe Health is **Fatih AKTAS**, Founder and Security Officer, reachable at privacy@transcribe.health. ### Security Officer For privacy-related inquiries, data subject rights requests, or concerns about our privacy practices: **Security Officer** Transcribe Health Corporation Email: privacy@transcribe.health (preferred for data-subject rights, DPIA / PIA requests, and sub-processor enquiries) Email: hello@transcribe.health (general contact) Response Time: Within 48 business hours ### Additional Contacts For comprehensive contact information including security incidents, legal inquiries, compliance matters, and audit support, please visit our [Compliance page](/compliance). ### Regulatory Authorities **Office of the Privacy Commissioner of Canada** 30 Victoria Street, Gatineau, Quebec K1A 1H3 Toll-free: 1-800-282-1376 Website: www.priv.gc.ca **U.S. Department of Health and Human Services** Office for Civil Rights 200 Independence Avenue, S.W., Washington, D.C. 20201 Toll-free: 1-877-696-6775 Website: www.hhs.gov/ocr **European Data Protection Authorities** For EU/EEA residents: Contact your local supervisory authority Directory: https://edpb.europa.eu/about-edpb/board/members_en **Information Commissioner's Office (ICO) — United Kingdom** For UK residents: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom Helpline: +44 (0)303 123 1113 Website: ico.org.uk ## 24. CHANGES TO THIS POLICY ### 24.1 Right to Modify We may modify this Policy from time to time. For any **material change**, the change takes effect only after the advance-notice period described in § 24.2. Non-material changes (such as typographical corrections or clarifications that do not reduce your rights or change how we handle your information) may take effect upon posting, with the "Last Updated" date revised accordingly. ### 24.2 Notice of Material Changes For material changes, we will: * Email notice to registered users * In-app notifications * Banner notice on website * 30-day advance notice for material adverse changes ### 24.3 Continued Use For material changes, your continued use of the Services after the 30-day notice period (and any required re-acceptance) constitutes acceptance of the modified Policy. If you disagree with a material change, you must discontinue use before it takes effect. ### 24.4 Version History Previous versions available upon written request to hello@transcribe.health. We maintain a complete version history for compliance purposes. ## 25. SEVERABILITY AND WAIVER ### 25.1 Severability If any provision of this Policy is found to be unenforceable or invalid, that provision shall be limited or eliminated to the minimum extent necessary, and the remaining provisions shall remain in full force and effect. ### 25.2 Waiver No waiver of any term of this Policy shall be deemed a further or continuing waiver of such term or any other term, and our failure to assert any right or provision shall not constitute a waiver of such right or provision. ## 26. FORCE MAJEURE We shall not be liable for any failure or delay in performance under this Policy which results from any cause beyond our reasonable control, including but not limited to acts of God, natural disasters, war, terrorism, riots, embargoes, acts of civil or military authorities, fire, floods, accidents, pandemics, strikes, or shortages of transportation facilities, fuel, energy, labor, or materials. ## 27. ASSIGNMENT You may not assign or transfer any rights or obligations under this Policy without our prior written consent. We may assign our rights and obligations without restriction. ## 28. ENTIRE AGREEMENT This Policy, together with our Terms of Service and any applicable BAA, constitutes the entire agreement between you and Transcribe Health regarding privacy and data protection, and supersedes all prior and contemporaneous understandings, agreements, representations, and warranties. ## 29. SURVIVAL Sections relating to limitation of liability, indemnification, disclaimers, dispute resolution, and any other provisions that by their nature should survive, shall survive any termination or expiration of this Policy. ## 30. ACKNOWLEDGMENT AND ACCEPTANCE **BY USING THE SERVICES, YOU ACKNOWLEDGE THAT YOU HAVE READ THIS PRIVACY POLICY, UNDERSTAND IT, AND AGREE TO BE BOUND BY ALL OF ITS TERMS AND CONDITIONS. IF YOU ARE ACCEPTING ON BEHALF OF AN ORGANIZATION, YOU REPRESENT AND WARRANT THAT YOU HAVE THE AUTHORITY TO BIND SUCH ORGANIZATION.** --- **© 2024-2026 Transcribe Health Corporation. All rights reserved.** --- **EFFECTIVE DATE: December 1, 2024** **LAST UPDATED: December 1, 2026** **VERSION: v2026.10.1** **DOCUMENT ID: POL-PRIV-2024-001** --- # Terms of Service --- **TERMS OF SERVICE** Last Updated: December 1, 2026 Version v2026.6.1 1. **INTRODUCTION** Transcribe Health Corporation, a corporation incorporated under the federal laws of Canada ("Transcribe Health", "we", "us", or "the Company") provides an AI-powered medical transcription platform (the "Services") that enables medical professionals to record, transcribe, and share patient conversations. These Terms of Service ("Terms") constitute a legally binding agreement between Transcribe Health and any individual or entity ("User", "you", or "your") who accesses or uses the Services. By accessing, registering for, or using the Services in any way, you expressly acknowledge that you have read, understood, and agree to be bound by these Terms and our Privacy Policy. 2. **DEFINITIONS** For the purposes of these Terms, the following definitions shall apply: * "Authorized User" means any individual who is authorized by you to use the Services on your behalf, including your employees, contractors, and agents. * "Services" means the AI-powered clinical documentation and clinical-intelligence platform provided by Transcribe Health, including, without limitation, the medical transcription product, the AI-generated clinical-note product, the standalone Assistant chat (a persistent chat surface where Authorized Users may submit clinical questions and receive AI-generated answers with citations to public medical literature), the Transcribe Health Medical Scribe Chrome extension (a browser-side component that captures and client-side-encrypts clinical-encounter audio, integrates with supported EHR systems, and inserts AI-generated text into clinical-note fields), and all related software, applications, tools, features, application programming interfaces, updates, and services. * "Transcriptions" means the transcribed text, annotations, and any derivative works generated by the Services. * "Assistant Conversations" means the persistent, server-stored chat threads created when an Authorized User interacts with the standalone Assistant chat feature, including the questions and any patient context submitted by the user, the AI-generated responses, the literature citations attached to those responses, the conversation title, the ordered history of messages within the thread, and associated metadata. * "Content" means any data, information, files, text, audio, or materials uploaded, transmitted, or processed through the Services, including Transcriptions, Assistant Conversations, and any PHI contained therein. * "Protected Health Information" or "PHI" means individually identifiable health information as defined under HIPAA and other applicable healthcare privacy laws. * "Intellectual Property Rights" means all patent rights, copyright rights, trademark rights, trade secret rights, and any other intellectual property or proprietary rights. * "Business Associate Agreement" or "BAA" means the agreement required under HIPAA between a Covered Entity and a Business Associate that establishes the permitted and required uses and disclosures of Protected Health Information. 3. **ELIGIBILITY AND ACCOUNT REGISTRATION** 3.1. To use the Services, you must: * Be at least 18 years old; * Have the legal capacity and authority to enter into these Terms; * If acting on behalf of an organization, have the authority to bind that organization; * Provide accurate, current, and complete registration information; * Comply with all applicable laws, regulations, and professional standards. 3.2. Account Security: * You are responsible for maintaining the confidentiality of your account credentials; * You must immediately notify us of any unauthorized use of your account; * You are responsible for all activities that occur under your account; * You must implement appropriate security controls to protect access to the Services. 4. **LICENSE AND SERVICE ACCESS** 4.1. Subject to these Terms and payment of applicable fees, Transcribe Health grants you a limited, non-exclusive, non-transferable, non-sublicensable license to: * Access and use the Services for your internal business purposes; * Allow Authorized Users to access and use the Services in accordance with these Terms; * Use any documentation provided with the Services; * Install and use the Transcribe Health Medical Scribe Chrome extension (the "Extension"), which forms part of the Services. The Extension is a browser-side component that captures clinical-encounter audio, encrypts that audio client-side before upload, integrates with supported EHR systems, and inserts AI-generated text into clinical-note fields. All references in these Terms to the "Services," "Content," "PHI," "Transcriptions," and "Authorized Users" expressly include use of the Extension and any data processed through it. You shall install the Extension only from official distribution channels designated by Transcribe Health (currently the Chrome Web Store listing or a packaged build supplied directly by Transcribe Health); you shall not install or distribute modified, repackaged, sideloaded, or third-party copies of the Extension, and any use of an unofficial build is at your sole risk and constitutes a material breach of these Terms. You are solely responsible for verifying that you have all consents and authorizations required to capture, encrypt, transmit, and insert PHI through the Extension into your EHR, and for ensuring that the Extension is used only on devices and browsers that satisfy the safeguards required by HIPAA, PIPEDA, and any applicable provincial health privacy legislation. 4.2. Restrictions. You shall not: * Modify, copy, or create derivative works of the Services; * Reverse engineer, decompile, or attempt to discover the source code; * Sell, resell, license, sublicense, or distribute the Services; * Use the Services to store or transmit malicious code; * Interfere with or disrupt the integrity or performance of the Services; * Attempt to gain unauthorized access to the Services or related systems. 5. **USER RESPONSIBILITIES AND ACCEPTABLE USE** 5.1. Compliance Requirements: * Comply with all applicable laws, regulations, and professional standards; * Obtain all necessary consents and authorizations for using the Services; * Maintain appropriate security measures to protect Content and PHI; * Ensure accuracy and completeness of all Content uploaded to the Services; * Comply with HIPAA, HITECH, PIPEDA, applicable provincial health privacy legislation (including PHIPA, HIA, Law 25, PIPA BC, HIPA, and applicable PHIAs), and other applicable healthcare privacy laws. 5.2. Prohibited Activities. You shall not use the Services to: * Violate any laws or regulations; * Infringe any intellectual property rights; * Harass, abuse, or harm others; * Transmit any unlawful, harmful, or offensive content; * Interfere with other users' use of the Services. 5.3. System of Record; Service Classification: * The Services are a clinical documentation assistant (commonly described as an "AI medical scribe"). The Services are NOT an electronic medical record (EMR), electronic health record (EHR), or system of record, and are not certified, accredited, or designed to operate as such. * The Services do not provide and are not intended to provide: longitudinal patient health records, computerized provider order entry (CPOE), electronic prescribing, laboratory or imaging order management, clinical decision support, drug-interaction or allergy alerting, claims submission, patient portal access, or any other function reserved by applicable law to a certified EMR/EHR. * You warrant that you maintain a separate medical record system that satisfies all certification, retention, accessibility, and record-keeping obligations applicable to your practice and jurisdiction (including, where applicable, ONC-certified Health IT in the United States, Santé Québec-certified products in Quebec, OntarioMD-certified EMRs in Ontario, or any other jurisdictional certification regime). * You are solely responsible for transferring, exporting, or otherwise integrating finalized outputs of the Services (including transcriptions, generated documents, diagnosis-code suggestions, and audio recordings to the extent retained) into your certified medical record system in a timely manner consistent with your professional and legal obligations. * Data retained within the Services is retained for purposes of delivery, customer access, integration, audit, and legal hold — not as the authoritative legal record of care. The Services should not be relied upon as the sole record of any patient encounter. 6. **CONTENT AND INTELLECTUAL PROPERTY** 6.1. Ownership: * You retain all right, title, and interest in and to your Content. * Transcribe Health owns all right, title, and interest in and to the Services, including all improvements, modifications, and derivative works of the Services themselves (excluding your Content). * Transcribe Health's Intellectual Property Rights are protected by applicable laws. 6.2. License to Content: * You grant Transcribe Health a limited, worldwide, non-exclusive, royalty-free license to host, store, process, transmit, and display your Content solely to the extent necessary to provide, maintain, secure, and support the Services for you and to comply with law. * This license does not authorize any use of Content for product development, analytics, or model training except as expressly permitted in Section 6.3. * You represent and warrant that you have all rights and authorizations necessary to grant this license. * This license terminates when your Content is deleted in accordance with Section 7.4 and Section 12.2, except for (a) Content subject to mandatory legal or regulatory retention as described in Section 7.4, and (b) residual encrypted copies in routine backups, which are not accessed and which age out on a bounded backup-retention cycle. 6.3. No AI Training on Customer Content: * Transcribe Health will not use Customer Content — including Transcriptions, Assistant Conversations, PHI, Personal Information, or any de-identified, anonymized, or aggregated derivative of Customer Content — to train, fine-tune, develop, or otherwise improve any general-purpose or third-party artificial-intelligence or machine-learning model, without your prior written opt-in. * Transcribe Health's third-party AI subprocessors process Customer Content under zero-retention terms: they retain no Customer Content after returning the output, and they are contractually prohibited from using Customer Content to train or improve their models. The current subprocessor list is published at the Transcribe Health Trust Center (Section 7.3). * This Section 6.3 is consistent with, and does not limit, the corresponding commitments in the Business Associate Agreement and the Privacy Policy. In the event of any conflict regarding the handling of PHI, the Business Associate Agreement controls. 