Athel AI ("Athel," "we," "us") provides a pre-visit clinical interview and intake platform used by physicians and specialist clinics. This policy explains how we collect, use, and disclose personal information in the course of our business — including information from individuals who visit our website, interact with our marketing communications, or use our platform as authorized healthcare professionals.

Applicability

This policy applies to information Athel collects in our own capacity — through our website (athelai.com), our marketing channels, and our authenticated platform user accounts.

This policy does not apply to Customer Data. Customer Data is the personal information and personal health information that our customers (clinics, physician practices, and health authorities) and their authorized users upload, transmit, or collect through our services. Athel processes Customer Data — which includes patient PHI — strictly on behalf of our customers. Our processing of Customer Data is governed by our agreements with those customers, including our Business Associate Agreements (BAAs) for U.S. clients and our Service Provider / Agent agreements for Canadian clients.

If you are a patient whose healthcare provider uses Athel, you should refer to your provider's Notice of Privacy Practices (U.S.) or their PHIPA or PIPEDA privacy notice (Canada) for information on how they handle your information. We are a Business Associate or Agent to your provider and process your information solely on their instruction. To exercise rights over your health information, contact your provider directly. Section 12 of this policy addresses this in detail.

01Who We Are and Our Role Under Privacy Law

Athel AI is a Canadian healthcare technology company headquartered in Toronto, Ontario.

Under Ontario's Personal Health Information Protection Act (PHIPA), Athel acts as an agent of the Health Information Custodian (the clinic, physician practice, or health authority that uses Athel). The custodian remains accountable for the personal health information collected through Athel; we process it strictly on their instructions and on their behalf.

Under the Personal Information Protection and Electronic Documents Act (PIPEDA), Athel acts as a service provider to our healthcare clients for personal information processed in the course of commercial activity.

Under the U.S. Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health Act (HITECH), for U.S. clients, Athel acts as a Business Associate to the Covered Entity (the clinic or provider). We enter into a written Business Associate Agreement (BAA) with each U.S. client before any protected health information (PHI) is processed. We use and disclose PHI only as permitted by the BAA, the Privacy Rule (45 CFR Part 164, Subpart E), and applicable law. Our subcontractors who create, receive, maintain, or transmit PHI on our behalf are required to sign written agreements that flow down the same obligations, as required by 45 CFR § 164.502(e)(1)(ii).

Where state law provides patients with greater privacy protections than HIPAA — for example, in Florida, Texas, California, or other states with stricter health-information statutes — Athel complies with the more protective standard.

Privacy inquiries are directed to our Privacy Officer at privacy@athelai.com. Mailing address: Athel AI, Attn: Privacy Officer, 88 Queens Quay W, Suite 2500, Toronto, ON M5J 0B6, Canada.

02Information We Collect

We collect four categories of information.

A. Clinic and User Account Information

When a clinic onboards with Athel and when authorized users (physicians, administrators, receptionists) access the dashboard, we collect:

• Names, professional email addresses, job titles, and clinic affiliations
• Authentication credentials (passwords are hashed and not visible to Athel staff)
• Billing contact and payment details (payment cards are tokenized by our PCI-compliant payment processor; we do not store full card numbers)
• Role assignments used to enforce role-based access

B. Patient Personal Health Information

Patient information is collected on behalf of the clinic, as part of the pre-visit interview the clinic has booked. Depending on the clinic's configuration, this may include:

• Identifiers: name, date of birth, phone number, and, where the clinic requires it, the provincial health identifier (handled in accordance with applicable provincial law, including Ontario's Health Cards and Numbers Control Act)
• A photo of the front of the health card, where the clinic requires this for verification
• Clinical content: the chief complaint, the patient's answers to follow-up questions, relevant medical history disclosed during the interview, and the resulting clinical summary
• Conversation transcripts and, where the interview is conducted by voice, the spoken audio captured during the call
• Consent acknowledgment, with a timestamp

C. Website and Technical Data

When you visit athelai.com or use the platform:

• Standard server logs: IP address, browser type, device type, pages requested, referring URL, session timestamps
• Cookies and similar technologies, used for authentication, security, and basic analytics. We do not use advertising trackers on athelai.com.
• For the clinician dashboard, audit logs of every read, write, export, and delete action on patient records — including the user identity, action, resource accessed, and timestamp. These logs are immutable and retained as required by applicable health privacy law.

