Skip to content
Privacy

Ava Terms of Service for Clinics

Addendum D — Ontario PHIPA and OntarioMD Certification Addendum

Incorporated by: Ava Industries Ltd. Clinic Terms of Service for Clinics, Section 13.6

Applies to: Clinic subscribers located in the Province of Ontario

Statutory Basis: Personal Health Information Protection Act, SO 2004, c. 3, Sch. A ("PHIPA"), section 17

Regulatory Body: OntarioMD Inc. ("OMD") — EMR Vendor Certification Program

Professional College: College of Physicians and Surgeons of Ontario (CPSO)

Privacy Commissioner: Information and Privacy Commissioner of Ontario (IPC)

Version: 1.0 — October 6, 2026

Scope
This Addendum applies to Clinic subscribers located in the Province of Ontario. It supplements the Clinic TOS and Addendum A and, together with those documents and the applicable Order, constitutes the written agreement required under PHIPA section 17. It also addresses Ava's obligations as a certified EMR vendor under the OntarioMD EMR Vendor Certification Agreement. Capitalized terms not defined in this Addendum have the meanings given to them in the Clinic TOS or Addendum A
OMD
Provisions marked [OMD] are required by the OntarioMD EMR Vendor Certification Agreement, Schedule D - Subscriber Agreement Principles. These are Mandatory Principles whose absence is a ground for certificate withdrawal. They cannot be waived or modified for Ontario subscribers.
1. Definitions

The following terms have the meanings set out below for the purposes of this Addendum:

  1. Agent: has the meaning given to that term in PHIPA, and in this Addendum refers to Ava Industries Ltd. in its capacity as agent of the Health Information Custodian in respect of Personal Health Information.
  2. Certified EMR Offering: means the Ava EMR Platform as certified by OntarioMD under the OntarioMD EMR Vendor Certification Agreement and who is a party to this Addendum.
  3. Health Information Custodian or HIC: has the meaning given to "health information custodian" in PHIPA, and in this Addendum refers to the Clinic and each physician within the Clinic, any Nurse Practitioner within the Clinic, and any other individual or organization who holds that status under PHIPA.
  4. Nurse Practitioner: means a registered nurse who holds an extended certificate of registration authorizing practice as a nurse practitioner under the Nursing Act, 1991 (Ontario) and its regulations, and who is recognized as a health information custodian under PHIPA.
  5. OntarioMD or OMD: means OntarioMD Inc., a subsidiary of the Ontario Medical Association, responsible for managing the provincial EMR Certification Program.
  6. Participating Jurisdiction: means Ontario and any other jurisdiction that adopts the OntarioMD Certification Program, as set out in Schedule G of the OntarioMD EMR Vendor Certification Agreement.
  7. Personal Health Information or PHI: has the meaning given to "personal health information" in PHIPA, and includes identifying information about an individual that relates to their physical or mental health, health care history, or health care providers.
  8. PHIPA: means the Personal Health Information Protection Act, SO 2004, c. 3, Sch. A, as amended from time to time, and the regulations made under it.

For greater certainty, this Addendum does not itself make any person a health information custodian under PHIPA, and does not alter the scope of custodianship that applies to any physician, Nurse Practitioner, or other custodian by operation of PHIPA.

2. PHIPA Compliance and Ava's Role

This Addendum, together with the Clinic TOS, Addendum A, and the applicable Order, constitutes the written agreement required under PHIPA section 17 before Ava, as Agent, may collect, use, or disclose Personal Health Information on behalf of the Clinic as Health Information Custodian.

By accepting the Clinic TOS, each Clinic in Ontario:

  • acknowledges its status as a Health Information Custodian under PHIPA;
  • appoints Ava Industries Ltd. as its Agent for all Personal Health Information under its custody or control that is accessed, stored, or processed through the Platform;
  • confirms that PHIPA governs the collection, use, and disclosure of Personal Health Information through the Platform;
  • confirms that this Addendum, together with the Clinic TOS and Addendum A, satisfies the written agreement requirements of PHIPA section 17; and
  • confirms that Ava acts solely as Agent of the Health Information Custodian and has no independent right to collect, use, or disclose Personal Health Information except as permitted by this Addendum and PHIPA.
3. Authorized Representatives

The Clinic's Authorized Representative is the Authorized User who signs or otherwise electronically accepts the Clinic TOS on behalf of the Clinic, as provided in Section 7.6 of the Clinic TOS. The Authorized Representative is authorized to execute this Addendum on behalf of the Clinic and all Health Information Custodians within the Clinic.