7. **DATA PROTECTION AND PRIVACY** 7.1. Data Processing: * Transcribe Health processes Content and PHI in accordance with applicable privacy laws; * We maintain appropriate technical and organizational security measures; * We will notify you of any security incidents affecting your Content or PHI. 7.2. Business Associate Agreement Requirement: * If you are a healthcare provider or other entity subject to HIPAA and you will use our Services to transmit, store, or process PHI, you MUST execute our Business Associate Agreement (BAA) prior to uploading or processing any PHI through the Services; * No PHI should be uploaded or processed through the Services until a BAA has been executed; * Use of the Services with PHI without an executed BAA is prohibited and constitutes a material breach of these Terms; * Our standard BAA is available upon request and during the account registration process; * Failure to execute a BAA when required under HIPAA may result in immediate suspension or termination of your account. 7.3. Data Storage and Transfer: * Content is stored on production infrastructure located in Canada. * International data transfers, where they occur, are carried out only under safeguards required by applicable data-protection law. * A current list of Transcribe Health's subprocessors, including those that process PHI under a Business Associate Agreement, is published and maintained at the Transcribe Health Trust Center: https://trust.transcribe.health. 7.4. Data Retention: * The Services are not a system of record (see Section 5.3). We retain Content only as needed to deliver the Services and meet our legal obligations. * **Mandatory retention minimums.** Certain Content is subject to mandatory legal and regulatory retention and is held for the applicable minimum period notwithstanding any deletion or export request: source audio is retained for a minimum of ninety (90) days; transcripts and associated medical-record documentation are retained for a minimum of seven (7) years (which meets the six (6)-year HIPAA documentation floor); and any opt-in short-retention configuration you select (between one (1) and thirty (30) days) applies only to categories of Content not subject to a mandatory minimum. These minimums override the deletion and export windows in this Section 7.4 and in Section 12.2 to the extent of any conflict. * **Sessions, voice recordings, transcriptions, and generated documents**: By default, and regardless of any optional retention policy, audio recordings are automatically and permanently deleted 90 days after transcription is completed, and transcript and session records are retained for seven (7) years (subject to a six-year HIPAA minimum) and then automatically deleted. These default windows apply to every organization and are enforced automatically by the platform. Separately, your organization may optionally enable an earlier automatic-deletion policy, configurable in 1-day to 30-day windows and disabled by default; when enabled, it deletes Content earlier than the default windows. If your organization does not enable the optional policy, the mandatory default windows above still apply. * **Audit logs**: Retained for at least six (6) years to satisfy HIPAA Security Rule documentation requirements (45 CFR 164.312(b) and 164.530(j)). * **De-identified and aggregated data.** Transcribe Health may retain de-identified or aggregated operational telemetry (for example, system performance, error rates, and usage volumes that do not identify any individual and are not derived from the substance of Customer Content) for security, billing, capacity-planning, and service-operation purposes. Transcribe Health does not retain or use de-identified or aggregated derivatives of Customer Content for AI or machine-learning model training (see Section 6.3). * **Account data**: Deleted within thirty (30) days of account termination, except where retention is required by law or by the mandatory minimums above. This window is aligned with the post-termination data handling in Section 12.2. * **Residual backups.** After deletion, residual encrypted backup copies are not accessed and age out on a bounded backup-retention cycle. * You may request deletion of your data at any time, subject to our Business Associate Agreement and applicable legal obligations. * Healthcare providers are responsible for retaining patient records in their own certified medical record system in accordance with their professional and jurisdictional obligations. HIPAA does not itself prescribe a minimum retention period for PHI in patient records; applicable retention obligations are set by state, provincial, and professional regulations governing your practice. 8. **FEES AND PAYMENT** 8.1. Payment Terms: * You agree to pay all fees specified for the Services; * Fees are non-refundable except as required by law; * Payments are processed through authorized payment processors; * You must provide valid payment information; * Late payments may result in service suspension. 8.2. Fee Changes: * We may modify fees upon 30 days' notice; * Continued use after fee changes constitutes acceptance; * Enterprise customers may have separate payment terms. 8.3. Term of Orders; Auto-Renewal: * Unless an Order Form, Statement of Work, or enterprise agreement (each, an "Order") states otherwise, each Order has an initial term as stated in the Order and automatically renews for successive twelve (12)-month terms unless either party gives written notice of non-renewal at least thirty (30) days before the end of the then-current term. * Where an Order specifies a different term or renewal mechanism, the Order controls. 9. **WARRANTY, DISCLAIMERS, AND SERVICE LEVELS** 9.1. Limited Warranty: * We warrant that the Services will perform materially as described; * We will use commercially reasonable efforts to maintain the Services; * We will provide technical support as specified in your service plan. 9.2. Medical and AI Disclaimers: **CRITICAL MEDICAL DISCLAIMER**: THE SERVICES ARE NOT MEDICAL DEVICES AND DO NOT PROVIDE MEDICAL ADVICE, DIAGNOSIS, OR TREATMENT. AI-GENERATED TRANSCRIPTIONS MAY CONTAIN ERRORS AND MUST ALWAYS BE REVIEWED BY QUALIFIED HEALTHCARE PROFESSIONALS BEFORE CLINICAL USE. * THE SERVICES ARE PROVIDED "AS IS" AND "AS AVAILABLE"; * WE DISCLAIM ALL IMPLIED WARRANTIES; * WE DO NOT WARRANT UNINTERRUPTED OR ERROR-FREE OPERATION; * WE DO NOT WARRANT THE ACCURACY OF TRANSCRIPTIONS OR AI-GENERATED CONTENT; * WE DO NOT WARRANT COMPATIBILITY WITH ALL EHR SYSTEMS; * AI MODELS MAY PRODUCE INACCURATE OR INAPPROPRIATE CONTENT; * HEALTHCARE PROVIDERS REMAIN SOLELY RESPONSIBLE FOR ALL CLINICAL DECISIONS; * THE SERVICES ARE NOT A SUBSTITUTE FOR PROFESSIONAL MEDICAL JUDGMENT; * THE SERVICES ARE NOT AN EMR, EHR, OR SYSTEM OF RECORD AND HAVE NOT BEEN CERTIFIED BY ANY EMR/EHR CERTIFICATION BODY; * YOU ARE SOLELY RESPONSIBLE FOR MAINTAINING A SEPARATE CERTIFIED MEDICAL RECORD SYSTEM AND FOR ALL JURISDICTIONAL EMR CERTIFICATION REQUIREMENTS APPLICABLE TO YOUR PRACTICE. **ASSISTANT CHAT — EVIDENCE-BASED Q&A DISCLAIMER**: THE STANDALONE ASSISTANT CHAT IS AN INFORMATIONAL TOOL AND IS NOT A CLINICAL DECISION SUPPORT SYSTEM, A MEDICAL DEVICE, OR A SUBSTITUTE FOR INDEPENDENT MEDICAL JUDGMENT. IN ADDITION TO THE GENERAL DISCLAIMERS ABOVE, THE FOLLOWING APPLY SPECIFICALLY TO ASSISTANT-GENERATED ANSWERS: * ASSISTANT ANSWERS ARE PRODUCED BY LARGE LANGUAGE MODELS AND MAY BE INCOMPLETE, OUTDATED, INACCURATE, OR HALLUCINATED, EVEN WHEN ACCOMPANIED BY CITATIONS; * LITERATURE CITATIONS ARE RETRIEVED FROM PUBLIC SOURCES AT THE TIME OF THE QUERY AND ARE PROVIDED FOR YOUR INDEPENDENT VERIFICATION; WE DO NOT WARRANT THE CURRENCY, COMPLETENESS, AUTHORITATIVENESS, OR APPLICABILITY OF ANY CITED SOURCE TO ANY PARTICULAR PATIENT; * AN ANSWER MAY MISCHARACTERIZE, OVERGENERALIZE, OR MISAPPLY THE CONTENT OF A CITED SOURCE — YOU MUST READ THE ORIGINAL SOURCE BEFORE RELYING ON IT; * THE ASSISTANT DOES NOT KNOW YOUR PATIENT'S COMPLETE HISTORY UNLESS YOU PROVIDE IT IN THE QUESTION; ANSWERS ARE NOT INDIVIDUALIZED TO ANY PATIENT; * THE ASSISTANT IS NOT INTENDED FOR USE IN EMERGENCY OR TIME-CRITICAL CLINICAL DECISIONS; * PRESCRIBING, DIAGNOSTIC, AND TREATMENT DECISIONS REMAIN SOLELY YOUR PROFESSIONAL RESPONSIBILITY AND MUST BE BASED ON YOUR INDEPENDENT EVALUATION OF THE PATIENT, AUTHORITATIVE CLINICAL GUIDELINES, AND CURRENT PRESCRIBING INFORMATION; * YOU MUST VERIFY ANY DRUG NAME, DOSAGE, INTERACTION, CONTRAINDICATION, OR CLINICAL RECOMMENDATION SURFACED BY THE ASSISTANT AGAINST AN INDEPENDENT, AUTHORITATIVE SOURCE BEFORE ACTING ON IT; * IF YOU CHOOSE TO INCLUDE PATIENT CONTEXT (INCLUDING PHI) IN AN ASSISTANT QUESTION, YOU REPRESENT AND WARRANT THAT YOU HAVE THE LEGAL AUTHORITY AND ALL REQUIRED CONSENTS, AUTHORIZATIONS, AND BAA COVERAGE TO DO SO, AND THAT SUCH INCLUSION COMPLIES WITH THE MINIMUM-NECESSARY PRINCIPLE UNDER HIPAA AND ANALOGOUS OBLIGATIONS UNDER PIPEDA, QUEBEC LAW 25, GDPR, AND OTHER APPLICABLE LAWS; * WE DISCLAIM ALL LIABILITY ARISING FROM RELIANCE ON ASSISTANT-GENERATED ANSWERS OR THE PRESENCE, ABSENCE, OR CONTENT OF ANY CITATION. 9.3. Service Levels: * If and when a Service Level Agreement (the "SLA") is attached to or referenced in your Order, that SLA is incorporated into these Terms by reference and defines the applicable uptime commitment, support severity tiers, target response and resolution times, and any service credits. * Until an SLA is attached to an Order, no specific uptime percentage or service-credit remedy is offered, and availability is governed by the commercially reasonable efforts standard in Section 9.1. 10. **LIMITATION OF LIABILITY** 10.1. General Cap: * EXCEPT AS PROVIDED IN SECTION 10.2 AND SECTION 10.3, THE TOTAL AGGREGATE LIABILITY OF EITHER PARTY ARISING OUT OF OR RELATING TO THESE TERMS, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), OR OTHERWISE, SHALL NOT EXCEED THE GREATER OF (A) THE TOTAL FEES PAID OR PAYABLE BY YOU TO TRANSCRIBE HEALTH FOR THE SERVICES IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM, OR (B) THE TOTAL FEES PAYABLE BY YOU UNDER THE APPLICABLE ORDER FOR ITS INITIAL TWELVE (12)-MONTH TERM. * THE FOREGOING CAP APPLIES TO ALL LIABILITY ARISING OUT OF OR RELATING TO A DATA-SECURITY BREACH OR A BREACH INVOLVING PHI OR PERSONAL INFORMATION, WHICH IS NOT SUBJECT TO ANY INCREASED CAP UNDER SECTION 10.2. * NEITHER PARTY SHALL BE LIABLE FOR INDIRECT, SPECIAL, CONSEQUENTIAL, PUNITIVE, OR INCIDENTAL DAMAGES, OR FOR LOST PROFITS OR LOST DATA, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. * As between the parties, the healthcare provider remains solely responsible for all clinical decisions, professional judgment, and the maintenance of the system of record (see Sections 5.3 and 9.2); Transcribe Health is not liable for medical malpractice or patient-care decisions. 10.2. Increased Cap for Enumerated Claims (Supercap): * For liability arising out of (a) either party's breach of its confidentiality obligations; (b) a party's indemnification obligations under Section 11; or (c) infringement or misappropriation of a third party's Intellectual Property Rights, the liability cap in Section 10.1 is increased to two (2) times the amount determined under Section 10.1. * This increased cap is a single aggregate cap for all claims within this Section 10.2 and is not additive across categories. * For the avoidance of doubt, liability for a data-security breach or a breach involving PHI or Personal Information is not within this Section 10.2 and remains subject to the general cap in Section 10.1, consistent with the Business Associate Agreement. 10.3. Uncapped Liability: * Nothing in these Terms limits or excludes either party's liability for: (a) gross negligence, willful misconduct, or fraud; (b) death or personal injury caused by its negligence; or (c) any liability that cannot be limited or excluded under applicable law. 10.4. Insurance: * Upon and after binding cyber/privacy liability, technology errors-and-omissions/professional liability, and commercial general liability insurance coverage, Transcribe Health will maintain such coverage with reputable insurers in amounts commercially appropriate for a business of its size and service category. * Once such coverage is in force, Transcribe Health will, upon written request, provide a certificate of insurance evidencing the coverage then in force. 11. **INDEMNIFICATION** 11.1. Indemnification by Transcribe Health. Transcribe Health will defend, indemnify, and hold harmless you and your officers, directors, employees, and agents from and against third-party claims, and resulting damages, losses, and reasonable costs (including reasonable legal fees) finally awarded or agreed in settlement, arising from: * an allegation that the Services, as provided by Transcribe Health and used in accordance with these Terms, infringe or misappropriate a third party's Intellectual Property Rights; and * a third-party claim arising from Transcribe Health's breach of its confidentiality, security, or data-protection obligations to the extent caused by Transcribe Health's negligence, willful misconduct, or breach of these Terms. Indemnification under this bullet is subject to the general liability cap in Section 10.1 and is not within the increased cap in Section 10.2. As between the parties, allocation of costs arising from a breach involving PHI or Personal Information is governed by the Business Associate Agreement. If the Services become, or in Transcribe Health's reasonable opinion are likely to become, the subject of an infringement claim, Transcribe Health may, at its option and expense, procure the right for you to continue using the Services, modify or replace the affected component to make it non-infringing, or, if neither is commercially reasonable, terminate the affected Services and refund prepaid, unused fees. The IP indemnity does not apply to claims arising from your Content, your combination of the Services with non-Transcribe Health products not authorized by Transcribe Health, or your use of the Services in breach of these Terms. 11.2. Indemnification by You. You will defend, indemnify, and hold harmless Transcribe Health and its officers, directors, employees, and agents from and against third-party claims, and resulting damages, losses, and reasonable costs (including reasonable legal fees) finally awarded or agreed in settlement, arising from: * your Content, or an allegation that your Content infringes or misappropriates a third party's rights; * your or your Authorized Users' use of the Services in violation of these Terms, the Privacy Policy, or applicable law; * your failure to obtain any patient consent, authorization, or BAA coverage required for your use of the Services; * your clinical decisions, professional services, or any medical malpractice or patient-care claim; and * your integration of the Services with, or your use of, any third-party or EHR system. 11.3. Indemnification Procedure. The party seeking indemnification must promptly notify the indemnifying party of the claim (provided that failure to give prompt notice relieves the indemnifying party only to the extent it is prejudiced), give the indemnifying party sole control of the defense (except that the indemnifying party may not settle any claim in a manner that imposes any non-monetary obligation or admission on, or that fails to fully release, the indemnified party without that party's prior written consent, not to be unreasonably withheld), and provide reasonable cooperation at the indemnifying party's expense. Nothing in this Section 11.3 affects, delays, or subordinates either party's independent statutory or regulatory obligations, including breach-notification obligations under applicable law and under the Business Associate Agreement (including its breach-notification timeline), which apply regardless of any indemnification defense or settlement. 