We do not collect race, ethnicity, citizenship status, immigration status, sexual orientation, or genetic information unless a clinic has specifically configured Athel to ask a question that elicits it for a documented clinical reason.

D. Information from Other Sources

In limited circumstances, we may receive information about a patient or clinic user from sources other than the individual directly. These include:

• Information provided by the Custodian or Covered Entity — for example, the patient's name, contact information, appointment time, and reason for visit, transmitted to Athel by the clinic when an interview is scheduled
• Electronic medical record (EMR) integrations — where the clinic has authorized an integration, demographic or appointment data may be transmitted to Athel directly from their EMR
• Referrals — where a patient is referred by another provider, basic referral information may be transmitted to Athel by the referring or receiving clinic

In all cases, this information is collected on behalf of the Custodian or Covered Entity and is governed by their authority to do so.

03How We Use Information

We apply the Minimum Necessary Standard (45 CFR § 164.502(b) under HIPAA, and the equivalent data-minimization principle under PIPEDA and PHIPA): we limit the use, disclosure, and request of personal information and PHI to the minimum necessary to accomplish the intended purpose.

We use the information we collect to:

• Conduct the pre-visit clinical interview the patient has been invited to complete
• Generate the clinical summary delivered to the physician before the appointment
• Authenticate clinicians, enforce role-based access, and maintain audit logs
• Operate, secure, and improve the platform
• Detect and prevent abuse, fraud, and unauthorized access
• Communicate with clinic users about service updates, billing, and support
• Meet our legal, regulatory, and contractual obligations

For U.S. clients, we use and disclose PHI only as permitted or required by the BAA, the Privacy Rule, and applicable state law. We do not use or disclose PHI for marketing, sale, or any purpose not authorized in writing by the Covered Entity.

We do not use patient personal health information to train AI models. This is explained in detail in Section 5.

We do not sell or rent personal information or personal health information. We do not share it with advertisers, data brokers, or any third party for cross-context behavioral advertising. We have not sold or rented personal information in the past twelve months and have no intention to do so.

No solely automated decision-making. Athel does not make decisions about patients that produce legal or similarly significant effects based solely on automated processing. All AI-generated outputs are reviewed by a clinician before any care decision is made.

Where Athel uses data that has been de-identified in accordance with applicable standards — including the HIPAA Safe Harbor and Expert Determination methods (45 CFR § 164.514(b)) and ISO/IEC 20889 — for the purpose of service improvement, quality assurance, or aggregate reporting, that data is not personal information and is not subject to the restrictions of this policy. We do not attempt to re-identify de-identified data.

04How We Share Information

We share information only as described below.

• With the Custodian or Covered Entity that has engaged Athel. The clinical summary, transcript, and audit records are made available to the authorized users at the clinic.
• With our subprocessors, as described in Section 9, strictly for the purpose of operating the platform and only under written agreements that bind them to protections consistent with this policy.
• To comply with law — for example, in response to a subpoena, court order, or other lawful request. For PHI, we will notify the affected Custodian or Covered Entity before disclosure where permitted by law, so they may seek a protective order or otherwise contest the request.
• To protect rights and safety — to prevent fraud, investigate security incidents, or address an imminent threat to safety, where doing so is permitted or required by law.
• In a business transfer — if Athel is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction. Any successor will be bound to the protections of this policy, and we will provide notice to clients before personal health information is transferred. The transfer of PHI in a business transaction will comply with the BAA, PHIPA, and applicable law.

We do not share information for any other purpose without the express authorization of the Custodian, Covered Entity, or affected individual.

05How Artificial Intelligence Is Used

Athel uses AI to conduct the clinical interview and to generate the physician-facing summary. The following safeguards are architectural — they are enforced by how the system is built, not by policy alone.

• Human review. Every AI-generated summary is delivered to the physician for clinical review before any care decision is made. Athel does not make automated decisions that produce legal or similarly significant effects without human review.
• No training on patient data. Patient information processed through Athel is never used to train, fine-tune, or improve any AI model — ours or our infrastructure providers'. This is enforced both contractually and architecturally.
• Identifier scrubbing. Patient names, dates of birth, health card numbers, phone numbers, and clinic and physician identifiers are never passed to the AI model. The model receives only the clinical content of the conversation.
• Two-layer guardrails. Our reporting pipeline runs a grounding check (every clinical claim in the report is verified against the transcript) and an independent re-derivation of any risk stratification, before the report is released to the physician.
• Disclosure to patients. Before any interview begins, patients are informed that the interview is conducted by an AI agent and that the resulting summary is reviewed by their physician.