Where there are two or more Health Information Custodians within a Clinic, the Authorized Representative warrants that all Health Information Custodians have consented to: (a) the appointment of Ava as Agent on the terms set out in this Addendum; and (b) the Authorized Representative acting on their behalf for the purposes of this Addendum.

Each Health Information Custodian remains individually responsible for fulfilling their obligations as a custodian under PHIPA. The appointment of an Authorized Representative does not transfer or diminish the statutory responsibilities of any Health Information Custodian. The Clinic must notify Ava promptly of any change to the Authorized Representative by written notice to Ava, effective when Ava records the change. No new Order or Agreement is required.

4. Continuing Consent

Each Health Information Custodian consents to the collection, use, and disclosure of Personal Health Information by Ava as Agent in accordance with, and solely for the purposes set out in, this Addendum and Addendum A.

5. Data Ownership, Use, and Restrictions

OMD

OMD Schedule D, Mandatory Principles 3.0(6), 3.0(7), and 13(b). Certificate withdrawal ground if absent.

In addition to the restrictions in Addendum A, Section 2, item 3A (Secondary Use, Analytics, and AI Training Restrictions) and the change-control obligations in Addendum A, Section 4, the following restrictions apply to Ontario subscribers:

  • As between Ava and the Clinic, all Personal Health Information and all data derived from Personal Health Information including anonymized, de-identified, and aggregated forms belongs to and remains under the control of the Health Information Custodian and, in the case of PHI, the patient.
  • Ava will not de-identify, anonymize, or create derivative data from Personal Health Information except for the sole purpose of providing the Certified EMR Offering to the Clinic, or for such other purposes as the Clinic specifically agrees to in writing.
  • Ava will not use or disclose Personal Health Information, or any data derived from Personal Health Information in any form including data that has been pseudonymized, anonymized, de-identified, or aggregated for any purpose other than giving the Clinic and its Authorized Users access to and use of the Certified EMR Offering and providing related services.
  • By accepting this Addendum, the Clinic specifically agrees in writing that Ava may de-identify, anonymize, or create derivative data from Personal Health Information, and may use such de-identified or derivative data, solely to support platform quality assurance, error diagnosis and debugging, and performance and load testing of the Certified EMR Offering and its underlying infrastructure (collectively, "Platform Testing Activities"). Platform Testing Activities are a function Ava performs for the Clinic in support of the reliable operation of the Certified EMR Offering, and constitute related services within the meaning of this Section 5. Ava will not use identifiable Personal Health Information for Platform Testing Activities where de-identified or synthetic data can reasonably be used instead.
  • For Ontario subscribers only, Section 7.2 of the Clinic TOS is modified to the extent necessary to give effect to this Section 5. Ava's rights to create and use Aggregate Data under Section 7.2 do not apply to data derived from Personal Health Information of Ontario subscribers.
  • Ava will not aggregate or combine Personal Health Information, or any data derived from Personal Health Information, with data from other customers, or otherwise use it across Ava's customer base, for analytics, product development, benchmarking, marketing, research, or any other secondary purpose.
  • Ava will not use Personal Health Information, or any data derived from Personal Health Information, to train, fine-tune, validate, or otherwise improve any general-purpose or multi-customer artificial intelligence or machine-learning model. This restriction applies regardless of whether the information has been de-identified, anonymized, or aggregated.
6. Privacy Obligations

OMD

OMD Schedule D, Mandatory Principles 3.0(8), 3.0(9), 3.0(10), and 1.0(m). Certificate withdrawal ground if absent.