12. **TERM AND TERMINATION** 12.1. Term; Termination for Cause: * These Terms remain in effect until terminated. * Either party may terminate these Terms or any Order for convenience on thirty (30) days' written notice, subject to the Order term in Section 8.3. * Either party may terminate for material breach if the breaching party fails to cure the breach within thirty (30) days after written notice describing it in reasonable detail. * Transcribe Health may suspend or terminate immediately, without the cure period, only for: (a) your non-payment that remains uncured ten (10) days after a past-due notice; (b) your use of the Services with PHI without an executed BAA where one is required (Section 7.2); (c) your installation or distribution of an unofficial build of the Extension (Section 4.1); or (d) use of the Services that creates an imminent security, legal, or safety risk, for the duration of that risk. 12.2. Effect of Termination: * Access to the Services will cease at the end of the applicable term or any wind-down period. * You must pay all fees accrued through the effective date of termination. * For thirty (30) days following termination, Transcribe Health will, on your request, provide you read-only access to export your Content in a commonly used machine-readable format (such as CSV or JSON). After that thirty (30)-day window, Transcribe Health will delete your Content in accordance with Section 7.4, except for (i) Content subject to the mandatory retention minimums in Section 7.4, (ii) residual encrypted backup copies that are not accessed and that age out on a bounded backup-retention cycle, and (iii) retention otherwise required by law or the Business Associate Agreement. * Sections 6.1, 6.3, 9.2, 10, 11, 13, 14, and 15, and any provision that by its nature should survive, survive termination. 13. **GOVERNING LAW AND DISPUTE RESOLUTION** 13.1. Governing Law. These Terms are governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein, without regard to conflict-of-laws rules. 13.2. Dispute Resolution: * The parties will first attempt in good faith to resolve any dispute through negotiation between authorized representatives. * Any dispute not resolved within thirty (30) days will be finally resolved by binding arbitration administered by the ADR Institute of Canada, Inc. under its Arbitration Rules, by a single arbitrator, seated in Toronto, Ontario, conducted in English. * To the extent permitted by applicable law, the parties waive any right to bring or participate in a class, collective, or representative proceeding. * Each party bears its own costs; arbitrator and administrative fees are shared equally, subject to reallocation by the arbitrator. * Either party may seek interim or injunctive relief from a court of competent jurisdiction in Ontario to protect its Intellectual Property Rights or Confidential Information pending arbitration. 14. **CONTACT INFORMATION** **Transcribe Health Corporation** Email: legal@transcribe.health (contract / agreement notices, governing-law correspondence, BAA / DPA enquiries) Email: hello@transcribe.health (general contact) **Mailing Address:** Transcribe Health Corporation Unit 523 - 8 Telegram Mews Toronto, Ontario, M5V 3Z5 Canada 15. **GENERAL PROVISIONS** 15.1. Entire Agreement: * These Terms, together with the applicable Order Form, Business Associate Agreement, Data Processing Agreement, and Privacy Policy, constitute the complete agreement between the parties regarding the Services. * They supersede all prior agreements, representations, and understandings relating to the Services. * Modifications must be in writing (other than updates made under Section 18). 15.2. Severability: * Invalid provisions shall be modified to be enforceable; * Remaining provisions remain in full effect. 15.3. Force Majeure: * Neither party is liable for events beyond reasonable control; * Affected party must notify other party promptly. 15.4. Assignment: * Neither party may assign these Terms without the other party's prior written consent, not to be unreasonably withheld or delayed, except that either party may assign these Terms in their entirety, on written notice and without consent, to a successor in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets. * Where Transcribe Health assigns to a successor, the successor must assume these Terms and the Business Associate Agreement; if the successor does not assume the Business Associate Agreement, you may terminate the affected Services on written notice and receive a refund of prepaid, unused fees. * Any other purported assignment is void. These Terms bind and benefit the parties' permitted successors and assigns. 15.5. Notices: * Notices must be in writing; * Notices are effective upon receipt. 15.6. Order of Precedence: * If there is a conflict among the documents comprising the agreement between the parties, the following order of precedence governs the conflicting term: (1) the executed Order Form; (2) the Business Associate Agreement; (3) the Data Processing Agreement; (4) these Terms of Service; and (5) the Privacy Policy. Outside of a direct conflict, all such documents apply together. 16. **HIPAA AND CANADIAN HEALTH PRIVACY COMPLIANCE** 16.1. Healthcare Users: * If you are a healthcare provider, health plan, healthcare clearinghouse, or business associate subject to HIPAA regulations, you acknowledge and agree that: * You are solely responsible for your compliance with HIPAA, PIPEDA, applicable provincial health privacy legislation, and other applicable laws; * You must determine whether a BAA is required for your use of the Services; * You must execute a BAA with us before using the Services with any PHI; * You must implement appropriate administrative, physical, and technical safeguards. 16.2. Canadian Health Privacy Compliance: * If you are a healthcare provider or health information custodian in Canada, you acknowledge and agree that: * You must comply with PIPEDA and any applicable provincial health privacy legislation, including the Personal Health Information Protection Act (Ontario), the Health Information Act (Alberta), Law 25 and the Quebec Privacy Act, the Personal Information Protection Act (British Columbia), the Health Information Protection Act (Saskatchewan), and the Personal Health Information Acts of Manitoba, New Brunswick, and Newfoundland and Labrador; * You are responsible for obtaining all required consents under applicable provincial legislation before using the Services with personal health information; * You must ensure that any cross-border transfers of personal health information comply with applicable provincial restrictions. 16.3. PHI Processing: * We process PHI only as permitted by the applicable BAA; * We will maintain reasonable and appropriate safeguards; * We will report security incidents as required by HIPAA and the BAA; * We will make our facilities and documentation available for audit as required. 16.4. SOC 2: * Transcribe Health designs and operates its security controls to the AICPA SOC 2 Trust Services Criteria (Security, Availability, Confidentiality, and Privacy) and is preparing for a SOC 2 Type II examination. Once issued, the report will be made available to customers under a non-disclosure agreement upon request. 16.5. User Representations: * By using the Services with PHI, you represent and warrant that: * You have obtained all necessary consents and authorizations; * You have executed a BAA with us; * You are in compliance with all applicable privacy laws. 17. **PATIENT CONSENT AND NOTICE REQUIREMENTS** 17.1. Express Consent Requirements: * You are responsible for obtaining express consent from each patient before using our AI transcription service with their PHI * You must inform patients that their conversations may be recorded and processed using AI technology * You must provide patients with the ability to opt-out without impacting their healthcare 17.2. Privacy Notice Requirements: * You must update your privacy policies to include references to: * The use of AI transcription services * The recording of patient encounters * The retention practices applicable to data processed by the Services (see Section 7.4) * Data residency (where applicable) 17.3. Physician Responsibilities: * You must review and edit all AI-generated documentation to ensure accuracy * You are responsible for maintaining complete and accurate medical records * You must comply with all applicable laws, regulations, and professional standards * On written request and under a mutual non-disclosure agreement, Transcribe Health will make available, no more than once per year, then-current compliance documentation, which once available will include a SOC 2 Type II report and a HIPAA Security Rule attestation. Until such reports are issued (see Section 16.4), Transcribe Health will provide a written summary of its current compliance posture in their place. 18. **MODIFICATIONS TO THESE TERMS** * Transcribe Health may update these Terms from time to time. * For any change that materially and adversely affects your rights or obligations, Transcribe Health will provide at least thirty (30) days' advance written notice through the in-product agreement-notice and re-acceptance flow (or by email to your administrative contact) before the change takes effect. * If a material change adversely affects you, you may terminate the affected Services without penalty by giving written notice before the change's effective date, and Transcribe Health will refund any prepaid, unused fees for the terminated Services. * Changes that are not material (for example, clarifications, contact-information updates, or changes required by law) may take effect on posting. * Fee changes apply only at the start of a renewal term, except that Transcribe Health may pass through documented increases in third-party fees on thirty (30) days' notice, with any such pass-through increase capped at the actual third-party increase. * This Section 18 does not apply to the Business Associate Agreement, which is amended only as provided therein. * Your continued use of the Services after a change's effective date, following notice, constitutes acceptance of the updated Terms. By using the Services, you acknowledge that you have read, understood, and agree to be bound by these Terms. --- **BUSINESS ASSOCIATE AGREEMENT** This Business Associate Agreement ("BAA") is entered into by and between the healthcare provider or covered entity ("Covered Entity") that accepts this agreement and Transcribe Health Corporation ("Business Associate"), a corporation incorporated under the federal laws of Canada. Last Updated: May 19, 2026 ## 1. DEFINITIONS For purposes of this BAA, the following terms shall have the meanings set forth below: - "HIPAA" means the Health Insurance Portability and Accountability Act of 1996, as amended. - "HITECH Act" means the Health Information Technology for Economic and Clinical Health Act, as amended. - "Privacy Rule" means the Standards for Privacy of Individually Identifiable Health Information at 45 CFR Part 160 and Part 164, Subparts A and E. - "Security Rule" means the Security Standards for the Protection of Electronic Protected Health Information at 45 CFR Part 160 and Part 164, Subparts A and C. - "Breach Notification Rule" means the Breach Notification for Unsecured Protected Health Information at 45 CFR Part 164, Subpart D. - "Protected Health Information" or "PHI" means any information, whether oral or recorded in any form or medium, that (i) relates to the past, present, or future physical or mental health condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual; and (ii) identifies the individual or with respect to which there is a reasonable basis to believe the information can be used to identify the individual. PHI includes Electronic Protected Health Information ("ePHI"). - "Services" means the AI-powered clinical documentation and clinical-intelligence platform provided by Business Associate to Covered Entity, including the medical transcription product, the AI-generated clinical-note product, the standalone Assistant chat (a persistent chat surface where Authorized Users of the Covered Entity may submit clinical questions — which may include patient context constituting PHI — and receive AI-generated answers cited to public medical literature), the Transcribe Health Medical Scribe Chrome extension (a browser-side component that captures clinical-encounter audio constituting ePHI, client-side-encrypts that audio prior to transmission, integrates with supported EHR systems, and inserts AI-generated text into clinical-note fields), the patient forms feature (through which Covered Entity builds or selects intake, consent and screening forms, sends them to patients through a secure link, and receives the patients' answers, signatures, scores, flags and completed PDFs, all of which constitute PHI collected by Business Associate on Covered Entity's behalf), and all related software, applications, application programming interfaces, updates, and services. - "Security Incident" means, consistent with 45 CFR §164.304, the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information, or interference with system operations in an information system, in each case affecting ePHI that Business Associate creates, receives, maintains, or transmits on behalf of Covered Entity. "Security Incident" does not include any Unsuccessful Security Incident. - "Unsuccessful Security Incident" means a Security Incident that does not result in unauthorized access to, or the unauthorized use, disclosure, modification, or destruction of, ePHI, or in interference with an information system that maintains ePHI, including without limitation pings and other broadcast attacks on a firewall, port scans, unsuccessful or denied log-on attempts, malformed or malicious packets, and denied or blocked network traffic routinely absorbed by Business Associate's security controls. ## 1.5. SERVICE CLASSIFICATION The parties acknowledge and agree that: - Business Associate provides a clinical documentation assistant service. Business Associate is not an EMR, EHR, designated record set custodian, or system of record for Covered Entity, and the Services have not been certified under ONC, Santé Québec, OntarioMD, or any other EMR/EHR certification regime. - Covered Entity is the custodian of the Designated Record Set. Covered Entity warrants that it maintains a separate medical record system that satisfies all certification, retention, and record-keeping requirements applicable to its practice and jurisdiction. - PHI created or processed by the Services is provided to Covered Entity for incorporation into Covered Entity's record system. Covered Entity is responsible for the timely transfer of finalized Service outputs into its certified medical record system. - Business Associate's obligations under HIPAA Sections 164.524 (access) and 164.526 (amendment) are limited to PHI then-currently held within the Services and shall be satisfied by making such PHI available to Covered Entity, which remains responsible for satisfying Individual access and amendment rights against the underlying Designated Record Set. Without limiting the foregoing, upon Covered Entity's written request, Business Associate shall provide a copy of the PHI then held within the Services in a commonly used, machine-readable format within fifteen (15) business days, sufficient to enable Covered Entity to meet its thirty (30) day individual-access deadline under 45 CFR 164.524. - Completed patient forms, signed consents and completed PDFs produced through the Services are Service outputs. Covered Entity is responsible for incorporating any of them that form part of its Designated Record Set into its own record system. The Services keep them only as described in Section 4.4 and are not the custodian of record for them. ## 2. OBLIGATIONS OF BUSINESS ASSOCIATE ### 2.1. Permitted Uses and Disclosures: - Business Associate shall not use or disclose PHI other