Skip to content
Privacy

Ava Terms of Service for Clinics

Addendum B — Alberta Health Information Act Compliance Addendum

Incorporated by: Ava Terms of Service for Clinics, Section 13.6

Applies to: Clinic subscribers located in the Province of Alberta

Statutory Basis: Health Information Act, RSA 2000, c. H-5 ("HIA"), section 66

Regulator: Office of the Information and Privacy Commissioner of Alberta (OIPC)

Professional College: College of Physicians and Surgeons of Alberta (CPSA)

Version: 1.0 — October 6, 2026

Scope
This Addendum B applies to Clinic subscribers located in the Province of Alberta. It supplements the Clinic TOS and Addendum A and, together with those documents, constitutes the written agreement required under section 66 of the Health Information Act (Alberta). Capitalized terms not defined in this Addendum have the meanings given to them in the Clinic TOS

1. Definitions

The following terms have the meanings set out below for the purposes of this Addendum:

  1. Custodian: has the meaning given to "custodian" in the HIA, and in this Addendum refers to the Clinic, each physician within the Clinic, any Nurse Practitioner within the Clinic, and any other individual or organization recognized as a custodian under the HIA who is a party to this Information Management Agreement
  2. Health Information: has the meaning given to that term in the HIA, and includes diagnostic, treatment, and care information, registration information, and health service provider information as defined in the HIA.
  3. HIA: means the Health Information Act, RSA 2000, c. H-5, as amended from time to time, and the regulations made under it.
  4. Information Management Agreement: means the written agreement between Ava and the Clinic constituted by this Addendum, the Clinic TOS, and Addendum A read together, which collectively satisfy the requirements of HIA section 66.
  5. Information Manager: has the meaning given to that term in the HIA, and in this Addendum refers to Ava Industries Ltd. in its capacity as information manager for the Clinic.
  6. Nurse Practitioner: means a registered nurse who holds additional registration entitling them to practice as a nurse practitioner under the Health Professions Act (Alberta) or equivalent legislation, and who is recognized as a custodian under the HIA.

For greater certainty, this Addendum does not itself make any person a custodian under the HIA, and does not alter the scope of custodianship that applies to any physician, Nurse Practitioner, or other Custodian by operation of the HIA.

2. HIA Section 66 Compliance

This Addendum, together with the Clinic TOS, Addendum A, and the applicable Order, constitutes the written agreement required under section 66 of the HIA before Ava, as Information Manager, may collect, use, or disclose Health Information on behalf of the Clinic as Custodian.

By accepting the Clinic TOS, each Clinic in Alberta:

  • acknowledges its status as a Custodian under the HIA;
  • appoints Ava Industries Ltd. as its Information Manager for the Health Information under its custody or control that is accessed, stored, or processed through the Platform;
  • confirms that this Information Management Agreement, consisting of this Addendum, the Clinic TOS, Addendum A, and the applicable Order, satisfies the written agreement requirements of HIA section 66; and
  • confirms that the guiding principles of this Information Management Agreement are in compliance with section 66 of the HIA.
3. Authorized Representatives

The Clinic’s Authorized Representative is the Authorized User who signs or otherwise electronically accepts the Clinic TOS on behalf of the Clinic, as provided in Section 7.6 of the Clinic TOS. The Authorized Representative is authorized to execute this Information Management Agreement and all notices on behalf of the Clinic and all Custodians within the Clinic.

Where there are two or more Custodians within a Clinic, the Authorized Representative warrants that all Custodians have consented to: (a) the appointment of Ava as Information Manager on the terms set out in this Information Management Agreement; and (b) the Authorized Representative acting on their behalf for the purposes of this Information Management Agreement.

Each Custodian remains individually responsible for fulfilling their obligations as a custodian under the HIA. The appointment of an Authorized Representative does not transfer or diminish the statutory responsibilities of any Custodian. The Clinic must notify Ava promptly of any change to the Authorized Representative by written notice to Ava, effective when Ava records the change. No new Order or Agreement is required.

Authorized Representative

The Clinic’s Authorized Representative is the Authorized User who signs or otherwise electronically accepts the Clinic TOS, as provided in Section 7.6 of the Clinic TOS. The Clinic may change its Authorized Representative by written notice to Ava at any time, without a new Order.

4. Continuing Consent

Each Custodian consents to the release of Health Information to Ava as Information Manager in accordance with, and for the purposes set out in, this Information Management Agreement and Addendum A.

5. Permitted Collection, Use, and Disclosure

In addition to the permitted purposes set out in Addendum A, items 2 and 3, Ava will limit its collection, use, and disclosure of Health Information to the minimum amount reasonably necessary for the authorized purpose, in accordance with the minimum necessary principle under the HIA. Ava will process, store, retrieve, and dispose of Health Information strictly in accordance with the HIA and any other applicable legislation in force in the Province of Alberta.