In addition to the obligations set out in Clinic TOS Section 7.6 and Addendum A, Section 6, the following apply to Ontario subscribers:

  • Ava covenants to comply with PHIPA and all other applicable Ontario privacy legislation in respect of its handling of Personal Health Information as Agent of the Health Information Custodian.
  • Ava will promptly notify affected Clinics of any unauthorized access, use, transfer, disclosure, or destruction of Personal Health Information in accordance with PHIPA and applicable law. Notification will be provided without undue delay and in any event within forty-eight (48) hours of Ava becoming aware of the incident.
  • Ava will provide reasonable assistance to Clinics in responding to any inquiry by a patient or privacy or regulatory authority about the collection, use, disclosure, retention, or destruction of Personal Health Information through the Platform.
  • Ava's Privacy Officer can be contacted at: privacy@avaindustries.ca. Ava will maintain and publish current Privacy Officer contact information on its website and update this Addendum or its published Privacy Notice if that contact changes.
7. OntarioMD Certification Obligations

OMD

OMD Schedule D, Mandatory Principles 20, 25, and 26. Certificate withdrawal ground if absent.

7.1 Subscriber Termination Right on Decertification

If the Certified EMR Offering no longer has the required OntarioMD certificates and other evidences of conformance in good standing whether because OntarioMD has withdrawn them or because Ava has failed or refused to maintain them the Clinic has the right, but not the obligation, to terminate its agreement with Ava on written notice. This termination right is in addition to any other termination rights set out in the Clinic TOS.

7.2 CPSO Medical Records Requirements

Ava covenants that the Certified EMR Offering complies with the medical records requirements of the College of Physicians and Surgeons of Ontario (CPSO) and applicable health profession and privacy legislation in Ontario. If CPSO requirements change in a manner that affects the Platform, Ava will use commercially reasonable efforts to update the Platform within a reasonable time and will notify affected Ontario Clinics accordingly.

7.3 OntarioMD Subscriber List Reporting

By accepting this Addendum, each Ontario Clinic consents to Ava providing the Clinic's contact information to OntarioMD for the following purposes only: OntarioMD's customer relationship management, outreach, reporting, and policy analysis; urgent technical, security, or patient safety communications; and OntarioMD's contingency response activities. This consent is required to enable Ava to comply with its monthly reporting obligations to OntarioMD under the OntarioMD EMR Vendor Certification Agreement.

8. Data Portability on Termination

OMD

OMD Schedule D, Mandatory Principle 4. Certificate withdrawal ground if absent.

For Ontario subscribers, Section 10.1 of the Clinic TOS is supplemented as follows. Upon request, Ava will extract and securely transfer the Clinic's EMR data unencumbered by technological or other constraints, in accordance with the OMD EMR Data Migration Specification in effect at the time of the request. This obligation is triggered by:

  • termination of the Agreement by either party for any reason;
  • expiration of the Agreement where either party decides not to renew;
  • the Clinic's transition to a different EMR provider;
  • windup or retirement of the Certified EMR Offering under Articles 8 or 17 of the OntarioMD EMR Vendor Certification Agreement; or
  • loss of OntarioMD certification where the Clinic exercises its termination right under Section 7.1 of this Addendum.

The only condition Ava may place on performing this obligation is payment of any amounts not disputed in writing by the Clinic as of the date of the request, plus reasonable time and materials charges for complex or large-scale exports disclosed in advance.

9. Liability

OMD

OMD Schedule D, Mandatory Principle 18. Certificate withdrawal ground if absent.

For Ontario subscribers, Section 11.5 of the Clinic TOS is modified as follows:

  • The $50,000 ceiling on Ava's aggregate liability is removed. Ava's aggregate liability for general claims is at least equal to the fees paid by the Clinic in the twelve (12) months prior to the claim.
  • The liability cap does not apply to claims arising from Ava's infringement of a third party's intellectual property rights. Ava's liability for such claims is unlimited.
  • The liability cap does not apply to claims arising from Ava's gross negligence. Ava's liability for such claims is unlimited.
  • Subject to the foregoing, Ava's liability remains limited to actual direct damages. Indirect, consequential, special, punitive, and exemplary damages remain excluded.
10. Governing Law and Dispute Resolution

OMD

OMD Certification Agreement, Article 9.3, and Schedule D, Section 4.0 and Mandatory Principle 24. Certificate withdrawal ground if absent.