than as permitted or required by this BAA, the Terms of Service, or as required by law. - Business Associate may use or disclose PHI for the proper management and administration of its business, provided that the disclosures are required by law or Business Associate obtains reasonable assurances from the person to whom the information is disclosed that it will be held confidentially. - Business Associate may use PHI to provide data aggregation services relating to the health care operations of Covered Entity as permitted by 45 CFR 164.504(e)(2)(i)(B). - Business Associate may de-identify PHI in accordance with 45 CFR 164.514(a)-(c). ### 2.2. Safeguards: - Business Associate shall implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of ePHI that it creates, receives, maintains, or transmits on behalf of Covered Entity. - Business Associate shall comply with the Security Rule requirements applicable to business associates under HIPAA. - Business Associate shall ensure that any agent, including a subcontractor, to whom it provides PHI agrees to the same restrictions and conditions that apply to Business Associate under this BAA. Business Associate shall remain liable for the acts and omissions of its subcontractors to the same extent as if Business Associate were performing the services directly. - Business Associate shall provide at least thirty (30) days' advance notice before engaging any new subcontractor that will have access to PHI, giving Covered Entity the opportunity to object. The current subcontractor list is in the Data Processing Agreement at transcribe.health/legal/dpa. - If Covered Entity objects in writing within fifteen (15) days of Business Associate's notice, the parties shall confer in good faith for thirty (30) days to resolve the objection, which may include an alternative subcontractor or additional safeguards. If unresolved, Covered Entity's sole and exclusive remedy is to terminate this BAA and the corresponding Services, without penalty and without early-termination liability, on written notice. ### 2.3. Reporting: - Business Associate shall report to Covered Entity any use or disclosure of PHI not provided for by this BAA of which it becomes aware, including Breaches of Unsecured PHI as required by 45 CFR 164.410. - Business Associate shall report to Covered Entity any Successful Security Incident of which it becomes aware in accordance with the timing in this Section 2.3. The parties acknowledge that Unsuccessful Security Incidents occur frequently and carry no material risk to ePHI; this paragraph constitutes Covered Entity's notice of, and the parties' agreed reporting mechanism for, all Unsuccessful Security Incidents, which Business Associate need not report individually. On Covered Entity's reasonable written request, no more than once per calendar quarter, Business Associate shall provide an aggregate summary of the categories of Unsuccessful Security Incidents observed. - For purposes of this BAA, "Discovery" of a Breach means the first day on which the Breach is known to Business Associate, or by exercising reasonable diligence would have been known, treating Business Associate as having knowledge if the Breach is known, or would have been known by reasonable diligence, to any workforce member or agent of Business Associate other than the person committing the Breach, consistent with 45 CFR 164.410(a)(2). - Reports of Breaches of Unsecured PHI shall be made without unreasonable delay and in no case later than five (5) business days after Discovery of the Breach, with supplemental information provided as it becomes available. Business Associate shall provide regular status updates to Covered Entity at mutually agreed intervals until the incident is resolved. This internal reporting window is intended to allow Covered Entity to satisfy its own notification obligations, including the outer limit of without unreasonable delay and no later than sixty (60) days under 45 CFR 164.404–164.410. - Business Associate shall cooperate with Covered Entity in the investigation of any Breach and shall preserve and make available forensic evidence and audit logs relevant to the incident. ### 2.4. Access to PHI: - Business Associate shall make available PHI in a Designated Record Set to Covered Entity or, as directed by Covered Entity, to an Individual, as necessary to satisfy Covered Entity's obligations under 45 CFR 164.524. - Business Associate shall make PHI available for amendment and incorporate any amendments to PHI as directed by Covered Entity, as necessary to satisfy Covered Entity's obligations under 45 CFR 164.526. - Business Associate shall make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining Covered Entity's compliance with HIPAA. ### 2.5. Accounting of Disclosures: - Business Associate shall maintain and make available information required to provide an accounting of disclosures as necessary to satisfy Covered Entity's obligations under 45 CFR 164.528. ## 3. OBLIGATIONS OF COVERED ENTITY ### 3.1. Covered Entity shall: - Notify Business Associate of any limitations in the Notice of Privacy Practices of Covered Entity that may affect Business Associate's use or disclosure of PHI. - Notify Business Associate of any changes in, or revocation of, the permission by an Individual to use or disclose their PHI, to the extent that such changes may affect Business Associate's use or disclosure of PHI. - Notify Business Associate of any restriction on the use or disclosure of PHI that Covered Entity has agreed to or is required to abide by under 45 CFR 164.522, to the extent that such restriction may affect Business Associate's use or disclosure of PHI. - Not request Business Associate to use or disclose PHI in any manner that would not be permissible under HIPAA if done by Covered Entity. - Determine the content of every patient form it publishes or sends, including forms started from a template in the Services' library, and be responsible for the lawfulness of each question and of the consent or authorization wording, including, where a form is used as an authorization, the requirements of 45 CFR 164.508, and any consent required by 42 CFR Part 2 or by state law for minors or sensitive services. - Not use the patient forms feature to collect payment card numbers, card verification codes, PINs or other cardholder or sensitive authentication data within the meaning of the PCI Data Security Standard. Business Associate may require Covered Entity to change a form that does so and to delete the affected responses, and may archive the form after notice where necessary to protect Individuals or the Services. - Review patient form responses and flags in a timely way and provide any clinical follow-up, including on any answer indicating thoughts of self-harm. Scores and flags are review aids, not diagnoses. Business Associate does not monitor responses or provide an emergency or crisis service. ## 4. SECURITY MEASURES Business Associate implements the following security measures to protect ePHI: ### 4.1. Technical Safeguards: - AES-256 encryption for data at rest - TLS 1.2+ encryption for data in transit - Client-side encryption of audio captured by the Transcribe Health Medical Scribe Chrome extension, with per-session keys scoped to the user's active browser session — so that ciphertext rather than plaintext ePHI audio leaves the user's device - Role-based access controls (RBAC) - Multi-factor authentication (MFA) - Automated session timeout, including an inactivity timeout in the Chrome extension - Comprehensive audit logging, including a tamper-evident audit log generated by the Chrome extension and mirrored to Business Associate's server-side audit log ### 4.2. Physical Safeguards: - Production servers are located in a locked, access-controlled server room in Canada, with physical access restricted to authorized personnel - Video monitoring of the server room - Smoke and fire detection, dedicated cooling, and an uninterruptible power supply (UPS) - Production storage encrypted at rest (AES-256), with encryption keys escrowed separately from the storage they protect - Backups kept on separate, dedicated backup storage with immutable retention - Components hosted on Google Cloud Platform or Amazon Web Services rely on the physical safeguards of those providers' data centers, which the providers have independently audited (SOC 2 Type II, ISO 27001) ### 4.3. Administrative Safeguards: - Security awareness and HIPAA training scheduled in the compliance calendar - Documented security policies and procedures - Regular risk assessments - Incident response procedures - Business continuity and disaster recovery plans ### 4.4. Data Handling: - The platform enforces a mandatory default retention schedule for every organization: audio recordings are automatically deleted 90 days after transcription, and transcript and session records are retained for 7 years (a six-year HIPAA minimum) and then automatically deleted. Covered Entity may additionally enable an optional automatic retention policy, configurable in 1-day to 30-day windows and disabled by default, to purge sessions, audio recordings, transcriptions, and generated documents earlier than the mandatory default. PHI is also deleted on Covered Entity request or account closure, subject to the termination provisions of Section 5.3. - PHI is stored in encrypted databases with organization-level isolation - Multi-tenant architecture with strict data segregation - Access to PHI is logged and auditable; audit logs are retained for at least six (6) years to satisfy HIPAA Security Rule documentation requirements (45 CFR 164.312(b) and 164.530(j)) - AI processing does not retain PHI beyond the immediate transcription request; AI providers are contractually bound by zero-retention agreements - Browser-extension audio handling is within the scope of Business Associate's permitted uses and safeguards under this BAA. Where Covered Entity's Authorized Users install the Transcribe Health Medical Scribe Chrome extension, ePHI audio is captured in the browser, encrypted client-side before leaving the user's device, transmitted as ciphertext to Business Associate's Canadian backend, and decrypted only inside Business Associate's processing environment. Locally buffered audio on the user's device is purged once upload is confirmed. The Extension introduces no new subcontractor and routes only to Business Associate's existing backend and previously disclosed Sub-processors. - Patient forms handling is within the scope of Business Associate's permitted uses and safeguards under this BAA. A patient must confirm their date of birth before any form is shown, and repeated failures lock the link. Answers, drafts, signer names, drawn signatures and completed PDFs are encrypted at rest under an organization-specific key. Form link messages contain no PHI beyond the practice name and the link. Unsubmitted drafts are deleted 30 days after the link expires or is cancelled. Submitted responses are kept with the patient's record until Covered Entity deletes the patient or this BAA ends, subject to Section 5.3. On deletion of a patient, answers, drafts and completed PDFs are deleted and signature records keep only what proves consent was given. Answers and scores of a visit-linked form are included in the context used to generate that visit's clinical documentation, through the same previously disclosed subcontractors and under the same zero-retention terms. The feature introduces no new subcontractor. Access to, views of and exports of responses are logged and auditable without recording response content. ### 4.5. Audit Rights and Assurance: - Business Associate designs and operates its security controls to the AICPA SOC 2 Trust Services Criteria and is preparing for a SOC 2 Type II examination. Once the report is issued, upon Covered Entity's reasonable written request, no more than once per twelve (12) month period, Business Associate shall make its then-current SOC 2 Type II report available under a mutual non-disclosure agreement, together with a summary of any remediation of exceptions noted therein. - Once issued, the SOC 2 Type II report shall be deemed to satisfy Covered Entity's audit and assessment rights under this BAA with respect to the controls within its scope. - Covered Entity may conduct an on-site or remote audit of Business Associate's PHI-relevant controls in lieu of, or in addition to, the report only (i) following a Breach affecting Covered Entity's PHI, or (ii) following identification of a material control deficiency, on at least thirty (30) days' prior written notice, during normal business hours, no more than once per calendar year absent a subsequent Breach, in a manner that does not unreasonably disrupt operations or compromise other customers' data, subject to the confidentiality obligations of this BAA and the Terms of Service. ## 5. TERM AND TERMINATION ### 5.1. - This BAA shall be effective upon acceptance by Covered Entity and shall remain in effect until the earlier of: termination of the underlying Terms of Service, or termination of this BAA by either party. ### 5.2. - Either party may terminate this BAA if the other party materially breaches this BAA and fails to cure the breach within 30 days of receiving written notice of the breach. ### 5.3. Upon termination: - Business Associate shall, at Covered Entity's election, return (machine-readable) or destroy all PHI to the extent feasible. Destruction from active systems within thirty (30) days, from backup systems within ninety (90) days, consistent with Business Associate's Data Retention and Disposal Policy. - On completion, Business Associate shall provide written certification, including confirmation that subcontractors completed their destruction obligations. - Return or destruction is "not feasible" only where, and for so long as, PHI resides in immutable, encrypted backup media subject to a bounded, automatically expiring retention cycle from which selective deletion is not technically practicable, or where PHI is subject to a legal hold or record-retention obligation imposed by law (including the mandatory transcript-retention period in Section 4.4 and the Data Retention and Disposal Policy v4.0). Where not feasible, Business Associate shall extend the protections of this BAA to such PHI, limit further uses/disclosures to the purposes that make destruction infeasible, and destroy the residual PHI upon expiry of the applicable backup-retention cycle or legal hold. ## 6. CANADIAN HEALTH PRIVACY COMPLIANCE ### 6.1. In addition to HIPAA requirements, Business Associate acknowledges and complies with: - The Personal Information Protection and Electronic Documents Act (PIPEDA) - Applicable provincial privacy and health-privacy legislation, including PHIPA (Ontario), the Health Information Act (HIA, Alberta), the Personal Information Protection Act (PIPA, Alberta), the Act respecting the protection of personal information in the private sector as amended by Law 25 (Quebec), the Personal Information Protection Act (PIPA, British Columbia), and other provincial privacy legislation as applicable. - Cross-border data transfer requirements under Canadian federal and provincial law ## 7. MISCELLANEOUS ### 7.1. Regulatory References: - Any reference in this BAA to a section in HIPAA means the section as in effect or as amended. ### 7.2. Amendment: - The parties agree to take such action as is necessary to amend this BAA from time to time as is necessary for compliance with HIPAA and the HITECH Act. ### 7.3. Survival: - The respective rights and obligations of Business Associate under Sections 5.3, 7.6, and 7.7 of this BAA shall survive the termination of this BAA. ### 7.4. Interpretation: - Any ambiguity in this BAA shall be interpreted to permit compliance with