Skip to content
Privacy

Ava Terms of Service for Clinics

Addendum A — Information Management Services

Incorporated by: Ava Terms of Service for Clinics, Section 13.6

Applies to: All Clinic subscribers in Alberta, British Columbia, and Ontario

Provincial Addenda: Addendum B (Alberta HIA); Addendum C (British Columbia); Addendum D (Ontario PHIPA / OMD)

Version: 1.0 — October 6, 2026

NOTE
This Addendum A is incorporated by reference into the Ava Industries Ltd. Clinic Terms of Service for Clinics and forms part of the Agreement between Ava and each Clinic subscriber. It is also incorporated by reference into Addendum B (Alberta), Addendum C (British Columbia), and Addendum D (Ontario). Where a provincial addendum imposes additional or more specific obligations on Ava as information manager, the addendum prevails to the extent of any inconsistency with this Addendum.

1. Purpose, Incorporation and Definitions

This Addendum A forms part of the Ava Terms of Service for Clinics (the "Clinic TOS") and describes the Information Management Services (“IMS”) that Ava provides to Clinics and their Authorized Users in the course of delivering the Platform. Capitalized terms used in this Addendum have the meanings given to them in the Clinic TOS.

This Addendum A satisfies the requirement under applicable Health Privacy Laws for a written agreement describing the services to be provided by an information manager, service provider, or equivalent, including section 66 of the Health Information Act (RSA 2000, c. H-5) in Alberta, section 17 of the Personal Health Information Protection Act (SO 2004, c. 3, Sch. A) in Ontario, and equivalent provisions under applicable health privacy legislation in British Columbia and other provinces. The specific statutory compliance confirmation for each province is set out in the applicable provincial addendum.

The written agreement between Ava and each Clinic for the purposes of applicable Health Privacy Laws consists of the Clinic TOS, this Addendum A, and the applicable provincial addendum, read together.

1.1. Definitions

"Nurse Practitioner" means a registered nurse who holds additional registration entitling them to practice as a nurse practitioner under applicable health profession legislation and who is recognized as a custodian or equivalent under applicable Health Privacy Laws. The specific statutory recognition in each province is set out in the applicable provincial addendum.

"Affiliate" means, in respect of a Clinic, an employee, volunteer, student, contractor, or agent of a physician or other custodian — including, for example, a nurse, medical office assistant, or other clinic staff member — who performs a service for that custodian, as that concept is used under applicable Health Privacy Laws. An Affiliate is not itself a custodian and acts under the direction and authority of the custodian it serves.

"Custodian(s)" means, individually and collectively, the physicians and any Nurse Practitioners or other individuals or organizations recognized as a custodian or equivalent under applicable Health Privacy Laws who are party to the Clinic TOS, whether directly or through an Authorized Representative, together with their respective Affiliates where the context requires. Nothing in this definition expands or narrows who is a custodian under applicable Health Privacy Laws — it identifies, among the persons who may already be custodians, which of them are bound by this Addendum.

Unless the context requires otherwise, every reference in this Addendum to the Clinic applies equally, and in the same manner, to any Custodian who is a party to the Clinic TOS, and every reference to Authorized Users includes that Custodian's Affiliates. This Addendum does not itself make any person a custodian under applicable Health Privacy Laws, and does not alter the scope of custodianship that applies to any physician, nurse practitioner, or other custodian by operation of applicable Health Privacy Laws.

2. Information Management Services Provided by Ava

Ava will provide the following Information Management Services to each Clinic, as applicable to the Services subscribed to by the Clinic under the applicable Order, Service Agreement, and Service Level Assurance (“SLA”):

