Compliance, in detail.

AivaMD handles health information as defined under the Alberta Health Information Act (HIA), RSA 2000, c H-5.

Health information you enter - including encounter notes, patient names, health card numbers, and diagnosis codes - is used only to provide the service you signed up for: generating billing codes and claims, writing the encounter note, keeping your patient files, and answering your questions in the Aiva assistant.

AivaMD does not sell, share, or disclose health information to third parties except as required to deliver the service (see Third-Party Processors below) or as required by law.

All production servers are hosted in Canada, in Ontario and Quebec, which is outside Alberta: backend infrastructure on Fly.io (yyz - Toronto, ON) and database on Supabase (ca-central-1 - Montreal, QC). No patient health information leaves Canada except as required for the services listed under Third-Party Processors.

As a healthcare provider using AivaMD, you remain the custodian of your patients' health information under HIA and are responsible for ensuring your use of the platform complies with your obligations under HIA and the College of Physicians and Surgeons of Alberta (CPSA) standards.

AivaMD acts as an information manager as defined in HIA s.1(1)(p.1), under the written Information Manager Agreement (IMA) that HIA s.66(2) requires, signed with each custodian (each physician). The Terms of Service set out the permitted purposes, use restrictions, security requirements, and data-handling obligations incorporated into that agreement.

AivaMD complies with the Alberta Personal Information Protection Act (PIPA), SA 2003, c P-6.5, which governs your own account and billing details. Patient health information is governed by the HIA instead.

AivaMD also complies with the Personal Information Protection and Electronic Documents Act (PIPEDA), SC 2000, c 5, which applies to personal information that crosses provincial or national borders in the course of commercial activity (for example, to processors in the United States such as Anthropic and Stripe).

We collect only the personal information necessary to provide the service: name, email address, Practitioner ID, practice details, and health information you submit.

You may request access to, correction of, or deletion of your personal information at any time by contacting support@aivamd.ca.

We do not use personal information for purposes beyond what is disclosed in our Privacy Policy without obtaining additional consent.

H-Link is Alberta Health's electronic claim submission system. AivaMD has completed H-Link accreditation through Alberta Health and is authorized to submit claims electronically on behalf of registered physicians.

Claims are submitted via secure SFTP to Alberta Health in the H-Link EDI format as specified by the Electronic Claims Submission Specifications Manual (Version 3.1, January 2016). All transmissions are encrypted in transit.

AivaMD's H-Link submitter credentials (submitter prefix AVM) are issued by Alberta Health and are used exclusively for authorized claim submission on behalf of AivaMD-registered providers.

AivaMD does not guarantee that claims submitted to Alberta Health will be accepted. Claim acceptance is governed by Alberta Health policies and your compliance with the Schedule of Medical Benefits (SOMB).

AivaMD uses the Anthropic Claude API to read what you upload and extract billing codes. The notes, documents and photos you upload, including patient names, health numbers and dates of birth, and your questions to the Aiva assistant, are sent to Anthropic's API in the United States for processing. AivaMD has a Data Processing Agreement (DPA) with Anthropic governing this data handling.

Under Anthropic's API terms and the DPA, customer data submitted via the API is not used to train Anthropic's models.

AivaMD does not train any AI model on health information, and neither do our processors.

All data is encrypted in transit using TLS 1.2 or higher.

Data at rest is encrypted using AES-256.

Access to health information is restricted to authenticated providers. Each API endpoint enforces provider-level isolation - you can only access your own claims and data.

Authentication is managed by Clerk using industry-standard JWT tokens verified on every API request.

Before every release we run automated security checks: known vulnerabilities in the software we depend on, that every endpoint still requires sign-in, and that no credential has been left in the code. Known gaps are tracked until they are fixed. No independent penetration test has been done yet.

Deepgram (USA): When you use the voice recording feature, encounter audio is streamed to Deepgram's nova-2-medical API for real-time transcription. Raw audio is not retained after transcription. You must obtain patient consent before recording any encounter.