This Addendum and the Clinic TOS as applicable to Ontario subscribers are made in and construed and interpreted in accordance with the laws of the Province of Ontario and the federal laws of Canada applicable in Ontario. The courts of Ontario are the exclusive forum for any dispute arising under or in connection with the Clinic TOS or this Addendum, and each party irrevocably attorns to their exclusive jurisdiction.

For Ontario subscribers, Sections 13.17 and 13.18 of the Clinic TOS are replaced by the following:

(a) Talk first. Either party may give the other written notice of a dispute, and senior management of both parties will try in good faith to resolve it within fifteen (15) days of that notice.

(b) Arbitration only by agreement. A dispute goes to arbitration only if both parties agree in writing after the dispute arises. Any such arbitration will be held in Toronto, Ontario, under the Arbitration Act, 1991 (Ontario), before a single arbitrator chosen jointly by the parties or, failing agreement within fifteen (15) days, appointed by a judge of the Ontario Superior Court of Justice. Each party bears its own costs, and the arbitrator’s fees are shared equally unless the arbitrator decides otherwise. Nothing in this Section 10 limits the right of the Clinic or any Authorized User to seek redress in a court of competent jurisdiction.

(c) Disputes over the right to possess data. In any dispute over the right to possess information stored on or within the Platform, Ava will cooperate and work with the Clinic, its Authorized Users and OntarioMD to resolve it. These disputes will be resolved, and the Clinic TOS and this Addendum interpreted, according to the following principles: (i) the requirements of health privacy laws and other applicable laws, including the views and interests of patients and the fiduciary obligations of health care professionals to their patients, come above all other considerations; (ii) the integrity and the timely and secure transfer of Data; and (iii) the timely resolution of disputes.

11. OntarioMD Cross-Reference Confirmation

This Addendum is intended to satisfy Ava's obligations under Schedule D - Subscriber Agreement Principles of the OntarioMD EMR Vendor Certification Agreement, read together with the Clinic TOS, Addendum A, and the Ava Service Level Assurance. Ava will update this Addendum if OntarioMD amends its Subscriber Agreement Principles in a manner that requires amendment to these terms, and will notify Ontario Clinics accordingly in accordance with Section 13.2(d) of the Clinic TOS.

For Ontario Clinics, the subscriber agreement for the purposes of the OntarioMD EMR Vendor Certification Agreement consists of the following documents. Ava maintains the cross-reference template required under Schedule D, Section 6.0 of that agreement, which maps each Mandatory Principle to the relevant sections of these documents, and provides it to OntarioMD.:

  • Order and any SOW - the Services, Fees and pricing information, subscription term, and Authorized Representative;
  • Clinic TOS - general commercial terms, data rights, confidentiality, indemnification, term, renewal and termination, read-only access during suspension, and governing commercial obligations;
  • Addendum A - Information Management Services, description of Information Management Services and universal health privacy obligations, and the universal secondary use, analytics, and AI training restrictions in Section 2, item 3A;
  • Addendum D (this document), Ontario and OMD-specific statutory compliance, data use restrictions, liability, data portability, certification obligations, governing law and dispute resolution;
  • Ava Service Level Assurance - service availability, support hours, incident management, business continuity, audit trail, chronic failure termination right, and client notification service.
12. Conflict

In the event of any inconsistency between this Addendum and the Clinic TOS or Addendum A, this Addendum prevails to the extent of the inconsistency for Ontario Clinics. In the event of any inconsistency between this Addendum and PHIPA, the OntarioMD EMR Vendor Certification Agreement, or any other mandatory applicable law or regulatory requirement, the applicable law or requirement prevails.

* * *

This Addendum is incorporated into and forms part of the Ava Industries Ltd. Clinic Terms of Service for Clinics pursuant to Section 13.6 of that agreement. It does not require separate execution. By accepting the Clinic TOS, Ontario Clinics confirm their agreement to the terms of this Addendum.