06Legal Basis and Consent

We process personal information and personal health information under the following legal bases:

• Consent. Patients provide explicit, timestamped consent at the start of every interview, in line with PIPEDA and PHIPA standards. For U.S. patients, the use of information is governed by the Covered Entity's Notice of Privacy Practices and the HIPAA Privacy Rule.
• Within the circle of care. For Ontario clinics operating under PHIPA, information is processed within the patient's circle of care to support the upcoming appointment.
• Contractual necessity. To deliver the service the clinic has contracted for.
• Legal obligation. Where retention, audit, or disclosure is required by law.

A patient may withdraw consent at any time by contacting their clinic. Withdrawal does not affect processing that has already occurred and may affect the clinic's ability to deliver care.

07Data Residency

Athel operates separate, region-locked infrastructure for Canadian and U.S. clients. Patient data does not cross the border.

Canadian Clients

All information processed for Canadian clients — including patient personal health information, transcripts, audio, generated reports, audit logs, AI inference, and backups — is stored and processed on enterprise cloud infrastructure located physically within Canada. PHI from Canadian clients does not leave Canada at any stage of the pipeline, including AI inference, voice synthesis, and storage.

U.S. Clients

All information processed for U.S. clients — including protected health information, transcripts, audio, generated reports, audit logs, AI inference, and backups — is stored and processed on enterprise cloud infrastructure located physically within the United States. PHI from U.S. clients does not leave the United States.

Cross-Border Data

A small amount of operational data that does not contain personal health information — for example, an account holder's support ticket, a billing record, or a product analytics event — may be processed outside the client's home jurisdiction for service operation. Where this occurs, we use contractual safeguards (Data Processing Addenda and, where applicable, Standard Contractual Clauses) to maintain equivalent protection.

08Security Controls

Athel's security posture is designed to meet the requirements of PHIPA, PIPEDA, and the HIPAA Security Rule (45 CFR Part 164, Subpart C — covering administrative, physical, and technical safeguards), and to be reviewed under SOC 2 Type II. Controls include:

• Encryption in transit. TLS 1.2 or higher on all endpoints and APIs. Real-time voice audio is encrypted end-to-end using the WebRTC industry-standard media encryption protocol.
• Encryption at rest. AES-256 encryption for the database, document storage, backups, and audit logs. Credentials and API keys are stored in a managed secrets vault.
• Per-clinic isolation. Every patient record carries a clinic identifier. Data is isolated at both the application layer and the database layer using row-level security policies. Cross-clinic data access is not architecturally possible.
• Role-based access control. Dashboard access requires authenticated session tokens. Roles are enforced at the API middleware layer.
• Immutable audit logging. Every PHI access — read, write, download, delete — is logged to an append-only audit stream. Application code cannot modify or delete audit entries.
• Breach detection. Audit middleware monitors for anomalous PHI access patterns and triggers an internal alert pathway.
• Vulnerability and patch management. Infrastructure is hosted on managed enterprise cloud platforms and kept current with security patches; application dependencies are scanned regularly.

A detailed Trust Center — including our current subprocessor list, security white paper, and compliance attestations — is available to prospective and current clients under NDA: security@athelai.com.

No security guarantee. While Athel implements industry-leading administrative, physical, and technical safeguards, no method of transmission over the internet or method of electronic storage is 100% secure. We continuously evaluate and adapt our safeguards to new threats, but we cannot guarantee absolute security. Authorized users are responsible for keeping their account credentials confidential and for notifying us immediately of any suspected unauthorized access by emailing security@athelai.com.

09Subprocessors

We engage a limited number of carefully vetted enterprise subprocessors to operate the platform — including a cloud infrastructure provider, a managed database provider, voice and telephony providers, and a payment processor. We require each subprocessor to provide protections consistent with this policy and applicable law, and to enter into appropriate data processing agreements.