  1. EMR Platform: Host, operate, maintain, and provide access to the Ava electronic medical record Platform in accordance with the Clinic TOS and the applicable SLA. Ava will use commercially reasonable efforts to ensure the Platform is available and performs in accordance with the service levels described in the applicable SLA.
  2. Health Information Processing: Process, store, organize, retrieve, transmit, display, copy, and otherwise handle health information only as necessary to provide the IMS, in accordance with the Clinic's lawful instructions, this Addendum, the Clinic TOS, the applicable provincial addendum, and applicable Health Privacy Laws. The categories of health information processed and the sources from which it is collected are described in the applicable Order and product documentation. As between the parties, custody and control of health information at all times remains with the Clinic and its Custodians. Ava has no independent authority to collect health information on its own behalf and holds no custody or control of health information in its own right.
  3. Permitted Purposes: Use and disclose health information provided by the Clinic solely to deliver the IMS and to create Aggregate Data as expressly permitted in Section 7.2 of the Clinic TOS, subject to any restrictions imposed by the applicable provincial addendum. Ava will not collect health information from other sources, or use or disclose health information for any other purpose, without the Clinic's prior written consent or as required by applicable law.

3A Secondary Use, Analytics, and AI Training Restrictions: Notwithstanding the foregoing, Ava will not, except as required to provide the specific IMS subscribed to by the Clinic: (a) use or disclose identifiable health information for analytics, benchmarking, or service or product improvement beyond what is reasonably necessary to operate and support the specific Services subscribed to by the Clinic; (b) aggregate or combine health information with data from other customers, or otherwise use health information across Ava's customer base, for analytics, product development, marketing, research, or any other secondary purpose; (c) use identifiable health information to train, fine-tune, validate, or otherwise improve any general-purpose or multi-customer artificial intelligence or machine-learning model; or (d) use or disclose health information for advertising, marketing, or sale, or provide it to a third party for that party's own analytics, product development, or AI-training purposes. These restrictions do not apply where the health information has first been de-identified in a manner that satisfies the requirements of applicable Health Privacy Laws such that it is no longer health information, or where the Clinic has provided express prior written authorization identifying the specific proposed use and confirming that it holds the legal authority required under applicable Health Privacy Laws to permit that use.