5.1. Secondary Use, Analytics, and AI Training Restrictions

In addition to the restrictions in Addendum A, Section 2, item 3A, the following Alberta-specific requirements apply to Ava’s handling of Health Information. Notwithstanding any other provision of this Information Management Agreement, Ava will not, directly or indirectly, use, disclose, or otherwise process Health Information for any secondary purpose including analytics, benchmarking, product development, AI model training, or commercial data activities except: (a) where the Health Information has first been de-identified in accordance with the HIA and its regulations such that it is no longer health information for the purposes of the HIA; or (b) where the Custodian(s) have provided express prior written authorization that identifies the specific proposed use and confirms that they, as custodian(s) under the HIA, hold the legal authority required under the HIA including any applicable research or ethics approval to permit that use. The Custodian(s)’ acceptance of the Clinic TOS or this Information Management Agreement does not, by itself, constitute legal authority under the HIA for any secondary use of Health Information.

6. Protection and Security of Health Information

In addition to the safeguards described in Addendum A section 2, item 4, Ava will:

  • maintain reasonable administrative, technical, and physical safeguards to protect Health Information against unauthorized access, use, disclosure, alteration, loss, destruction, or disposal, having regard to the sensitivity, amount, format, and location of the Health Information and the reasonably foreseeable risks to it;
  • ensure that its employees, agents, and subcontractors comply with the safeguards applicable to their roles and are bound by confidentiality obligations materially consistent with those set out in this Information Management Agreement;
  • not modify or alter Health Information except as reasonably necessary to provide the Information Management Services, on the lawful instructions of the Custodian, or as required by applicable law; and
  • where Health Information is stored, used, or accessed outside Alberta, do so only as authorized by this Information Management Agreement and in compliance with the HIA and its regulations, and consistent with the Canadian data residency requirements set out in Addendum A, Section 5.
7. Breach Notification

Ava will notify the Clinic without undue delay, and in any event within forty-eight (48) hours of becoming aware of, any actual or reasonably suspected unauthorized access, use, disclosure, loss, alteration, or destruction of Health Information under Ava's control. The notice will include the information then available regarding the nature and scope of the incident. Ava will take reasonable steps to contain, investigate, and mitigate the incident and will provide cooperation reasonably required by the Clinic to assess and satisfy the Clinic's legal reporting and notification obligations under the HIA.

The Clinic will notify Ava without undue delay, and in any event within forty-eight (48) hours of becoming aware of, any suspected unauthorized access, privacy breach, compromised credentials, or security incident involving the Platform or Health Information accessible through the Platform.

8. Patient Requests for Health Information

Any patient request or expressed wish received by Ava concerning access to, correction of, amendment to, or disclosure of Health Information under the HIA will be referred to the Clinic as soon as reasonably practicable. Ava will not respond substantively to any such request without the Clinic's authorization, except as required by law, and will provide reasonable technical assistance to enable the Clinic to respond.

The Clinic, as Custodian, must make every reasonable effort to respond to a request under HIA section 8(1) within thirty (30) days of receiving it. Ava will promptly notify the Clinic upon receiving any such request to ensure the Clinic can meet this statutory obligation. Any expressed wish communicated by a patient regarding disclosure of their Health Information under HIA section 22 will be forwarded in writing to the Clinic as soon as practicable.

9. CPSA Medical Records Requirements

Ava covenants that the Platform, as used by Alberta Clinics, complies with the medical records requirements of the College of Physicians and Surgeons of Alberta (CPSA) and applicable health profession legislation in Alberta. If CPSA requirements change in a manner that affects the Platform, Ava will use commercially reasonable efforts to update the Platform within a reasonable time of becoming aware of the change and will notify affected Clinics accordingly.

10. Governing Law

This Addendum is governed by and interpreted in accordance with the laws of the Province of Alberta and the federal laws of Canada applicable in Alberta. Each party irrevocably attorns to the exclusive jurisdiction of the courts of the Province of Alberta for the resolution of any dispute arising under or in connection with this Addendum. For greater certainty, the HIA and all regulations made under it apply to the collection, use, and disclosure of Health Information under this Information Management Agreement.

11. Conflict

In the event of any inconsistency between this Addendum B and the Clinic TOS or Addendum A, this Addendum prevails to the extent of the inconsistency for Alberta Clinics. In the event of any inconsistency between this Addendum B and the HIA or any other mandatory applicable law, the applicable law prevails.

* * *

This Addendum is incorporated into and forms part of the Ava Terms of Service for Clinics pursuant to Section 13.6 of that agreement. It does not require separate execution. By accepting the Clinic TOS, Alberta Clinics confirm their agreement to the terms of this Addendum Bnd the Information Management Agreement constituted by this Addendum, the Clinic TOS, and Addendum A read together.