Skip to content
Privacy

Ava Terms of Service for Clinics

Addendum C - British Columbia Privacy and Health Information Compliance Addendum

Incorporated by: Ava Terms of Service for Clinics, Section 13.6

Applies to: Clinic subscribers located in the Province of British Columbia

Statutory Basis: Personal Information Protection Act, SBC 2003, c. 63 ("PIPA BC")

Health System Integration: E-Health (Personal Health Information Access and Protection of Privacy) Act, SBC 2008, c. 38 ("E-Health Act") — applicable upon PharmaNet connectivity

Regulator: Office of the Information and Privacy Commissioner of British Columbia (OIPC BC)

Professional College: College of Physicians and Surgeons of British Columbia (CPSBC)

PharmaNet Access Vendor: Medinet (confirmed) — Ministry of Health approved PharmaNet access vendor

Version: 1.0 — October 6, 2026

Scope
This Addendum applies to Clinic subscribers located in the Province of British Columbia. It supplements the Clinic TOS and Addendum A and, together with those documents and the applicable Order, constitutes the written framework governing Ava's handling of personal and health information for BC Clinics. Capitalized terms not defined in this Addendum have the meanings given to them in the Clinic TOS or Addendum A.
Pharmanet Note
Ava is planning to connect to BC's PharmaNet system through Medinet, a Ministry of Health-approved PharmaNet access vendor. PharmaNet connectivity is not yet live as at the date of this Addendum. Section 5 sets out the obligations that will apply when PharmaNet connectivity is established. Those obligations activate automatically on connection without requiring amendment to this Addendum.
1. Definitions

The following terms have the meanings set out below for the purposes of this Addendum:

  1. Custodian: means, individually and collectively, the physicians and any Nurse Practitioners or other individuals or organizations within the Clinic who are recognized as custodians of personal health information under applicable British Columbia legislation and who are a party to this Addendum, together with their respective Affiliates where the context requires. For greater certainty, this Addendum does not itself make any person a custodian, and does not alter the scope of custodianship that applies by operation of applicable British Columbia legislation.
  2. E-Health Act: means the E-Health (Personal Health Information Access and Protection of Privacy) Act, SBC 2008, c. 38, as amended from time to time, and the regulations made under it.
  3. Medinet: means Medinet Inc., a Ministry of Health-approved PharmaNet access vendor operating in the Province of British Columbia, through which Ava will connect to PharmaNet.
  4. Nurse Practitioner: means a registered nurse who holds registration as a nurse practitioner under the Health Professions Act (RSBC 1996, c. 183) and the Nurses (Registered) and Nurse Practitioners Regulation, and who is recognized as a custodian of personal health information under applicable British Columbia legislation.
  5. Personal Information: has the meaning given to that term in PIPA BC, and includes information about an identifiable individual, including health and personal health information.
  6. PharmaNet: means the provincial computer network owned and operated by the BC Ministry of Health that records prescriptions dispensed in BC community pharmacies and provides authorized practitioners with access to patient medication history.
  7. PIPA BC: means the Personal Information Protection Act, SBC 2003, c. 63, as amended from time to time, and the regulations made under it.
  8. PRIME: means the BC Ministry of Health's Provider Relations and Identity Management Enrolment system, through which practitioners and clinic sites must enrol before accessing PharmaNet.
2. Applicable Law and Ava's Role

PIPA BC governs the collection, use, and disclosure of Personal Information about identifiable individuals by private sector organizations in British Columbia. Ava collects, uses, and discloses Personal Information about BC Clinic subscribers and their patients in the course of providing the Platform and is subject to PIPA BC in that capacity.

In addition to PIPA BC, the E-Health Act will govern Ava's handling of personal health information accessed through PharmaNet once PharmaNet connectivity is established. Ava's obligations under the E-Health Act are set out in Section 5 of this Addendum.