For U.S. clients, every subprocessor that creates, receives, maintains, or transmits PHI on Athel's behalf is required to sign a Business Associate Agreement that flows down HIPAA obligations, as required by 45 CFR § 164.502(e)(1)(ii) and § 164.308(b)(1). For Canadian clients, equivalent written safeguards are in place under PHIPA and PIPEDA.

For Canadian clients, subprocessors handling PHI operate in Canadian regions. For U.S. clients, subprocessors handling PHI operate in U.S. regions.

A current subprocessor list is maintained in our Trust Center and made available to active clients and prospective clients under NDA. We provide advance notice to active clients of material changes to our subprocessor list, consistent with our BAA obligations.

10Data Retention and Deletion

Athel retains personal health information only as long as required to fulfill our contractual obligations to the Health Information Custodian or Covered Entity, and consistent with PHIPA's requirement that PHI be retained only as long as necessary.

• Patient personal health information. As an agent of the Custodian (or Business Associate of the Covered Entity), Athel retains PHI for the period specified by the Custodian or Covered Entity in our contract. The Custodian's underlying record-retention obligations — including those imposed by professional regulatory colleges in their jurisdiction — remain with the Custodian. Athel's default retention is seven (7) years from the date of the last entry, which may be extended or shortened by contract.
• Account and billing data. Retained for the duration of the contract and for seven (7) years after termination to meet financial-recordkeeping obligations.
• Audit logs. Retained for the period required by applicable health privacy law and contract.
• Website logs. Retained for up to 12 months.

Return or destruction of PHI on contract termination. Following contract termination and a 30-day data retrieval window, Athel will, at the Custodian's or Covered Entity's election, return or permanently delete all PHI. For U.S. clients, this obligation is performed in accordance with 45 CFR § 164.504(e)(2)(ii)(J), which requires Business Associates to return or destroy all PHI received from, or created or received on behalf of, the Covered Entity at termination of the BAA. If return or destruction is not feasible for a specific category of PHI (for example, regulatory archive copies required by law), Athel will extend the protections of the BAA to that PHI and limit further use and disclosure to those purposes that make return or destruction infeasible.

Permanent deletion is performed using cryptographic erasure (verified destruction of the encryption keys protecting the data partition) consistent with NIST SP 800-88 Rev. 1 guidance for media sanitization in cloud environments. Associated backups are purged within 90 days. A Certificate of Destruction is available on request to the Health Information Custodian or Covered Entity.

11Your Rights

Patients and clinic users have rights with respect to their information. These rights are exercised through the Health Information Custodian (your clinic) or the Covered Entity, who is the primary point of contact for your records. Athel supports the Custodian or Covered Entity in fulfilling these requests.

Depending on your jurisdiction, you may have the right to:

• Access the personal information or PHI held about you, including, for U.S. patients, the right of access to your designated record set under HIPAA (45 CFR § 164.524)
• Request correction of inaccurate information, including, for U.S. patients, the right to request amendment of PHI under HIPAA (45 CFR § 164.526)
• Receive an accounting of certain disclosures of your PHI, for U.S. patients, under HIPAA (45 CFR § 164.528)
• Request restrictions on certain uses and disclosures of your PHI (45 CFR § 164.522)
• Receive confidential communications by alternative means or at alternative locations (45 CFR § 164.522(b))
• Withdraw consent (subject to legal and clinical limitations)
• Receive a copy of your information in a portable, electronic format
• File a complaint with a regulator without retaliation

If your clinic is unable to address your request, or if you have a privacy concern directly involving Athel, contact our Privacy Officer at privacy@athelai.com. We respond to verified requests within 30 days.

Non-discrimination. Athel will not retaliate against any individual for exercising their privacy rights. We will not deny services, charge different prices, or provide a different level or quality of service because an individual exercised a right under applicable privacy law.

Marketing communications. If you receive marketing communications from Athel — for example, product updates or newsletters sent to clinic users — you may opt out at any time by clicking the unsubscribe link in any message or by emailing privacy@athelai.com. Transactional and service messages (for example, security alerts, billing notices) will continue regardless.

Cookies. You may manage cookies through your browser settings. Most browsers allow you to block or delete cookies; refer to your browser's help documentation. Blocking cookies may affect the functionality of the clinician dashboard and other authenticated parts of the platform.