HIPAA. ### 7.5. Governing Law: - This BAA shall be governed by and construed in accordance with the laws of the Province of Ontario and the federal laws of Canada applicable therein. ### 7.6. Limitation of Liability: - The Limitation of Liability set forth in the Terms of Service applies to this BAA and to all claims arising out of or relating to the use, disclosure, or safeguarding of PHI. The parties do not establish any supercap or enhanced liability for PHI or Security-Rule claims; such claims are subject to the same Limitation of Liability as all other claims under the Terms of Service, except for any liability that cannot be limited under applicable law. ### 7.7. Insurance: - Business Associate is in the process of procuring cyber-liability and technology errors-and-omissions insurance appropriate to the nature and scale of its Services and intends to maintain such coverage. Once such coverage is in force, Business Associate shall, upon Covered Entity's reasonable written request, provide a certificate of insurance evidencing it. ## 8. DATA PROCESSING AGREEMENT This BAA operates in conjunction with the Data Processing Agreement (available at transcribe.health/legal/dpa), which sets out additional terms governing the processing of Personal Information under PIPEDA and applicable provincial privacy legislation. The DPA includes detailed Schedules covering processing activities, technical and organizational security measures, and the current list of sub-processors. In the event of a conflict between this BAA and the DPA with respect to the handling of Protected Health Information, this BAA shall prevail. ## 9. CONTACT INFORMATION Transcribe Health Corporation Security Officer (security and incident matters): security@transcribe.health Privacy matters and PHI requests: privacy@transcribe.health By accepting this BAA, Covered Entity acknowledges that it has read, understood, and agrees to be bound by the terms of this Business Associate Agreement. --- **DATA PROCESSING AGREEMENT** This Data Processing Agreement ("Agreement") is entered into by and between Transcribe Health Corporation ("Transcribe Health"), a corporation incorporated under the federal laws of Canada, and the healthcare provider or other organization that accepts this Agreement ("Customer"). This Agreement is made pursuant to PIPEDA Principle 4.1.3, which requires that an organization transferring personal information to a third party for processing ensure a comparable level of protection while the information is being processed. Where the Customer is subject to HIPAA, this Agreement operates in conjunction with the Business Associate Agreement. Effective Date: May 19, 2026 ## 1. DEFINITIONS AND INTERPRETATION In this Data Processing Agreement, the following terms have the meanings set out below. Where a term is defined in PIPEDA or the HIPAA Rules, the statutory definition shall prevail to the extent of any inconsistency. - "Agreement" means this Data Processing Agreement, including all Schedules annexed hereto. - "Customer" means the healthcare provider, clinic, or other organization that has entered into the Terms of Service with Transcribe Health and on whose behalf Personal Information is processed. - "Data Subject" means the individual to whom Personal Information relates, including patients whose consultations are transcribed through the Services. - "Personal Data" has the same meaning as "Personal Information" and is used interchangeably with it throughout this Agreement; where the Customer or a Data Subject is subject to the GDPR or UK GDPR, "Personal Data" bears the meaning given in Article 4(1) of the GDPR. - "Personal Information" means information about an identifiable individual, as defined in section 2(1) of PIPEDA, including health information and Protected Health Information as defined under HIPAA. - "Processing" means any operation performed on Personal Information, including collection, recording, organization, storage, adaptation, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, combination, restriction, erasure, or destruction. - "Services" means the AI-powered medical transcription platform and related services provided by Transcribe Health to Customer under the Terms of Service. - "Sub-processor" means any third party engaged by Transcribe Health to process Personal Information on behalf of the Customer. - "Transcribe Health" means Transcribe Health Corporation, a corporation incorporated under the federal laws of Canada, acting as the processor of Personal Information on behalf of the Customer. - "GDPR" means Regulation (EU) 2016/679, and "UK GDPR" means that Regulation as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of the European Union (Withdrawal) Act 2018. - "Supervisory Authority" means any data protection or privacy regulator with jurisdiction over the processing, including the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, the Information and Privacy Commissioners of British Columbia and Alberta, the competent EU supervisory authority, the UK Information Commissioner's Office, and the California Privacy Protection Agency or California Attorney General. - "Patient Forms" means the feature of the Services that lets the Customer build or select intake forms, consent forms, screening questionnaires and other forms, send them to patients through a secure link, and receive the patients' answers, signatures, scores, flags and completed PDFs. - "Customer Form Content" means everything that determines what a Patient Form collects and from whom: the questions, answer options, help text, consent and information wording, conditional logic, scoring and flag rules, PDF forms uploaded by the Customer, the selection of recipients, and any template from the Services' library once the Customer chooses to publish or send it. ## 2. SCOPE AND PURPOSE OF PROCESSING ### 2.1. Purpose Limitation Transcribe Health processes Personal Information solely for the purpose of providing the Services described in the Terms of Service. This processing is limited to: (a) receiving and temporarily storing audio recordings of healthcare consultations; (b) transcribing audio recordings into text using artificial intelligence; (c) generating clinical documentation from transcriptions; (d) storing transcriptions and generated documents for the retention period configured by the Customer; (e) operating the standalone Assistant chat feature, which receives clinical questions submitted by Authorized Users (which may include patient context), retrieves relevant excerpts from public medical literature sources, generates AI-authored answers with literature citations, persists the resulting conversations server-side, and supplies prior messages within a conversation to the AI provider as context for subsequent turns; and (f) operating Patient Forms on the Customer's behalf: hosting the form builder and the Customer's published form versions, sending form links to patients through the Services' patient messaging channels, verifying the patient's date of birth before a form is shown, collecting and storing the patient's answers, drafts, signatures and completed PDFs, calculating scores and flags, making responses available to the Customer's Authorized Users, and, where a form is linked to a visit, including its answers and scores in the context used to generate that visit's clinical documentation. Transcribe Health shall not process Personal Information for any purpose other than those specified in this Agreement and the Terms of Service, unless required to do so by applicable law. In such a case, Transcribe Health shall inform the Customer of that legal requirement before processing, unless the law prohibits such notification on important grounds of public interest. ### 2.2. Nature of the Processing The processing consists of automated transcription of audio recordings containing doctor-patient consultations using artificial intelligence models, storage of audio files, persistent storage of transcription text, and generation of structured clinical notes. By default, and regardless of any optional retention policy, audio recordings are automatically and permanently deleted ninety (90) days after transcription is completed, and transcript and session records are retained for seven (7) years (subject to a six-year HIPAA minimum) and then automatically deleted. These default windows apply to every Customer organization and are enforced automatically by the platform. Separately, the Customer may optionally enable an earlier automatic-deletion policy, configurable in 1-day to 30-day windows and disabled by default; when enabled, it deletes Content earlier than the default windows. The processing also includes operation of the standalone Assistant chat feature. For each user turn, the Customer's Authorized User submits a free-text clinical question (which may contain Personal Information about a patient if the user chooses to include such context); Transcribe Health retrieves relevant excerpts from public medical literature sources; the question, retrieved excerpts, and prior messages from the same conversation are transmitted to a contracted AI sub-processor under zero-retention terms for inference; and the AI-generated response together with its literature citations is returned to the user and persisted in Transcribe Health's Canadian infrastructure. Assistant conversations are scoped to a single Authorized User within a single Customer organization; content is not concatenated or shared across users, conversations, or organizations. Assistant conversations persist until the Authorized User deletes them, the Customer deletes the user's account, or the Customer terminates the Agreement. Retrieval of literature citations relies on a local index of de-identified literature metadata hosted inside Transcribe Health's Canadian infrastructure (queried using the raw user question, which does not leave Transcribe Health's infrastructure) and on parallel calls to public, non-PHI-receiving medical-research APIs. External calls carry only PHI-scrubbed query variants derived from the user's question (for example, a generic drug name or symptom phrase); they do not carry user identifiers, organization identifiers, conversation identifiers, patient identifiers, or any other Personal Information. Because no Personal Information is transmitted to these public research APIs, they are public data sources rather than Sub-processors of Personal Information under this Agreement and are therefore not listed in Schedule C. Where the Customer's Authorized Users install the Transcribe Health Medical Scribe Chrome extension, the processing additionally includes a browser-side capture path. The Extension captures consultation audio in the browser and, before any data leaves the user's device, encrypts that audio using a per-session symmetric key generated and scoped client-side to the active browser session. The Extension transmits ciphertext (not plaintext audio) to Transcribe Health's backend; the backend decrypts the audio only inside Transcribe Health's Canadian processing environment for transcription and clinical-note generation, and the decrypted audio is then subject to the same retention rules described above. The Extension also generates non-content telemetry (a recording session identifier, the detected EHR system, the extension version, capture and insertion timestamps, and integrity hashes) used to maintain a tamper-evident audit log retained locally for a limited rolling window and mirrored to Transcribe Health's server-side audit log. The Extension introduces no new Sub-processor: it communicates only with Transcribe Health's existing Canadian backend, which then engages the Sub-processors listed in Schedule C on the same terms as the rest of the Services. Where the Customer uses Patient Forms, the processing also includes collecting Personal Information directly from patients on the Customer's behalf. Each published form version is stored unchanged so the wording a patient saw can be shown later. A patient must confirm their date of birth before any form is displayed, and repeated failed attempts lock the link until the Customer reopens it. Answers are saved as encrypted drafts while the patient works and are replaced by the submitted response on submission. Answers, drafts, signer names, drawn signatures and completed PDFs are encrypted at rest under a key specific to the Customer's organization. Scores and flags are calculated by fixed rules on Transcribe Health's servers at submission, not by artificial intelligence. Form link messages identify only the Customer's practice and contain no patient name, form name or health information, and they are subject to the patient's messaging consent, opt-outs and the Customer's quiet hours. Where a form is linked to a visit, its answers and scores are included in the content sent for AI inference for that visit under Section 5.2 and the Customer's AI residency setting; Patient Forms introduces no new Sub-processor. ### 2.3. Categories of Personal Information The Personal Information processed under this Agreement includes: patient names and identifiers mentioned during consultations; health information including symptoms, diagnoses, treatment plans, medications, and medical history discussed during consultations; healthcare provider names and professional identifiers; and any other personal information verbally communicated during recorded consultations. Through the Assistant chat feature, the categories of Personal Information further include: free-text questions and any patient context an Authorized User chooses to include in those questions (which may constitute Protected Health Information, including symptoms, diagnoses, treatments, medications, dates, ages, and other clinical details); the AI-generated answers returned in response, including any health information they reproduce or summarize; the literature citations and excerpts attached to those answers; conversation titles (typically authored by the user or auto-summarized from the first question); the ordered history of messages within a conversation; the identifier of the Authorized User who created the conversation; and timestamps. Through Patient Forms, the categories of Personal Information further include whatever the Customer Form Content asks for, which may include: identification and contact details; date of birth (also used to verify the patient before a form is shown); health history, symptoms, medications, allergies and review-of-systems answers; answers to mental health screening instruments (such as the PHQ-9, PHQ-2 and GAD-7, including the PHQ-9 item on thoughts of self-harm) and the scores, severity bands and flags derived from them; consent statements accepted, signer names and drawn signatures; completed PDF forms; information about family members or other individuals that a patient chooses to provide; and security records of link access, date-of-birth checks, starts and submissions, together with one-way hashes of the IP address and user agent used to submit or sign. ### 2.4. Categories of Data Subjects Data Subjects whose Personal Information is processed under this Agreement include: patients whose healthcare consultations are recorded and transcribed; healthcare providers (physicians, nurses, specialists) who participate in recorded consultations; and other individuals whose information may be incidentally captured during recorded consultations. Through Patient Forms, Data Subjects also include patients to whom the Customer sends forms, parents, guardians or other persons who fill in or sign a form on a patient's behalf, and individuals about whom a patient provides information in a form. ## 3. OBLIGATIONS OF TRANSCRIBE HEALTH ### 3.1. Compliance with Instructions Transcribe Health shall process Personal Information