In addition to the obligations set out in Clinic TOS Section 7.6 and Addendum A, the following BC-specific obligations apply to Ava's handling of Personal Information for BC subscribers:

  • Ava will collect, use, and disclose Personal Information about BC Clinics and their patients only for the purposes identified in Addendum A and this Addendum, or for other purposes to which the Clinic has consented or that are authorized by PIPA BC.
  • Ava will make reasonable efforts to ensure that Personal Information used or disclosed is accurate and complete as required for the purposes for which it is used or disclosed.
  • Ava will protect Personal Information by security safeguards appropriate to the sensitivity of the information, as further described in Addendum A Section 2 item 4.
3. Authorized Representatives

The Clinic’s Authorized Representative is the Authorized User who signs or otherwise electronically accepts the Clinic TOS on behalf of the Clinic, as provided in Section 7.6 of the Clinic TOS. The Authorized Representative is authorized to administer this Addendum on behalf of the Clinic and all physicians within the Clinic. The Clinic must notify Ava promptly of any change to the Authorized Representative by written notice to Ava, effective when Ava records the change. No new Order or Agreement is required.

Where there are two or more physicians within a Clinic, the Authorized Representative warrants that all physicians have consented to the appointment of Ava to provide the Information Management Services described in Addendum A on the terms set out in this Addendum and the Clinic TOS.

4. Breach Notification

In addition to the breach notification obligations in Addendum A Section 2 item 11 and Clinic TOS Section 7.6(d)(vi), the following BC-specific obligations apply:

  • Ava will notify affected BC Clinics without undue delay and in any event within forty-eight (48) hours of becoming aware of any actual or suspected unauthorized access, use, disclosure, loss, alteration, or destruction of Personal Information under Ava's control. The notice will describe the nature and scope of the incident and the steps Ava is taking to contain and remediate it.
  • Where a breach creates a real risk of significant harm to an individual, Ava will cooperate with the Clinic in preparing and delivering the notification to affected individuals required under PIPA BC. Ava will also cooperate with the Clinic in assessing whether notification to the OIPC BC is required.
  • The BC Clinics will notify Ava without undue delay and in any event within forty-eight (48) hours of becoming aware of any suspected unauthorized access, privacy breach, compromised credentials, or security incident involving the Platform or Personal Information accessible through it.

For greater certainty, PIPA BC does not prescribe a mandatory notification timeframe to the OIPC BC for all breaches. Notification to the Commissioner is required where the breach creates a real risk of significant harm to an individual. Ava and the Clinic will assess this threshold jointly on a case-by-case basis.

4A. Secondary Use, Analytics, and AI Training Restrictions

In addition to the restrictions in Addendum A, Section 2, item 3A, the following British Columbia-specific requirements apply to Ava's handling of Personal Information. Notwithstanding any other provision of this Addendum, Ava will not, directly or indirectly, use, disclose, or otherwise process Personal Information for any secondary purpose — including analytics, benchmarking, product development, AI model training, or commercial data activities — except: (a) where the Personal Information has first been de-identified such that it no longer identifies an individual and is no longer Personal Information under PIPA BC; or (b) where the Clinic and applicable Custodian(s) have provided express prior written authorization that identifies the specific proposed use and confirms that they hold the legal authority required under PIPA BC and any other applicable British Columbia legislation to permit that use. The Clinic's acceptance of the Clinic TOS or this Addendum does not, by itself, constitute authority for any secondary use of Personal Information.

5. PharmaNet Connectivity

ACTIVATION

This Section 5 activates automatically when Ava establishes PharmaNet connectivity through Medinet for any BC Clinic. No amendment to this Addendum is required. Ava will notify affected BC Clinics before PharmaNet connectivity is established at their site.

5.1 E-Health Act Application

Upon establishment of PharmaNet connectivity, the E-Health Act will govern Ava's access to and handling of personal health information obtained through PharmaNet. Ava will comply with all applicable requirements of the E-Health Act and the PharmaNet terms of service governing its use of Medinet's PharmaNet access services.

5.2 Medinet Intermediary Obligations

Ava will ensure that its agreement with Medinet requires Medinet to maintain privacy and security obligations in respect of PharmaNet data that are materially consistent with Ava's obligations under this Addendum and Addendum A. Ava will provide the Clinic with reasonable information about Medinet's data handling practices upon request.