You may also file a complaint with:

• Information and Privacy Commissioner of Ontario — for PHIPA matters in Ontario
• Office of the Privacy Commissioner of Canada — for PIPEDA matters
• The applicable provincial privacy commissioner, for matters outside Ontario
• U.S. Department of Health and Human Services, Office for Civil Rights (HHS OCR) — for HIPAA matters in the United States
• The applicable U.S. state attorney general's office, for state health-information law matters

Verifying your request. To protect your information, we will verify your identity before responding to any rights request. We may ask you to confirm details that match our records (for example, your name, email address, and the clinic or relationship through which we know you). If you submit a request through an authorized agent, we will require written authorization signed by you and may still contact you directly to confirm.

12Your Rights in Respect of Customer Data

If your personal information or personal health information has been submitted to Athel by or on behalf of a Custodian or Covered Entity (your clinic, physician, or health authority), and you wish to exercise any rights you may have in respect of that information — including the right to access, correct, amend, or delete it — please contact your provider directly and refer to their privacy notice.

This is because Athel processes Customer Data on the provider's instruction. Under PHIPA, the Custodian is the party with the legal authority to act on your record; under HIPAA, the Covered Entity is the party with the legal authority over your designated record set. We will support your provider in fulfilling your verified request, but we cannot fulfill it directly without their authorization.

If you have already contacted your provider and have been unable to resolve your concern, you may contact our Privacy Officer at privacy@athelai.com and we will work with your provider to address it.

13International Data Transfer

Athel is headquartered in Canada. For Canadian and U.S. clients, PHI is processed within the client's home jurisdiction as described in Section 7 (Data Residency).

A limited amount of operational data that does not contain PHI — for example, a clinic user's support ticket, billing record, or product analytics event — may be processed by Athel or our subprocessors outside of the client's home jurisdiction. Where this occurs, we rely on contractual safeguards (Data Processing Addenda and, where applicable, Standard Contractual Clauses or equivalent transfer mechanisms) to ensure a level of protection equivalent to that of the originating jurisdiction.

By using our website, marketing channels, or non-authenticated platform features, you understand that your information may be processed in Canada and in countries where our service providers are located, which may have different data protection laws than your home country.

14Breach Notification

If we become aware of a security incident that results in the unauthorized access, use, disclosure, loss, or theft of personal health information or PHI, we will:

1. Notify the affected Health Information Custodian or Covered Entity without unreasonable delay. For U.S. clients, in accordance with the HIPAA Breach Notification Rule (45 CFR § 164.410), Athel will report a breach of unsecured PHI to the Covered Entity without unreasonable delay and in no case later than 60 calendar days after discovery of the breach. For Canadian clients, notification timelines follow the requirements of PHIPA, PIPEDA, and our contract.
2. Provide the information needed for the Custodian or Covered Entity to meet their own notification obligations to patients and regulators — including, for U.S. breaches, the identification of affected individuals, the nature of the PHI involved, and the steps Athel has taken to mitigate harm and prevent recurrence.
3. Cooperate with their investigation and remediation, including providing access to relevant audit logs.
4. Notify the applicable regulator directly where required by law.

Athel maintains a written Incident Response Plan that is tested and updated regularly, consistent with the administrative safeguard requirements of 45 CFR § 164.308(a)(6).

15Children's Information

Athel's services are directed to healthcare providers, not directly to children. We do not knowingly collect personal information directly from children under the age of 13 in the United States (per the Children's Online Privacy Protection Act, COPPA) or under the applicable age of consent in other jurisdictions, through our website or marketing channels.

Where a clinic uses Athel for a pediatric patient, the interview is conducted with the parent or legal guardian who has the right to act on the child's behalf, in accordance with the rules under PHIPA, PIPEDA, HIPAA, or applicable state law. The Custodian or Covered Entity is responsible for ensuring that appropriate consent has been obtained.

If you believe we have inadvertently collected information directly from a child in a manner not covered by a clinic engagement, please contact privacy@athelai.com and we will delete it.

16Changes to This Policy

We may update this policy from time to time. Material changes will be communicated to clinic users through the platform or by email at least 30 days before they take effect, unless an earlier change is required by law. The current version, and the date of the most recent update, is always posted at athelai.com.

17Contact