only on documented instructions from the Customer, including with regard to transfers of Personal Information outside of Canada. The Terms of Service, this Agreement, and the Customer's configuration of the Services constitute the Customer's complete instructions for the processing of Personal Information. Any additional or alternative instructions must be agreed upon separately in writing. ### 3.2. Confidentiality Transcribe Health shall ensure that all persons authorized to process Personal Information have committed to confidentiality obligations or are under an appropriate statutory obligation of confidentiality. Access to Personal Information is restricted to personnel who require access to perform the Services, in accordance with the principle of least privilege. ### 3.3. Security Measures Transcribe Health implements and maintains appropriate technical and organizational measures to protect Personal Information against unauthorized or unlawful processing, accidental loss, destruction, or damage. These measures are described in Schedule B to this Agreement and include, without limitation: AES-256 encryption for data at rest; TLS 1.2 or higher for data in transit; multi-factor authentication for all user accounts; role-based access controls with the principle of least privilege; comprehensive audit logging of all access to Personal Information; automated session timeouts; regular vulnerability assessments; and documented incident response procedures. Transcribe Health shall regularly test, assess, and evaluate the effectiveness of these technical and organizational measures and shall update them as necessary to maintain an appropriate level of security, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risks to Data Subjects. ### 3.4. Sub-processing The Customer provides general authorization for Transcribe Health to engage Sub-processors for the purposes of delivering the Services. The current list of Sub-processors is set out in Schedule C to this Agreement and is available at transcribe.health/legal/dpa. Transcribe Health shall provide at least thirty (30) days' advance written notice before engaging any new Sub-processor or replacing an existing one. The Customer shall have thirty (30) days from receipt of such notice to object on reasonable grounds. If the Customer objects and Transcribe Health cannot reasonably accommodate the objection, the Customer may terminate the affected Services without penalty. Transcribe Health shall impose on each Sub-processor, by way of a written contract, the same data protection obligations as those set out in this Agreement, in particular providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the processing meets the requirements of applicable data protection law, including GDPR Article 28(4). Where a Sub-processor fails to fulfil its data protection obligations, Transcribe Health shall remain liable to the Customer for the performance of that Sub-processor's obligations, subject to the limitations of liability in §10. ### 3.5. Assistance with Data Subject Rights Transcribe Health shall assist the Customer, by appropriate technical and organizational measures and insofar as this is possible, in fulfilling the Customer's obligation to respond to requests from Data Subjects exercising their rights. Given the nature of the Services, the Customer retains direct control over session, transcript, clinical-document, and Assistant-conversation data through the platform interface and may locate, export, correct, restrict, or delete Personal Information without requiring Transcribe Health's intervention. Where a request cannot be satisfied through self-service tooling, Transcribe Health shall provide reasonable assistance upon the Customer's documented request. The rights with respect to which Transcribe Health provides assistance include: under PIPEDA and applicable provincial legislation (including Quebec Law 25, BC PIPA, and Alberta PIPA) — access to and correction of Personal Information; withdrawal of consent; deindexation and the cessation of dissemination under Quebec Law 25 §7; and information about automated decision-making under Quebec Law 25 §12.1. Under the GDPR and UK GDPR (for EU/UK data subjects): the right of access (Article 15) — satisfied through export of a Data Subject's records; rectification (Article 16) — satisfied through in-platform editing of transcripts and clinical notes; erasure (Article 17) — satisfied through deletion tooling and the deletion procedures in §3.7, subject to the mandatory retention periods set out in §3.7 and to Transcribe Health's and the Customer's overriding legal-retention obligations; restriction of processing (Article 18); data portability (Article 20) — satisfied through export in a commonly used, machine-readable format; objection (Article 21); and rights relating to automated individual decision-making, including profiling (Article 22). For clarity, where a Data Subject requests erasure of Personal Information that Transcribe Health or the Customer is required by law to retain (including audio and transcript records subject to the retention periods in §3.7), the data will be restricted from active processing and deleted only upon expiry of the applicable mandatory retention period, in accordance with GDPR Article 17(3)(b) and equivalent provisions of Canadian law. Automated decision-making (Article 22; Quebec Law 25 §12.1; for EU/UK data subjects and Quebec residents where applicable). The Services apply automated processing to generate draft transcriptions, clinical documentation, and Assistant-chat responses. None of these constitutes a decision based solely on automated processing that produces legal effects concerning a Data Subject or similarly significantly affects them. All AI-generated output is a draft intended for review, correction, and approval by a qualified healthcare professional before it is relied upon or entered into a medical record; a human is in the loop at the point of every clinically significant decision. Transcribe Health does not make solely automated decisions about Data Subjects on the Customer's behalf. Transcribe Health shall provide the Customer with reasonable information about the logic involved and the categories of input used, to the extent such information is available to Transcribe Health from its AI Sub-processors and necessary for the Customer to respond to a Data Subject's Article 22 or §12.1 request. Transcribe Health shall also provide reasonable information and assistance to support a Privacy Impact Assessment that the Customer is required to conduct, including any assessment required under Quebec Law 25 §17 in respect of the transfer of Personal Information of Quebec residents outside Quebec, and any Data Protection Impact Assessment under §3.5b. ### 3.5b. Data Protection Impact Assessments and Prior Consultation Taking into account the nature of the processing and the information available to it, Transcribe Health shall provide the Customer with reasonably necessary information, documentation, and assistance to enable the Customer to (a) carry out Data Protection Impact Assessments under GDPR Article 35 and equivalent assessments under applicable law, including the high-risk processing inherent in AI-assisted clinical documentation; (b) consult with a Supervisory Authority under GDPR Article 36 where the Customer is required to do so; and (c) respond to inquiries, investigations, audits, or orders from a Supervisory Authority. Such assistance is provided at the Customer's reasonable request and to the extent the relevant information is within Transcribe Health's possession or control. Transcribe Health maintains, and makes available through its Trust Center, security documentation, sub-processor information, and Transfer Impact Assessment summaries intended to support these assessments. (Applicable to EU/UK data subjects and Quebec residents where applicable.) ### 3.6. Breach Notification In the event of a Security Incident involving Personal Information processed under this Agreement, Transcribe Health shall notify the Customer without undue delay, and in any event within five (5) business days of becoming aware of the Security Incident, and earlier where reasonably feasible given the severity of the incident and the Customer's own notification deadlines under applicable law. A "Security Incident" for this purpose includes a breach of security safeguards under PIPEDA, a confidentiality incident under Quebec Law 25 §3.5, and a personal data breach under GDPR Article 4(12) (where applicable). The initial notification shall include, to the extent reasonably available and consistent with GDPR Article 33(3): (a) a description of the nature of the Security Incident, including where possible the categories and approximate number of Data Subjects concerned and the categories and approximate number of records concerned; (b) the name and contact details of Transcribe Health's designated incident response contact (the Security Officer); (c) a description of the likely consequences of the Security Incident; and (d) a description of the measures taken or proposed to be taken to address the Security Incident, including, where appropriate, measures to mitigate its possible adverse effects. Where it is not possible to provide all of this information at once, it may be provided in phases without further undue delay, and Transcribe Health shall supplement the initial notification as further information becomes available. This five-business-day notice obligation runs to the Customer and applies in addition to, and is consistent with, Transcribe Health's breach-notification obligations as a Business Associate under the Business Associate Agreement, which likewise require notice to the Customer within five (5) business days of discovery. Nothing in this Section alters the Customer's own obligation, as a Covered Entity or controller, to notify affected individuals and regulators within the timeframes required of the Customer by HIPAA (including the 60-day individual-notification deadline under 45 C.F.R. §164.404), PIPEDA, Quebec Law 25, BC PIPA, Alberta PIPA, the GDPR, or other applicable law. Following the initial notification, Transcribe Health shall provide the Customer with regular status updates at reasonable intervals until the incident is resolved. Transcribe Health shall cooperate with the Customer and take reasonable commercial steps to assist in the investigation, mitigation, and remediation of each such Security Incident, including preserving and providing forensic evidence and logs. ### 3.7. Deletion and Return of Data Upon termination of the Services or upon the Customer's request, Transcribe Health shall, at the Customer's election, either return to the Customer all Personal Information in a commonly used, machine-readable format or delete all Personal Information processed on behalf of the Customer, including copies held by Sub-processors and in backup systems. Deletion from active systems shall be completed within thirty (30) days of the request, and from backup systems within ninety (90) days. Independently of any deletion request, the platform enforces mandatory default retention windows on every Customer organization: audio recordings are automatically and permanently deleted ninety (90) days after transcription is completed, and transcript and session records are retained for seven (7) years (subject to a six-year HIPAA minimum) and then automatically deleted. The Customer may also delete Sessions, audio recordings, transcription text, and clinical documents earlier, and — where the Customer has enabled the optional automatic retention policy (configurable in 1-day to 30-day windows and disabled by default) — that policy triggers earlier deletion. Audit logs are retained for at least six (6) years to satisfy HIPAA Security Rule documentation requirements (45 CFR 164.312(b) and 164.530(j)). Upon completion of deletion, Transcribe Health shall provide the Customer with written certification confirming that all Personal Information has been deleted in accordance with this section, including confirmation that Sub-processors have completed their deletion obligations. ### 3.8. Audit Rights Transcribe Health shall make available to the Customer all information necessary to demonstrate compliance with this Agreement and shall allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer. Transcribe Health shall immediately inform the Customer if, in its opinion, an instruction from the Customer infringes PIPEDA or other applicable data protection provisions. Transcribe Health maintains a Trust Center at trust.transcribe.health where the Customer may review Transcribe Health's current security documentation, compliance status, sub-processor list, and, once available, third-party audit reports. Transcribe Health designs and operates its security controls to the AICPA SOC 2 Trust Services Criteria and is preparing for a SOC 2 Type II examination, and its information security management practices are aligned with ISO/IEC 27001. The Customer's audit and inspection rights under this Section are satisfied by Transcribe Health making available, through the Trust Center and under a non-disclosure agreement, its SOC 2 Type II report and any ISO 27001 certification and Statement of Applicability once issued, together with responses to a reasonable number of the Customer's written security questionnaires. The SOC 2 Type II report and any ISO 27001 certification will be made available through the Trust Center once issued, and the Trust Center reflects their current status. The Customer may exercise an on-site or independent third-party audit right beyond this only (a) where required by a binding order of a Supervisory Authority, (b) following a confirmed Security Incident affecting the Customer's Personal Information, or (c) where applicable data protection law confers a non-waivable audit right that this substitution cannot satisfy. Any such audit shall be conducted on reasonable prior written notice, during business hours, subject to confidentiality obligations, in a manner that does not compromise the security or privacy of other customers' data, and no more than once in any twelve-month period absent a Supervisory Authority order or confirmed Security Incident. ## 4. OBLIGATIONS OF THE CUSTOMER ### 4.1. Lawful Basis for Processing The Customer warrants that it has obtained all necessary consents, authorizations, and legal bases required under PIPEDA, applicable provincial privacy legislation, and HIPAA for the collection and processing of Personal Information through the Services. The Customer is responsible for providing appropriate notice to Data Subjects regarding the use of AI-powered transcription services. ### 4.2. Instructions The Customer is responsible for ensuring that its processing instructions to Transcribe Health comply with all applicable data protection laws. The Customer shall not instruct Transcribe Health to process Personal Information in a manner that would violate PIPEDA, HIPAA, or any other applicable law. ### 4.3. Data Accuracy The Customer is responsible for the accuracy of Personal Information provided to Transcribe Health and for updating or correcting such information as necessary. The Customer acknowledges that AI transcription may contain inaccuracies and is responsible for reviewing and correcting transcription output before incorporating it into permanent medical records. ### 4.4. Privacy and Impact Assessments The Customer is responsible for conducting any Data Protection Impact Assessment, Privacy Impact Assessment, or equivalent assessment required of it as controller under applicable law before initiating processing through the Services, including (a) any Data Protection Impact Assessment required under GDPR Article 35 for