Privacy Policy

1. Introduction

NeuroAI Inc. (“NeuroAI”, “we”, “us”, or “our”) operates Clarity, the clinician and administrator dashboard within the BRIDGES platform (the “Services”). This Privacy Policy describes how we handle personal information and personal health information in connection with Clarity. The Engage caregiver application and Allie AI are covered by their own separate privacy policies.

This Policy applies to the clinicians and administrators who use Clarity, and explains what information we handle (including the patient and caregiver personal health information that clinics manage through the Services), how we use and protect it, the role we play in relation to it, and the choices and rights available to you.

We are subject to the federal Personal Information Protection and Electronic Documents Act (“PIPEDA”) and to the applicable provincial and territorial privacy and health-information legislation in the jurisdictions where the clinics we serve operate — including, for example, Ontario’s Personal Health Information Protection Act (“PHIPA”), New Brunswick’s Personal Health Information Privacy and Access Act (“PHIPAA”), and Saskatchewan’s Health Information Protection Act (“HIPA”). We design and operate the Services with these obligations in mind.

2. Definitions

To make this policy clear, we distinguish two categories of information:

• “Account Data” — information about the people who hold accounts and operate the Services: clinician and administrator names, work email addresses, roles, authentication identifiers, billing and subscription details, and audit and usage records. For Account Data, NeuroAI is the controller.
• “Clinic PHI” — personal health information about patients/children and their caregivers that a clinic collects and entrusts to the Services (for example, child profiles, intake responses, developmental information, clinical notes, and AI-generated clinical content). For Clinic PHI, the clinic is the responsible party under its applicable provincial or territorial health-privacy legislation — called a “custodian” (e.g., Ontario, New Brunswick), a “trustee” (e.g., Saskatchewan), or an equivalent term, and referred to in this Policy as the “custodian” — and NeuroAI acts on the clinic’s behalf (see Section 3).

“Personal information” and “personal health information” otherwise have the meanings given to them under PIPEDA and the applicable provincial or territorial health-privacy legislation.

3. Our Role (Custodian, Agent, and Service Provider)

• For Account Data, NeuroAI is the controller and is directly accountable to you under PIPEDA.
• For Clinic PHI, the clinic is the custodian under the health-privacy legislation of the province or territory in which it operates. NeuroAI acts as the clinic’s agent and service provider (an information manager / service provider), processing Clinic PHI only on the clinic’s instructions and for the purpose of providing the Services. We do not use Clinic PHI for our own purposes.
• The Clarity AllieID registry is designed so that, with appropriate authorization, a child’s identity can be recognized across the connected care partners involved in that child’s care (for example, a clinic, a school-based service, or social services). Where NeuroAI enables connected custodians to share personal health information with one another electronically, NeuroAI may act as a health information network provider (or the equivalent role under the applicable provincial or territorial health-privacy legislation) and will meet the corresponding obligations.

If you are a patient or caregiver and wish to exercise rights over Clinic PHI, those requests are generally directed to and handled by your care partner (the custodian); see Section 11.

4. Information We Collect

• Account Data (clinicians and administrators): name, work email, clinic and role, authentication identifiers (including via Microsoft Entra single sign-on), preferences, and records of your activity in the Services.
• Clinic PHI we process on a custodian’s behalf: child and caregiver identifiers and demographics; intake and questionnaire responses; developmental information and clinician observations; clinical notes and summaries; and AI-generated clinical content that a clinician reviews and adopts.
• Audio for ambient documentation (AI Scribe): where a clinic enables the AI Scribe and a clinician chooses to use it, audio of a clinical encounter, handled as described in Section 6 — audio is never stored, and the resulting transcript is ephemeral.
• Documents you upload: files a clinician uploads (for example, assessments or report cards), which we process — including using automated text extraction (OCR) — to make their contents usable within the Services.
• Payment and subscription information: for self-serve clinic subscriptions, billing and subscription metadata processed through our payment provider. We do not store full payment card numbers.
• Communications you send us: if you contact our support team, the contents of that correspondence, to respond to and resolve your request.
• Technical and usage information: device and browser information, log data, and first-party usage analytics used to operate, secure, and improve the Services.

5. How We Use Information

We use information to provide, operate, secure, and maintain the Services; authenticate users and enforce role-based access; generate the clinical and operational features clinicians request (see Section 6); process subscriptions; respond to support requests; meet legal, regulatory, and audit obligations; and detect and prevent fraud, abuse, and security incidents.

We use Account Data and aggregate, first-party usage information to operate and improve the Services. We do not use your personal information, personal health information, or any AI inputs or outputs to train or fine-tune AI models — including third-party models.

6. AI Features and Automated Processing

The Services include AI-assisted features. AI output is decision support for a qualified professional — it does not make decisions about diagnosis, treatment, or care, and a clinician reviews and is responsible for any AI-generated content before it is used or adopted.