  1. Security Safeguards: Maintain reasonable administrative, technical, and physical safeguards designed to protect health information against unauthorized access, use, disclosure, alteration, loss, destruction, or disposal, having regard to the sensitivity of the information and the nature of the Platform. Safeguards include ISO 27001-certified information security management, AES-256 encryption for data at rest and in transit, multi-factor authentication, and regular security audits and penetration testing, as described in Section 7.4 of the Clinic TOS.
  2. Subprocessors and Third-Party Service Providers: Engage affiliates, subcontractors, subprocessors, and third-party service providers as reasonably necessary to provide the IMS. Ava will require each such party that may access health information to be bound by written confidentiality, privacy, and security obligations materially consistent with those applicable to Ava under this Addendum and the applicable provincial addendum. Ava remains accountable for the performance of its obligations where those obligations are performed on its behalf by such parties.
  3. Authorized Access Functionality: Maintain Platform functionality that enables the Clinic to establish and manage Authorized Users, roles, and access permissions. The Clinic remains responsible for determining and administering appropriate access for its personnel.
  4. System Integrations: Facilitate exchanges of health information through integrations supported by the Platform and authorized by the Clinic. Ava acts solely as an information manager in facilitating those exchanges and does not independently determine or verify the recipients, accuracy, legality, or clinical appropriateness of any transfer.
  5. Maintenance and Updates: Perform updates, maintenance, monitoring, patches, bug fixes, and other technical activities reasonably required to support the security and operation of the Platform. Planned maintenance and related subscriber notifications will be handled in accordance with the applicable SLA.
  6. Support Services: Provide technical support, incident response, and customer assistance during the support hours and through the support channels set out in the applicable SLA. Response and resolution targets are governed by the applicable SLA.
  7. Audit Information: Maintain and make available audit trail information concerning access to and activity involving health information to the extent supported by the Platform and required under the Clinic TOS or applicable Health Privacy Laws. Audit trail functionality cannot be disabled by the Clinic or its Authorized Users.
  8. Privacy and Security Incident Response: Investigate actual or suspected privacy or security incidents affecting health information; take reasonable steps to contain, mitigate, and remediate such incidents; notify the Clinic without undue delay and in any event within forty-eight (48) hours of becoming aware of an actual or suspected unauthorized access, use, disclosure, loss, alteration, or destruction of health information; and cooperate with the Clinic as required by the Clinic TOS, the applicable provincial addendum, and applicable Health Privacy Laws.
  9. Patient and Individual Rights Requests: Promptly refer to the Clinic any patient request or expressed wish received by Ava concerning access to, correction of, amendment to, or disclosure of health information under applicable Health Privacy Laws. Ava will provide reasonable technical assistance to the Clinic in responding where required by applicable law. Ava will not respond substantively to any such request without the Clinic's authorization, except as required by law.
  10. Data Export and Transition: Upon termination of the Agreement or the Clinic's written request, provide the Clinic with an export of its EMR data in accordance with the Clinic TOS and any applicable provincial addendum. Ava may charge reasonable fees, disclosed in advance, for complex or large-scale exports. The specific obligations applicable to data export on termination, including any triggering events, transfer standards, or format requirements imposed by applicable Health Privacy Laws or provincial regulatory requirements, are set out in the applicable provincial addendum.
  11. Return or Secure Disposition: Upon termination of the Agreement or the Clinic's written direction, return, securely destroy, or permanently delete health information in Ava's possession or control within one hundred and eighty (180) days, or within any shorter period required by applicable Health Privacy Laws, and confirm completion in writing where required.
  12. Compliance Verification: Upon the Clinic's reasonable written request, provide information reasonably necessary to demonstrate Ava's compliance with this Addendum and the applicable provincial addendum, which may include relevant policies, summaries of security controls, independent audit reports or certifications, and audit information supported by the Platform. Nothing in this clause requires Ava to disclose information that would compromise the security or confidentiality of another customer.
  13. Legal Demands: If Ava receives a subpoena, warrant, court order, or other legally binding demand requiring disclosure of health information, it will, unless prohibited by law, promptly notify the Clinic, disclose only the health information legally required, and reasonably cooperate with the Clinic if it seeks a protective order or other lawful remedy.
  14. Third-Party Services: Ava is not responsible for the availability, performance, accuracy, or support of third-party systems, integrations, content, or services that Ava does not directly operate, including internet connectivity and hardware at the Clinic's premises, as further described in the applicable SLA and the Clinic TOS.
3. Responsibilities of the Clinic

The Clinic, as the custodian or equivalent of the health information under applicable Health Privacy Laws, will:

  1. Determine the purposes for which health information is collected, used, and disclosed, and ensure those activities are authorized under applicable Health Privacy Laws.
  2. Ensure that health information entered into or transmitted through the Platform has been lawfully collected and is accurate, complete, and appropriate for the intended purpose.
  3. Establish and maintain appropriate access permissions for clinic personnel and Authorized Users, including promptly removing or changing access when it is no longer required.
  4. Ensure that Authorized Users comply with applicable privacy and security requirements, maintain the confidentiality of their credentials, and complete any required training.
  5. Provide Ava with timely and accurate instructions where Ava's assistance is required to access, correct, disclose, export, retain, return, or securely dispose of health information.
  6. Respond to patient access, correction, and expressed-wish requests and determine whether any disclosure of health information is permitted or required under applicable Health Privacy Laws.
  7. Make all clinical, professional, and medical-record decisions. Ava does not provide medical advice or exercise clinical judgment on behalf of the Clinic or its Authorized Users.
  8. Maintain reasonable safeguards for devices, networks, workspaces, credentials, and other systems under the Clinic's control.
  9. Notify Ava without undue delay and in any event within forty-eight (48) hours of becoming aware of any suspected unauthorized access, privacy breaches, compromised credentials, or security incidents involving the Platform or health information accessible through the Platform.
  10. Complete and maintain any privacy impact assessments, privacy policies, patient notices, consents, and other documentation required of the Clinic as a custodian or equivalent under applicable Health Privacy Laws.
4. Artificial Intelligence Features