high-risk processing (where applicable), and (b) any Privacy Impact Assessment required under Quebec Law 25 §17 in respect of communicating or transferring Personal Information of Quebec residents outside Quebec, including to Transcribe Health's infrastructure or its Sub-processors. Transcribe Health shall provide reasonable cooperation and information to support such assessments in accordance with §3.5 and §3.5b. ### 4.5. Patient Forms (a) Roles. For Patient Forms, the Customer decides which forms are used, which questions they ask, which patients receive them and why. The Customer is therefore the controller (GDPR and UK GDPR), the covered entity or, where the Customer is itself a business associate, the upstream business associate (HIPAA), the organization accountable for the information (PIPEDA and the British Columbia and Alberta Personal Information Protection Acts), the enterprise on whose behalf the information is collected (Quebec Law 25), and the business (CCPA/CPRA), for all Customer Form Content and all responses. Transcribe Health acts only as the Customer's processor, business associate and service provider, and processes form data only on the Customer's documented instructions. The Customer's publication of a form, its sending of a form (manually or by turning on automatic sending), and its configuration of scoring and flag rules are documented instructions for the purposes of Section 4.2 and GDPR Article 28(3)(a). Templates in the Services' library are offered as starting points only. Transcribe Health does not warrant that any template is suitable, complete or lawful for the Customer's purposes, and by publishing or sending a template the Customer adopts it as its own Customer Form Content. The library's consent template is not legal advice, and the Customer is responsible for having its wording reviewed before use. (b) Lawful basis and necessity. Without limiting Section 4.1, the Customer is solely responsible for: (i) having a lawful basis, and any consent or authorization required, for every question it asks, including any question that collects special-category data under GDPR Article 9 (such as health, mental health, sex life or sexual orientation, racial or ethnic origin, or religious belief), sensitive personal information under Quebec Law 25 and PIPEDA, or sensitive personal information under the CPRA; (ii) asking only for information that is necessary for the purposes it has identified, consistent with GDPR Article 5(1)(c), PIPEDA Principle 4.4, sections 4 and 5 of Quebec Law 25, and CCPA section 1798.100(c); (iii) giving patients any notice required at the time of collection beyond the default notice the Services display, including the Customer's identity, purposes, legal basis and contact details where GDPR Article 13 applies, and the notice required by section 13.1 of the Alberta Personal Information Protection Act where the Customer has enabled cross-border AI processing; (iv) obtaining the consent of a parent, guardian or tutor where the law requires it, including for a minor under 14 in Quebec (Quebec Law 25, section 4.1); (v) the content of any consent or authorization wording, including, where a form is used as a HIPAA authorization, the core elements and statements required by 45 CFR 164.508(c), and any consent required by 42 CFR Part 2; (vi) deciding whether an electronic signature captured through the Services meets its legal, regulatory and professional requirements; (vii) the validity, licensing and appropriate clinical use of any screening instrument it uses; and (viii) any privacy or data protection impact assessment Patient Forms requires of it under Section 4.4, including GDPR Article 35 where it screens patients' mental health on a large scale. (c) Payment card data prohibited. The Customer shall not use Patient Forms to collect, and shall not ask patients to enter, payment card account numbers, card verification codes (CVV, CVC or similar), PINs or PIN blocks, magnetic stripe or chip data, or any other cardholder or sensitive authentication data within the meaning of the PCI Data Security Standard. Patient Forms is not designed or assessed for cardholder data, and Transcribe Health makes no PCI DSS commitment for any such data. If Transcribe Health becomes aware that a form collects such data, it may notify the Customer and require the Customer to change the form and delete the affected responses, and, where necessary to protect patients or the Services, may archive the form after notice so it can no longer be sent. Any such data received remains protected by the security measures in Schedule B as part of the Customer's Personal Information. A breach of this Section 4.5(c) is a breach of the Customer's obligations under this Agreement for the purposes of Section 10.2. (d) Clinical review of responses and flags. Scores, severity bands and flags are aids to help the Customer decide which responses to review first. They are not diagnoses and do not replace professional judgment. The Customer is solely responsible for reviewing responses and flags in a timely way and for any clinical follow-up, including follow-up on any answer indicating thoughts of self-harm. Transcribe Health does not monitor responses, does not contact patients about their answers, and does not provide an emergency or crisis service. Patient-facing pages state that forms are not monitored around the clock and direct patients to emergency services. This Section 4.5(d) is in addition to Sections 6.2 and 6.3. (e) What Transcribe Health does with form data. Transcribe Health processes Patient Forms data only as described in Sections 2.1(f) and 2.2. It does not use form data to train or improve any model (Section 6.1), for analytics about individual patients, for marketing, or for any purpose of its own, and it does not sell or share form data. Transcribe Health personnel do not access response content except to provide support the Customer requests, to investigate a security incident, or as required by law, and every view or export of a response through the Services is recorded in the audit log without the response content. (f) Retention and deletion of form data. Unsubmitted drafts are deleted 30 days after the form link expires or is cancelled. Submitted responses, scores, flags and completed PDFs are kept with the patient's record in the Services until the Customer deletes that patient or this Agreement ends, and Section 3.7 then applies. When the Customer deletes a patient, the patient's answers, drafts and completed PDFs are deleted, and each signature record is reduced to what proves that consent was given (the form version, a hash of the statement, the date and time, and hashed IP address and user agent), without the signer's name or drawn signature. The Customer remains responsible for keeping any form it must retain as part of its medical record in its own record system, consistent with Section 1.5 of the Business Associate Agreement. (g) Requests from patients. Requests from patients about their form data are handled under Section 3.5. Transcribe Health will promptly forward to the Customer any such request it receives directly and will not respond to it on the merits except as the Customer instructs or the law requires. The Customer can view, export and delete a patient's responses in the Services. ## 5. CROSS-BORDER TRANSFERS ### 5.1. Data Storage All persistent data (databases, files, backups) is stored in Canada on infrastructure controlled by Transcribe Health. The Customer's Personal Information at rest does not leave Canadian jurisdiction. ### 5.2. AI Processing Transfers Per-organization AI residency. Cross-border AI processing under this Section is a per-organization setting, not an automatic default. Each Customer organization's default is Canada-resident inference: clinical AI runs on models hosted within Canada, and the Customer's Content is not transmitted to a United States region for AI inference. A Customer organization's owner or administrator may opt in to enhanced cross-border AI, which routes clinical inference to Google Cloud Vertex AI in a United States region under the Google Cloud Business Associate Agreement and Standard Contractual Clauses; this election is recorded together with the version of the disclosure the Customer accepted, and is reversible at any time. Where a Customer organization has not enabled cross-border AI, its clinical inference remains in Canada and no AI-inference transfer under this Section occurs for that organization. Where a Customer organization has enabled enhanced cross-border AI, derived transcript text (not raw audio, which is transcribed on models hosted within Canada and remains in Canada) may be transmitted to an AI sub-processor with inference endpoints located in the United States. These transfers are temporary, in-transit only, and subject to the following safeguards: data is encrypted using TLS 1.2 or higher during transmission; AI providers are contractually prohibited from retaining, storing, or using Personal Information beyond the immediate processing request; AI providers are bound by Business Associate Agreements where applicable; and transfers are limited to the minimum data necessary to perform the processing. Transcribe Health has conducted a Transfer Impact Assessment for these cross-border transfers, including the per-organization cross-border AI-inference flow to Google Cloud Vertex AI, and has determined that, with the contractual, technical, and organizational safeguards in place, the transfers provide a comparable level of protection to that required under PIPEDA Principle 4.1.3. Transcribe Health has conducted, and maintains, a dedicated Transfer Impact Assessment for the cross-border processing involved in the standalone Assistant chat feature, addressing the categories of data transmitted to the contracted AI Sub-processor, the zero-retention contractual terms, the PHI-scrubbing applied to external medical-literature queries, and the residual-risk analysis for the United States endpoint. A summary of this assessment is available to the Customer through the Trust Center on request. Where the Customer uses Patient Forms, the answers and scores of a form linked to a visit form part of the content transmitted for AI inference for that visit, and are therefore covered by this Section and by the Customer's AI residency setting. Patient Forms does not create any other cross-border transfer. ### 5.3. Transparency The Customer may request information about the specific jurisdictions in which Personal Information is processed. The current list of Sub-processors and their jurisdictions is set out in Schedule C. ## 6. AI-SPECIFIC PROVISIONS ### 6.1. No Model Training Transcribe Health does not use Personal Information processed under this Agreement to train, fine-tune, or improve any artificial intelligence or machine learning models. All AI processing is performed using pre-trained models provided by Sub-processors who are contractually bound by the same restriction. ### 6.2. AI Output Accuracy The Customer acknowledges that AI-generated transcriptions and clinical documentation are produced by automated systems and may contain errors, omissions, or inaccuracies. Transcribe Health does not guarantee the accuracy of AI-generated output. The Customer is solely responsible for reviewing, verifying, and approving all AI-generated content before incorporating it into medical records or relying on it for clinical decision-making. ### 6.3. Human Oversight The Services are designed to augment, not replace, the professional judgment of healthcare providers. The Customer shall ensure that qualified healthcare professionals review all AI-generated output before it is finalized. Transcribe Health provides tools within the platform for reviewing and editing transcriptions and clinical notes. ## 7. GOVERNMENT AND LAW ENFORCEMENT REQUESTS ### 7.1. Notification If Transcribe Health receives a request from a government authority or law enforcement agency for access to Personal Information processed on behalf of the Customer, Transcribe Health shall promptly notify the Customer of the request before disclosing any data, unless such notification is prohibited by applicable law. Where notification is prohibited, Transcribe Health shall use commercially reasonable efforts to challenge the prohibition and to redirect the requesting authority to obtain the data directly from the Customer. ### 7.2. Minimum Disclosure In the event that Transcribe Health is compelled by law to disclose Personal Information to a government authority, Transcribe Health shall disclose only the minimum amount of information required to satisfy the legal obligation and shall use commercially reasonable efforts to protect the confidentiality of the disclosed information. ## 8. HIPAA BUSINESS ASSOCIATE PROVISIONS Where the Customer is a Covered Entity or Business Associate under HIPAA, the terms of the Business Associate Agreement (available at transcribe.health/legal/baa) are incorporated by reference into this Agreement. In the event of a conflict between this Agreement and the Business Associate Agreement with respect to the handling of Protected Health Information, the Business Associate Agreement shall prevail. ## 9. INSURANCE Transcribe Health is procuring cyber-liability and technology errors-and-omissions insurance appropriate to the nature and scale of the Services and intends to maintain such coverage once bound. Transcribe Health makes no representation in this Agreement as to any specific coverage amount or that any such policy is currently in force, and any reference to insurance shall not be construed as a guarantee of coverage, an admission of liability, or a substitute for the limitations of liability in §10. Upon the Customer's written request following the binding of a policy, Transcribe Health shall confirm the existence and general scope of its then-current coverage, subject to the confidentiality terms of this Agreement. ## 10. LIABILITY AND INDEMNIFICATION ### 10.1. Liability Each party shall be liable for damages caused by processing that infringes applicable data protection laws. Transcribe Health shall be liable for damages caused by processing that does not comply with this Agreement or that is outside of or contrary to the Customer's lawful instructions. ### 10.2. Indemnification Transcribe Health shall indemnify, defend, and hold harmless the Customer from and against any third-party claims, damages, losses, and expenses (including reasonable legal fees) arising from Transcribe Health's breach of this Agreement, its negligent or wrongful processing of Personal Information, or its failure to comply with applicable data protection laws. The Customer shall indemnify, defend, and hold harmless Transcribe Health from and against any third-party claims arising from the Customer's unlawful processing instructions, failure to obtain required consents, or breach of the Customer's obligations under this Agreement. ### 10.3. Limitation Except as set out in this Section, the total aggregate liability of either party arising out of or in connection with this Agreement, the Business Associate Agreement, and the Terms of Service shall be subject to, and shall not exceed, the single combined limitation of liability set out in the Terms of Service, which applies as one shared cap across this Agreement, the Business Associate Agreement, and the Terms of Service. For the avoidance of doubt, this Agreement does not establish any separate or higher liability cap specific to Personal Information or Protected Health Information; the Terms of Service cap governs, including in respect of (i) Security Incidents and breaches of confidentiality affecting Personal Information, and (ii) a party's indemnification obligations under §10.2, including claims