5.3 BC Ministry of Health Requirements

The following requirements apply to Ava's PharmaNet integration and are imposed by the BC Ministry of Health:

  • All PharmaNet transactions must be processed within the Province of British Columbia. PharmaNet queries initiated by BC Clinics will not be routed through Ava's infrastructure located outside BC at any point in the transaction chain. Ava will confirm this architecture with Medinet before activating PharmaNet connectivity at any BC Clinic site.
  • Each BC Clinic and each individual user accessing PharmaNet through the Platform must be separately enrolled in PRIME and approved by the Ministry of Health before PharmaNet access is activated at that site. Ava will not activate PharmaNet connectivity at any BC Clinic until written confirmation of both site registration and individual user enrolment approvals has been received.
  • All Personal Information obtained from PharmaNet must remain in the Province of British Columbia, in accordance with the Ministry of Health's PharmaNet access requirements.
  • Access to PharmaNet is permitted only for the purpose of providing health services to an individual patient as part of a professional health practice. Ava will not use PharmaNet data for any secondary purpose including research, monitoring, quality improvement, or commercial data products.

Ava will notify the Clinic promptly if PharmaNet access is suspended or terminated by the Ministry of Health or by Medinet for any reason affecting the Clinic's site.

5.4 Clinic PharmaNet Responsibilities

Each BC Clinic using Ava's PharmaNet integration is responsible for:

  • Completing and maintaining PRIME enrolment for the clinic site and all individual users who will access PharmaNet through the Platform;
  • Ensuring that all PharmaNet access through the Platform is for the purpose of providing health services to individual patients;
  • Notifying Ava promptly of any change to the clinic's PRIME enrolment status or to the individual users authorized to access PharmaNet at the clinic site; and
  • Complying with all Ministry of Health requirements applicable to the Clinic as a PharmaNet access site.
6. Individual Access to Personal Information

Under PIPA BC section 23, individuals have the right to request access to their Personal Information held by an organization. Any such request received by Ava in respect of a BC Clinic's patient or subscriber data will be referred to the Clinic as soon as reasonably practicable. Ava will not respond substantively to any such request without the Clinic's authorization, except as required by law, and will provide reasonable technical assistance to enable the Clinic to respond within the timeframes required by PIPA BC.

7. CPSBC Medical Records Requirements

Ava covenants that the Platform, as used by BC Clinics, complies with the medical records requirements of the College of Physicians and Surgeons of British Columbia (CPSBC) and applicable health profession legislation in British Columbia, including the Health Professions Act (RSBC 1996, c. 183) and the applicable college bylaws. If CPSBC requirements change in a manner that affects the Platform, Ava will use commercially reasonable efforts to update the Platform within a reasonable time and will notify affected BC Clinics accordingly.

8. Governing Law and Disputes

8.1 Governing Law

This Addendum is governed by and interpreted in accordance with the laws of the Province of British Columbia and the federal laws of Canada applicable in British Columbia. Each party irrevocably attorns to the exclusive jurisdiction of the courts of the Province of British Columbia for the resolution of any dispute arising under or in connection with this Addendum. For greater certainty, PIPA BC and, upon activation of PharmaNet connectivity, the E-Health Act and applicable Ministry of Health requirements apply to the handling of Personal Information under this Addendum.

8.2 Low Value Claims

Section 13.18 (Dispute Resolution) of the Clinic TOS does not apply to any claim for which a requirement to arbitrate, or a restriction on starting or joining a class proceeding, is inoperative under the Business Practices and Consumer Protection Act (British Columbia). Either party may bring that claim before the Civil Resolution Tribunal or a court of competent jurisdiction in British Columbia.

9. Conflict

In the event of any inconsistency between this Addendum and the Clinic TOS or Addendum A, this Addendum prevails to the extent of the inconsistency for BC Clinics. In the event of any inconsistency between this Addendum and PIPA BC, the E-Health Act, the Ministry of Health's PharmaNet terms of service, or any other mandatory applicable law or regulatory requirement, the applicable law or requirement prevails.

* * *

This Addendum is incorporated into and forms part of the Ava Terms of Service for Clinics pursuant to Section 13.6 of that agreement. It does not require separate execution. By accepting the Clinic TOS, BC Clinics confirm their agreement to the terms of this Addendum. The PharmaNet integration architecture with Medinet must be confirmed by Engineering and reviewed by Legal Counsel before PharmaNet connectivity is activated at any BC Clinic site.