Privacy Policy

1. About This Policy

This Privacy Policy describes how Northern Health Innovations Inc. ("NORHI", "we", "us") collects, uses, discloses, and protects personal information in connection with the NUAMP cloud productivity and AI service, including email, calendar, task management, AI-assisted retrieval, voice-to-text, and inference features (collectively, the "Service"). This policy is designed to comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.

This Privacy Policy supplements NORHI's General Privacy Policy available at https://norhi.ca/privacy/, which is incorporated by reference. The General Privacy Policy governs NORHI's corporate websites and business communications. Where this Privacy Policy addresses matters specific to the NUAMP service, including the handling of your content, retention periods, and security measures, this Privacy Policy takes precedence over the General Privacy Policy.

NORHI is a Canadian corporation. Our principal office is located at 5600-100 King Street West, Toronto, Ontario M5X 1A9.

2. Definitions

"User" means the individual or organization that subscribes to and uses the Service.

"Personal Information" has the meaning set out in PIPEDA and includes any information about an identifiable individual.

"Customer Content" means the content you create, upload, send, receive, or store through the Service, including email, calendar entries, tasks, documents, and other data.

3. Information We Collect

3.1 Account Information

When you subscribe to the Service, we collect:

• Email address (used as your account identifier)
• Name and, where applicable, organization name
• Payment information (processed by Helcim; NORHI does not store credit card numbers)

3.2 Customer Content

The Service is a system of record: the content you create and store in it is retained so that it remains available to you. This includes:

Data Type	Description	Retention
Email, calendar, tasks, documents	Content you create, send, receive, or store through the Service	Retained while your account is active
Voice-to-text audio	Audio you submit for transcription, processed to generate text — by design, not retained after transcription	Not retained; processed to produce text only
AI retrieval and inference inputs/outputs	Queries you make and results generated by NUAMP's locally deployed AI over your content	Retained with the related Customer Content

3.3 Technical Data

We automatically collect:

• IP address (for security, audit logging, and session management)
• Login timestamps and session duration
• Browser type and operating system (from HTTP headers)

We do not use cookies for tracking or advertising. Session cookies are used solely for authentication and are deleted when you log out or after a period of inactivity.

4. How We Use Your Information

Purpose	Data Used	Legal Basis (PIPEDA)
Provide the Service	Customer Content, voice-to-text audio (transient), AI inputs/outputs	Consent (subscription agreement)
Account management	Email, name, login data	Contractual necessity
Payment processing	Payment information (via Helcim)	Contractual necessity
Security and fraud prevention	IP address, login attempts, audit logs	Legitimate interest
Service improvement	Aggregate, de-identified usage statistics only	Legitimate interest

We do not:

• Use your Customer Content to train or fine-tune AI models or otherwise modify model weights.
• Transmit your content to any third-party AI service or model provider; AI features run on locally deployed models on NORHI-controlled infrastructure.
• Share, sell, or disclose your personal information to third parties for marketing purposes.
• Use automated decision-making that produces legal or similarly significant effects on individuals.
• Transfer your data outside of Canada, other than as required by law.

5. Data Storage and Security

5.1 Infrastructure

Your personal information and Customer Content are stored and processed on infrastructure that is:

• Physically located in Canada
• Under the exclusive control of NORHI (no public cloud providers)
• Protected by network-level segmentation between application, database, and storage components
• Connected via encrypted WireGuard mesh networking

5.2 Security Measures

• TLS encryption for all data in transit
• Encrypted database connections
• Two-factor authentication available for user accounts
• Account lockout after repeated failed login attempts
• Session timeout after a period of inactivity
• Audit trail of account and data access events
• Logical data isolation between accounts

5.3 Voice-to-Text Processing

Audio you submit for voice-to-text is processed to generate a text transcription using locally deployed models on NORHI-controlled infrastructure. The audio is processed for the duration required to produce the transcription and, by design, is not retained afterward. The resulting text becomes part of your Customer Content and is retained as described in Section 6.

6. Data Retention

Because NUAMP is a system of record, your Customer Content is retained for as long as your account is active so that it remains available to you. You may delete your content at any time through the Service.

After your subscription ends or your account is closed, your Customer Content is retained for ninety (90) days to allow you to export or transfer it, after which it is permanently deleted. You are responsible for exporting any content you wish to keep within this period.

Account data (email, name, login history, audit logs) is retained for the duration of the subscription and for ninety (90) days after account deactivation, after which it is permanently deleted.

Voice-to-text audio is not retained; it exists only transiently during transcription and is never persisted to storage.

Payment records are retained by Helcim in accordance with their privacy policy and applicable tax law requirements.

7. Disclosure of Information

NORHI does not disclose your personal information except in the following limited circumstances:

1. Legal requirement: Where disclosure is required by law, regulation, or court order.
2. Payment processing: Your payment information is shared with Helcim solely for the purpose of processing subscription payments. Helcim is a Canadian payment processor subject to PCI DSS requirements.
3. With your consent: Where you have provided explicit, informed consent to a specific disclosure.

NORHI does not have sub-processors for your Customer Content. All processing of your content is performed by NORHI's own infrastructure and employees.

8. Clinical Data, NORHI Scribe, and Health Information in NUAMP

Where your subscription includes NORHI Scribe, the handling of clinical audio, transcriptions, clinical notes, and other personal health information processed through Scribe is governed by the NORHI Scribe Privacy Policy and the NORHI Scribe Healthcare Data Processing Agreement, which take precedence over this Policy for that data.

NUAMP is a general productivity service and is not a designated clinical record or electronic health record. Where you use NUAMP for clinical purposes, however, personal health information may be present in your Customer Content — for example, a patient's name in a calendar entry, a task, or an email. NORHI's processing of that health information is governed by the NUAMP Healthcare Data Processing Agreement, which applies to clinical-use NUAMP subscriptions and sets out NORHI's obligations as your agent or information manager under applicable health privacy legislation. You remain responsible for maintaining your own clinical system of record.

9. Your Rights

Under PIPEDA, you have the right to:

1. Access: Request a copy of the personal information we hold about you.
2. Correction: Request correction of inaccurate personal information.
3. Withdrawal of consent: Withdraw your consent to the collection, use, or disclosure of your personal information, subject to legal or contractual restrictions. Withdrawal of consent may result in the inability to provide the Service.
4. Complaint: File a complaint with the Office of the Privacy Commissioner of Canada if you believe your privacy rights have been violated.

To exercise any of these rights, contact us at privacy@norhi.ca.

10. Children

The Service is intended for business and professional use by individuals 18 years of age or older. We do not knowingly collect personal information from individuals under the age of 18.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by sending notice to your registered email address at least thirty (30) days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the revised policy.

12. Privacy Officer

For questions, concerns, or requests regarding this Privacy Policy or NORHI's privacy practices, contact our Privacy Officer:

Northern Health Innovations Inc.
Attention: Privacy Officer
5600-100 King Street West
Toronto, Ontario M5X 1A9
Canada

Email: privacy@norhi.ca
Phone: (647) 601-5499
Toll-free: (844) 283-3615