Where the Clinic subscribes to an artificial-intelligence-enabled feature of the Platform, the following additional terms apply to Ava's handling of health information in connection with that feature:

  • Ava may process health information through an AI-enabled feature only for the purpose of providing the related IMS described in the applicable Order or product description.
  • Ava will not use identifiable health information to train or improve a general-purpose, foundational, or multi-customer artificial intelligence model, or for advertising, marketing, sale, independent research, or any other secondary purpose, unless expressly authorized in writing by the Clinic and permitted by applicable Health Privacy Laws.
  • Artificial-intelligence-generated or assisted output is intended to support, and not replace, the professional judgment of the Clinic's physicians and Authorized Users. The Clinic is responsible for reviewing, verifying, and approving all AI-generated outputs before relying on them for clinical documentation, patient communications, diagnosis, treatment, or other patient-care decisions.
  • Before implementing a material change to an AI-enabled feature, or a material change to the practices by which Ava collects, uses, discloses, stores, or otherwise processes health information including onboarding a new AI model or subprocessor, or introducing a materially different processing purpose Ava will: (a) assess the change through a documented change-control process that addresses privacy and security impact; (b) give the Clinic reasonable prior written notice describing the nature of the change, the categories of health information affected, and any new processing purpose, except where advance notice is not reasonably possible, in which case notice will be given as soon as reasonably practicable; and (c) obtain the Clinic's express written authorization in accordance with item 3A before implementing any change that involves a use of health information not already authorized under this Addendum, and give the Clinic a reasonable opportunity to decline or disable the changed feature where doing so does not prevent Ava from providing the core IMS. Nothing in this clause relieves the Clinic of its own responsibility as custodian to determine whether its use of any Ava feature, including any AI-enabled feature, is authorized under applicable Health Privacy Laws.
5. Data Residency

All health information processed by Ava in the course of providing the IMS, including data held in backup and disaster recovery systems, is stored on servers located in Canada. Ava will notify the Clinic promptly if any health information is stored outside Canada or transferred outside Canada for any reason, including as a result of a change in cloud infrastructure or subprocessor arrangements. Such notification will describe the nature of the data, the jurisdiction of storage or transfer, and the safeguards in place.

Where health information is stored, used, or accessed outside Canada, Ava will do so only as authorized by the applicable provincial addendum and in compliance with applicable Health Privacy Laws. The applicable service providers, jurisdictions, purposes, and safeguards will be described in the applicable service documentation or Addendum A update notice.

6. Retention and Destruction of Health Information

No health information in the custody and control of Ava will be copied, retained, destroyed, or disposed of without the express written consent of the Clinic, except as required by applicable law or as necessary to perform the IMS. Upon termination of the Agreement or written direction from the Clinic, Ava will return or securely destroy all health information in its possession or control in accordance with Section 2, item 14 of this Addendum.

7. Amendments to this Addendum

This Addendum A is amended only in accordance with Section 13.2 of the Clinic TOS. A change to the permitted collection, use, disclosure or retention of health information is a Material Change under Section 13.2(b) and takes effect only when the Clinic’s Authorized Representative accepts it. Where a change to this Addendum is required to comply with a change in applicable Health Privacy Laws, a direction from a regulatory authority, or a certification program applicable to the Platform, Section 13.2(d) of the Clinic TOS applies even where the change would otherwise be a Material Change, and Ava will implement the change and notify Clinics as soon as reasonably practicable. Section 4 of this Addendum applies in addition to Section 13.2 in respect of changes to AI enabled features and to Ava’s processing practices.

* * *

This Addendum A is incorporated into and forms part of the Ava Terms of Service for Clinics. It does not require separate execution by the Clinic. By accepting the Clinic TOS, the Clinic confirms its agreement to the terms of this Addendum A.

This Addendum A is also incorporated by reference into Addendum B (Alberta — HIA), Addendum C (British Columbia), and Addendum D (Ontario — PHIPA and OntarioMD Certification). In the event of any inconsistency between this Addendum A and a provincial addendum, the provincial addendum prevails to the extent of the inconsistency.