and administrative fines flowing from a Data Subject or a Supervisory Authority under GDPR Article 82 (where applicable). The Terms of Service cap shall not apply only to liability that cannot lawfully be excluded or limited under applicable law, including liability for death or personal injury caused by a party's negligence and liability for fraud or fraudulent misrepresentation. Nothing in this Section operates to limit or exclude any liability to the extent such limitation or exclusion is prohibited by the mandatory provisions of applicable data protection law. ## 11. TERM AND TERMINATION ### 11.1. Term This Agreement shall commence on the date the Customer accepts the Terms of Service and shall continue for as long as Transcribe Health processes Personal Information on behalf of the Customer. ### 11.2. Termination for Material Security Deficiency If an audit or assessment reveals a material security deficiency in Transcribe Health's processing of Personal Information, and Transcribe Health fails to remediate the deficiency within thirty (30) days of receiving written notice, the Customer may terminate this Agreement and the related Services without penalty. ### 11.3. Survival The following obligations shall survive the termination or expiry of this Agreement for as long as Transcribe Health retains any Personal Information of the Customer and thereafter to the extent required by applicable law: the obligations with respect to the confidentiality and security of Personal Information; the return or deletion of Personal Information under §3.7; assistance with and cooperation in audits and Supervisory Authority inquiries under §3.5b and §3.8; breach notification and incident-assistance obligations under §3.6 with respect to Security Incidents affecting Personal Information processed during the term; the limitations of liability and indemnification under §10; and the provisions of the Business Associate Agreement. ## 12. GENERAL PROVISIONS ### 12.1. Governing Law This Agreement shall be governed by and construed in accordance with the laws of the Province of Ontario and the federal laws of Canada applicable therein, without regard to conflict of laws principles. ### 12.2. Amendments and Regulatory Changes Transcribe Health may update this Agreement from time to time to reflect changes in its processing activities, Sub-processors, or applicable law. Material changes will be communicated to the Customer with at least thirty (30) days' advance written notice. Continued use of the Services after such notice constitutes acceptance of the updated Agreement. In the event that new data protection legislation or regulatory guidance materially affects the obligations of either party under this Agreement, both parties shall negotiate in good faith to amend this Agreement to ensure continued compliance. ### 12.3. Severability If any provision of this Agreement is held to be invalid or unenforceable, the remaining provisions shall continue in full force and effect. ### 12.4. Entire Agreement This Agreement, together with the Terms of Service, Privacy Policy, Business Associate Agreement, and (where applicable) the California Consumer Privacy Addendum in §13, constitutes the entire agreement between the parties with respect to the processing of Personal Information and supersedes all prior agreements, representations, and understandings relating to data processing. ## 13. CALIFORNIA CONSUMER PRIVACY ADDENDUM This Section applies where, and to the extent that, the Customer is a "business" and Transcribe Health processes the Personal Information of California residents on the Customer's behalf, within the meaning of the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act (collectively, "CCPA"). Terms used in this Section and defined in the CCPA have the meanings given there. ### 13.1. Service Provider Status The parties acknowledge that Transcribe Health is a "Service Provider" as defined in CCPA §1798.140(ag), processing Personal Information that the Customer discloses to it for the limited and specified business purpose of providing the Services under the Terms of Service. ### 13.2. Restrictions on Use Transcribe Health shall not: (a) sell or share (as those terms are defined in the CCPA) Personal Information; (b) retain, use, or disclose Personal Information for any purpose other than the specific business purpose of performing the Services, or as otherwise permitted by the CCPA; (c) retain, use, or disclose Personal Information outside the direct business relationship between the parties; or (d) combine Personal Information received from or on behalf of the Customer with Personal Information that Transcribe Health receives from or on behalf of any other person, or collects from its own interaction with a consumer, except as permitted under CCPA §1798.140(ag)(1)(D) and its implementing regulations. Transcribe Health certifies that it understands and will comply with the restrictions in this Section. ### 13.3. Consumer Rights Assistance Transcribe Health shall provide reasonable assistance to enable the Customer, as the business, to honor verifiable consumer requests to know, access, correct, and delete Personal Information, and to honor requests to limit the use and disclosure of sensitive personal information, in accordance with §3.5. ### 13.4. Sub-processors Transcribe Health shall engage Sub-processors that process Personal Information of California residents only under a written contract that binds them to the equivalent restrictions and obligations set out in this Section, as required by CCPA §1798.140(ag)(1). ### 13.5. Compliance and Notice Transcribe Health shall comply with its obligations as a Service Provider under the CCPA and shall notify the Customer if it determines that it can no longer meet those obligations. The Customer may, upon notice, take reasonable and appropriate steps to stop and remediate unauthorized use of Personal Information. --- ## SCHEDULE A: PROCESSING DETAILS | Field | Detail | |---|---| | Subject Matter | AI-powered transcription of healthcare consultations, generation of clinical documentation, and operation of the standalone Assistant chat feature (evidence-based clinical Q&A with literature citations), and operation of Patient Forms (collection of intake, consent and screening forms from patients on the Customer's behalf) | | Duration | For the term of the Customer's subscription to the Services. By default, and regardless of any optional retention policy, audio recordings are automatically and permanently deleted 90 days after transcription is completed, and transcript and session records are retained for seven (7) years (subject to a six-year HIPAA minimum) and then automatically deleted. These default windows apply to every organization and are enforced automatically by the platform. The Customer may optionally enable an earlier automatic-deletion policy, configurable from 1 to 30 days and disabled by default, which deletes Content earlier than the default windows. Patient Forms drafts are deleted 30 days after the link expires or is cancelled; submitted responses follow Section 4.5(f). | | Nature of Processing | Automated transcription of audio recordings, temporary audio storage, persistent text storage, AI-generated clinical note creation, and operation of the standalone Assistant chat: receipt of user-submitted clinical questions (which may include patient context), retrieval of excerpts from public medical literature sources, transmission of the question and prior conversation context to a zero-retention AI sub-processor for inference, return of an AI-generated answer with literature citations, and persistent storage of the resulting conversation and message history; for Patient Forms: hosting published form versions, sending form links, date-of-birth verification, collection and encrypted storage of answers, drafts, signatures and completed PDFs, rule-based scoring and flagging, display to Authorized Users, and inclusion of visit-linked answers in AI note generation | | Purpose | To provide the Customer with transcription, clinical documentation, and clinical-intelligence (Assistant chat) services as described in the Terms of Service | | Categories of Data Subjects | Patients, healthcare providers, and other individuals whose information is captured during recorded consultations or included by Authorized Users in Assistant questions, patients who receive Patient Forms, persons who fill in or sign a form on a patient's behalf, and individuals described in a patient's answers | | Categories of Personal Information | Health information (symptoms, diagnoses, treatments, medications, medical history), patient identifiers (names, dates of birth as mentioned), provider identifiers, free-text clinical questions and any patient context submitted to the Assistant chat, AI-generated answers and the literature citations attached to them, conversation titles, and message history, and Patient Forms data as listed in Section 2.3 | | Sensitive Data | Health information constituting sensitive personal information under PIPEDA (and Quebec Law 25), special-category data under GDPR Article 9 (health data), and Protected Health Information under HIPAA. The Assistant chat may receive such sensitive data through free-text questions if Authorized Users elect to include patient context. Patient Forms may collect mental health screening answers and any other special-category or sensitive data the Customer Form Content asks for, under the Customer's responsibility in Section 4.5(b). | ## SCHEDULE B: TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES ### Encryption - AES-256 encryption for all data at rest (databases, file storage, backups) - TLS 1.2 or higher for all data in transit - Encrypted database connections between application services - Key management: encryption keys are managed separately from the data they protect, with access restricted to the Security Officer and the platform's automated key-handling components. Per-session symmetric keys used for browser-side capture are generated and scoped per session and are not reused across sessions. ### Access Control - Multi-factor authentication required for all user accounts - Role-based access control (RBAC) with capability-based permissions - Principle of least privilege enforced across all services - Automated session timeout after period of inactivity - Organization-level data isolation in multi-tenant architecture ### Monitoring and Logging - Comprehensive audit logging of all access to Personal Information - PHI access logging with separate retention (6 years) - Real-time security event monitoring - Automated alerting for suspicious activity ### Physical Security - Production servers located in a locked, access-controlled server room in Canada, with physical access restricted to authorized personnel - Video monitoring of the server room - Smoke and fire detection, dedicated cooling, and an uninterruptible power supply (UPS) - Production storage encrypted at rest (AES-256), with encryption keys escrowed separately from the storage they protect - Backups kept on separate, dedicated backup storage with immutable retention - Components hosted on Google Cloud Platform or Amazon Web Services rely on the physical safeguards of those providers' data centers, which the providers have independently audited (SOC 2 Type II, ISO 27001) ### Infrastructure Security - Self-hosted Kubernetes infrastructure in Canada - Network segmentation with firewall rules - Redundant (mirrored) storage, continuous database backups with point-in-time recovery, and documented disaster-recovery procedures - Regular security patching and vulnerability management ### Data Management - Configurable data retention with automatic deletion - Backup integrity: encrypted backups are subject to periodic restore validation to confirm recoverability and integrity - Bounded backup lifecycle: residual encrypted backup copies age out on a bounded, automated cycle following deletion from active systems, consistent with the retention periods in §3.7 - Secure data deletion procedures ### Pseudonymisation and Data Minimisation - De-identified literature index: the Assistant retrieval index holds only de-identified medical-literature metadata; raw patient questions are not transmitted to external research APIs, which receive only PHI-scrubbed query variants - Minimisation of cross-border payloads: only the minimum data necessary for AI inference is transmitted to AI Sub-processors, under zero-retention terms - Tenant and user isolation: Assistant conversations are scoped to a single Authorized User within a single Customer organization and are not combined across users, conversations, or organizations ### Organizational Measures - Security Officer (the founder), serving as the HIPAA Security Officer and privacy contact - Documented security policies and procedures - Annual security awareness training (scheduled in the compliance calendar) - Documented incident response plan with defined escalation procedures - Regular risk assessments and security evaluations - Business Associate Agreements with all Sub-processors handling PHI ## SCHEDULE C: LIST OF SUB-PROCESSORS ### Google Cloud Platform / Vertex AI - **Legal entity**: Google LLC - **Jurisdiction**: United States (AI inference endpoints, where a Customer organization has enabled cross-border AI); Canada (storage and default AI inference) - **Purpose**: Cloud infrastructure and Vertex AI model endpoints for transcription and clinical-note generation - **Data processed**: Derived transcript text transmitted for AI inference when the Customer's organization has enabled cross-border AI; raw audio is transcribed in Canada and is not transmitted; not retained or used for training by the provider - **Safeguards**: BAA in place; zero-retention terms; provider holds SOC 2 Type II; encrypted in transit ### Amazon Web Services / Amazon Bedrock - **Legal entity**: Amazon Web Services, Inc. - **Jurisdiction**: Canada (ca-central-1 exclusively; Bedrock inference does not transmit Customer Content outside Canada) - **Purpose**: Cloud infrastructure and Amazon Bedrock managed model endpoints for clinical-note generation and related AI inference - **Data processed**: Derived transcript text transmitted for AI inference; raw audio is transcribed in Canada and is not transmitted; not retained or used for training by the provider or the underlying model provider - **Safeguards**: BAA in place; zero-retention terms; provider holds SOC 2 Type II, ISO 27001, and HIPAA eligibility; encrypted in transit ### Stripe - **Legal entity**: Stripe, Inc. - **Jurisdiction**: United States - **Purpose**: Payment processing and subscription management - **Data processed**: Customer billing and account information; no PHI - **Safeguards**: PCI DSS Level 1; DPA in place ### Cloudflare - **Legal entity**: Cloudflare, Inc. - **Jurisdiction**: Global edge network - **Purpose**: CDN, DDoS protection, DNS - **Data processed**: Web traffic metadata; no PHI in cached content - **Safeguards**: DPA in place; provider holds SOC 2 Type II; encrypted in transit ### GitHub - **Legal entity**: GitHub, Inc. - **Jurisdiction**: United States - **Purpose**: Source-code hosting and CI/CD operations - **Data processed**: Operational and configuration data; no Customer PHI processed in the course of the Services - **Safeguards**: DPA in place; provider holds SOC 2 Type II ### Twilio - **Legal entity**: Twilio Inc. - **Jurisdiction**: United States - **Purpose**: SMS appointment reminders and inbound reply handling - **Data processed**: Patient mobile number, appointment date and time, and practice identity; no clinical detail is included in message bodies - **Safeguards**: DPA, BAA, and A2P 10DLC registration required before SMS is enabled; encrypted in transit