Anthropic (USA): The notes, documents and photos you upload (which carry patient names, health numbers, dates of birth and diagnoses) and your Aiva assistant conversations are sent to Anthropic's Claude API for billing code extraction and answers. Governed by Anthropic's API Data Processing Agreement. Anthropic does not use API inputs to train models.

Clerk (USA): User authentication and session management. No patient health information (PHI) is transmitted to Clerk.

Stripe (USA): Payment processing for subscriptions under Stripe's own PCI-DSS compliance program. No PHI is transmitted to Stripe.

Fly.io (Canada - Toronto, ON): Backend API server hosting. Health information transits and is processed here. DPA signed June 2026.

Supabase (Canada - Montreal, QC): PostgreSQL database hosting. Health information is stored here, encrypted at rest.

Vercel (USA): Frontend application hosting. Vercel serves the static assets and browser code of the web application only. The application calls the AivaMD backend in Canada directly from your browser, so no patient health information is processed or stored on Vercel.

Alberta Health (Canada): Claim data is submitted to Alberta Health via H-Link EDI as part of the authorized billing process.

Service providers outside Canada: as contemplated by PIPA Alberta s.13.1, you may request our current list of service providers, their roles, and the jurisdictions in which they operate, and contact our Privacy Officer at support@aivamd.ca with any questions about personal information handled by service providers outside Canada.

AivaMD acts as an information manager, which makes it an affiliate of the custodian under the Health Information Act. As an affiliate, AivaMD reports to the custodian ANY loss of, unauthorized access to, or unauthorized disclosure of individually identifying health information in that custodian's custody or control. This duty under HIA s.60.1(1) has no harm threshold: every such incident is reported to the physician, whether or not AivaMD assesses it as harmful.

Reports are made to the affected custodian as soon as practicable after the incident is discovered, and always without waiting for an internal harm assessment to conclude.

The custodian, in turn, is required by HIA s.60.1(2) and (3) to notify the Office of the Information and Privacy Commissioner of Alberta (OIPC), the Minister of Primary and Preventative Health Services, and affected individuals where there is a risk of harm. AivaMD supports the custodian in making those notifications and provides the information needed to do so.

Separately, for personal information that is not health information (for example account and billing details), AivaMD notifies the OIPC under PIPA Alberta of any breach that creates a real risk of significant harm to an individual. This PIPA harm threshold applies only to that non-health information, and never limits the absolute reporting duty described above.

To report a suspected breach or security vulnerability, contact support@aivamd.ca immediately.

HIA s.64 requires a custodian to prepare a Privacy Impact Assessment (PIA) and submit it to the Office of the Information and Privacy Commissioner of Alberta for review and comment before introducing or changing a practice or information system that collects, uses, or discloses health information. Adopting AivaMD is such a change.

The duty to prepare and submit a PIA belongs to you as the custodian. AivaMD cannot file one on your behalf, because a PIA describes your practice, your patients, and your administrative and physical safeguards - not only the software you use. Physicians who practise together under the same policies and systems can submit one PIA that each of them signs.

HIA s.64.2(6) requires AivaMD, as your information manager, to give you a plain-language description of the system in enough detail for your PIA. It covers the subprocessors listed above and their jurisdictions, what data leaves Alberta and why, how health information is encrypted in transit and at rest, how provider isolation is enforced, and written confirmation that patient data is never used to train an AI model.

If you have already submitted a PIA that covers how you bill, adopting AivaMD is an amendment to it rather than a new assessment (Health Information (Ministerial) Regulation, s.6). The description is in the app under Settings, Agreements ("How AivaMD handles health information"), and support@aivamd.ca sends it to anyone who asks.

Privacy Officer: Cole Patola, AivaMD Inc. For compliance inquiries, Privacy Impact Assessments, or to report a concern: support@aivamd.ca.

For complaints under PIPA Alberta or HIA: Office of the Information and Privacy Commissioner of Alberta (OIPC) - oipc.ab.ca - 1-888-878-4044.

For complaints under PIPEDA (federal): Office of the Privacy Commissioner of Canada - priv.gc.ca - 1-800-282-1376.

AivaMD Inc. is incorporated in Alberta, Canada (Corporation Number 2028239404).

Effective date: August 2026. Last updated: October 2026.