Compliance

AivaMD handles health information as defined under the Alberta Health Information Act (HIA), RSA 2000, c H-5.

Health information you enter - including encounter notes, patient names, health card numbers, and diagnosis codes - is used solely to generate billing codes and claims on your behalf.

AivaMD does not sell, share, or disclose health information to third parties except as required to deliver the service (see Third-Party Processors below) or as required by law.

All production servers are hosted in Canada: backend infrastructure on Fly.io (yyz - Toronto, ON) and database on Supabase (ca-central-1 - Montreal, QC). No patient health information leaves Canada except as required for the services listed under Third-Party Processors.

As a healthcare provider using AivaMD, you remain the custodian of your patients' health information under HIA and are responsible for ensuring your use of the platform complies with your obligations under HIA and the College of Physicians and Surgeons of Alberta (CPSA) standards.

AivaMD acts as an information manager under HIA s.66 pursuant to a written Information Manager Agreement (IMA) executed with each custodian (physician or clinic). The Terms of Service set out the permitted purposes, use restrictions, security requirements, and data-handling obligations incorporated into that agreement.

AivaMD complies with the Alberta Personal Information Protection Act (PIPA), SA 2003, c P-6.5, which is the primary applicable private-sector privacy law for provincially regulated activities in Alberta.

AivaMD also complies with the Personal Information Protection and Electronic Documents Act (PIPEDA), SC 2000, c 5, which applies to interprovincial activities and transfers of personal information outside Alberta (for example, to third-party processors such as Anthropic and Stripe).

We collect only the personal information necessary to provide the service: name, email address, Practitioner ID, practice details, and health information you submit.

You may request access to, correction of, or deletion of your personal information at any time by contacting support@aivamd.ca.

We do not use personal information for purposes beyond what is disclosed in our Privacy Policy without obtaining additional consent.

H-Link is Alberta Health's electronic claim submission system. AivaMD has completed H-Link accreditation through Alberta Health and is authorized to submit claims electronically on behalf of registered physicians.

Claims are submitted via secure SFTP to Alberta Health in the H-Link EDI format as specified by the Electronic Claims Submission Specifications Manual (Version 3.1, January 2016). All transmissions are encrypted in transit.

AivaMD's H-Link submitter credentials (prefix AVM, User AVMa) are issued by Alberta Health and are used exclusively for authorized claim submission on behalf of AivaMD-registered providers.

AivaMD does not guarantee that claims submitted to Alberta Health will be accepted. Claim acceptance is governed by Alberta Health policies and your compliance with the Schedule of Medical Benefits (SOMB).

AivaMD uses the Anthropic Claude API to analyze encounter notes and extract billing codes. Encounter text is sent to Anthropic's API for processing. AivaMD has a Data Processing Agreement (DPA) with Anthropic governing this data handling.

Under Anthropic's API terms and the DPA, customer data submitted via the API is not used to train Anthropic's models.

AivaMD does not train AI models on individual patient records or provider billing data.

Aggregated, anonymized usage data may be used internally to improve extraction accuracy.

All data is encrypted in transit using TLS 1.2 or higher.

Data at rest is encrypted using AES-256.

Access to health information is restricted to authenticated providers. Each API endpoint enforces provider-level isolation - you can only access your own claims and data.

Authentication is managed by Clerk using industry-standard JWT tokens verified on every API request.

We conduct regular security reviews and follow OWASP guidelines for web application security.

Deepgram (USA): When you use the voice recording feature, encounter audio is streamed to Deepgram's nova-2-medical API for real-time transcription. Raw audio is not retained after transcription. You must obtain patient consent before recording any encounter.

Anthropic (USA): Encounter note text is sent to Anthropic's Claude API for billing code extraction. Governed by Anthropic's API Data Processing Agreement. Anthropic does not use API inputs to train models.

Clerk (USA): User authentication and session management. No patient health information (PHI) is transmitted to Clerk.

Stripe (USA): Payment processing for subscriptions under Stripe's own PCI-DSS compliance program. No PHI is transmitted to Stripe.

Fly.io (Canada - Toronto, ON): Backend API server hosting. Health information transits and is processed here. DPA signed June 2026.

Supabase (Canada - Montreal, QC): PostgreSQL database hosting. Health information is stored here, encrypted at rest.

Vercel (USA): Frontend application hosting (static assets and server-side rendering). No PHI is stored on Vercel.

Alberta Health (Canada): Claim data is submitted to Alberta Health via H-Link EDI as part of the authorized billing process.

Service providers outside Canada: as contemplated by PIPA Alberta s.13.1, you may request our current list of service providers, their roles, and the jurisdictions in which they operate, and contact our Privacy Officer at support@aivamd.ca with any questions about personal information handled by service providers outside Canada.

AivaMD acts as an information manager, which makes it an affiliate of the custodian under the Health Information Act. As an affiliate, AivaMD reports to the custodian ANY loss of, unauthorized access to, or unauthorized disclosure of individually identifying health information in that custodian's custody or control. This duty under HIA s.60.1 has no harm threshold and no exceptions: every such incident is reported to the physician, whether or not AivaMD assesses it as harmful.

Reports are made to the affected custodian as soon as practicable after the incident is discovered, and always without waiting for an internal harm assessment to conclude.

The custodian, in turn, is required by HIA s.60.1 to notify the Office of the Information and Privacy Commissioner of Alberta (OIPC), the Minister of Health, and affected individuals where there is a risk of harm. AivaMD supports the custodian in making those notifications and provides the information needed to do so.

Separately, for personal information that is not health information (for example account and billing details), AivaMD notifies the OIPC under PIPA Alberta of any breach that creates a real risk of significant harm to an individual. This PIPA harm threshold applies only to that non-health information, and never limits the absolute reporting duty described above.

To report a suspected breach or security vulnerability, contact support@aivamd.ca immediately.

HIA s.64 requires a custodian to submit a Privacy Impact Assessment (PIA) to the Office of the Information and Privacy Commissioner of Alberta before implementing a new practice or information system that collects, uses, or discloses health information. Adopting AivaMD is such a change.

The duty to prepare and submit a PIA belongs to you as the custodian. AivaMD cannot file one on your behalf, because a PIA describes your practice, your patients, and your administrative and physical safeguards - not only the software you use.

AivaMD provides the vendor-side information a PIA requires: the subprocessors listed above and their jurisdictions, what data crosses the border and why, how health information is encrypted in transit and at rest, how provider isolation is enforced, and written confirmation that patient data is never used to train an AI model.

If your clinic already has a PIA on file, adopting AivaMD will normally need an amendment rather than a new submission. Contact support@aivamd.ca and we will supply what you need for either route.

Privacy Officer: Cole Patola, AivaMD Inc. For compliance inquiries, Privacy Impact Assessments, or to report a concern: support@aivamd.ca.

For complaints under PIPA Alberta or HIA: Office of the Information and Privacy Commissioner of Alberta (OIPC) - oipc.ab.ca - 1-888-878-4044.

For complaints under PIPEDA (federal): Office of the Privacy Commissioner of Canada - priv.gc.ca - 1-800-282-1376.

AivaMD Inc. is incorporated in Alberta, Canada (Corporation Number 2029239404).

Effective date: June 2026.