• Clinical assistant, summaries, and intake tools: we use Azure OpenAI Service to generate developmental summaries, intake summaries and form drafts, and clinical-assistant responses that clinicians review.
• Disability Tax Credit (DTC) assessment: where enabled, we use Azure OpenAI Service to draft, on a per-field basis, suggested responses for the CRA T2201 (Mental Functions) form from the clinician’s notes. Each suggestion is presented for the clinician’s review, edit, and explicit confirmation; the clinician is the attesting health practitioner.
• Content tagging and document extraction: we use Azure OpenAI Service to tag resource-library content and Azure AI Document Intelligence to extract text from uploaded documents.
• AI Scribe / ambient documentation: where a clinic enables this feature and a clinician chooses to use it, the Services capture audio of a clinical encounter and use Microsoft Azure Speech to transcribe it, then use Azure OpenAI Service to generate a structured draft clinical note. Audio is never stored. The transcript is held only on the clinician’s device (in browser local storage) for the duration of the session, is not written to our databases, and is purged automatically — on note generation, on session end or discard, and in any event within a 4-hour crash-recovery window. The note is the record, reviewed and authored by the clinician. This feature is enabled per clinic and reflects the Ontario Information and Privacy Commissioner’s guidance on AI scribes (January 2026).
• AI providers and no-training commitment: AI features use Microsoft Azure OpenAI Service, Microsoft Azure Speech and Microsoft Azure AI Document Intelligence, under Microsoft’s enterprise data-protection terms. Our Azure OpenAI resource is located in Canada, and data the service stores, including any data held for abuse monitoring, stays in Canada. However, requests to Azure OpenAI Service, which powers every feature above except transcription and document text extraction, may be processed in Microsoft data centres in other countries, including the United States, to generate the response. If content is flagged for potential misuse, authorized Microsoft personnel, who may be located outside Canada, can review it. Azure Speech (transcription) and Azure AI Document Intelligence (document text extraction) process data in Canada. Your data is not used to train Microsoft’s models or any third-party models, and we do not send your data to consumer AI services. We are working to move clinical AI processing to Canadian-only deployments and will update this Policy when that is complete (see Section 9).
• Automated decision-making: the Services do not make decisions that produce legal or similarly significant effects about an individual solely through automated processing; a clinician remains involved.

7. The AllieID Registry and Cross-Care-Partner Identity

The Services use a portable identifier (“AllieID”) so that, with appropriate authorization, a child can be recognized across the connected care partners involved in their care. To support this, we maintain identity-link records (including one-way cryptographic hashes of demographic identifiers) used to match records and prevent duplicate or mismatched identities. Cross-care-partner linkage is governed by the role and obligations described in Section 3.

8. How We Share Information; Service Providers

We do not sell personal information. We share information only as needed to provide the Services, with service providers bound by agreements requiring them to protect it in accordance with applicable Canadian privacy law:

• Cloud infrastructure: Microsoft Azure (compute, storage, databases).
• AI processing: Microsoft Azure OpenAI Service; Microsoft Azure Speech (AI Scribe); Microsoft Azure AI Document Intelligence (document text extraction).
• Authentication: Microsoft Entra ID. Sign-in is handled by Microsoft in your organisation’s own Microsoft tenant or in ours; Microsoft stores Canadian tenants’ directory data in North America.
• Content delivery and network security: Cloudflare, Inc., through whose network our web application is delivered. Cloudflare decrypts and re-encrypts web traffic, which can include information you enter, at the data centre nearest you, which may be outside Canada.
• Application gateway: Microsoft Azure API Management, hosted in the United States. Requests from the family mobile app (including forms families submit to their clinic), notifications to families’ phones, and some caregiver email-verification messages pass through it.
• Email: Microsoft Azure Communication Services (verification, invite, and intake messages).
• Notifications to families’ phones: Apple Push Notification service and Google Firebase Cloud Messaging, reached through our application gateway.
• Payments: Stripe, Inc. (subscription billing).

Embedded video. Some Help Center pages contain videos hosted by YouTube or Vimeo. Nothing is loaded from those services until you choose to play a video. When you do, the provider receives your IP address, browser information, and the fact that the request came from Clarity, and handles it under its own privacy policy, which may be outside Canada. These providers are not NeuroAI service providers; your browser contacts them directly, at your request.

We may also disclose information where required by law, to protect rights and safety, or in connection with a corporate transaction (subject to equivalent protection).

9. Data Storage, Security, and Residency

We implement administrative, technical, and physical safeguards, including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256).
• Role-based access controls scoped to a user’s role and institution.
• PII-minimized audit logging that records operational events (such as timestamp, request method and path, status, user identifier, and institution identifier) without capturing request contents or clinical data.
• Secure credential handling (passwords are hashed; invite codes are stored as HMAC-SHA256 hashes, never in plaintext).
• Ongoing monitoring and security review.

Residency. Clinic PHI and clinician Account Data are stored in Canada (Microsoft Azure Canada Central and Canada East regions), except for billing information held by our payment provider and sign-in directory data held by Microsoft (see Section 8). Some processing takes place outside Canada: requests to Azure OpenAI Service may be processed in Microsoft data centres in other countries, including the United States (see Section 6); our web application is delivered through Cloudflare’s network, which may handle traffic outside Canada; requests from the family mobile app, notifications to families’ phones and some caregiver email-verification messages pass through our application gateway in the United States, and notifications also pass through Apple’s or Google’s notification services; content you choose to load from third-party video providers is served by those providers; and our payment provider (Stripe) stores and processes limited subscription and billing information outside Canada under contractual safeguards consistent with PIPEDA (see Section 8 for each). For clinics and users in Québec, this means personal information is stored and processed outside Québec, including in Ontario. While information is processed outside Canada, it may be subject to the laws of that country, including lawful access by its courts, law-enforcement and national-security authorities. You may contact us to ask where your information is stored and processed.

10. Data Retention and Deletion

We retain personal information for as long as needed to provide the Services and to meet legal, regulatory, professional, and audit obligations. Security-audit records are retained for up to 10 years. After a clinic subscription ends, Account Data is retained for a limited period and then deleted or de-identified, subject to legal-hold and audit requirements.

Deletion of Clinic PHI. Because the clinic is the custodian of Clinic PHI, certain clinical and registry records are retained by the custodian clinic in accordance with its own retention obligations, even after a caregiver deletes their account or requests deletion of their personal information. When a caregiver deletes their account, caregiver-private data held in the caregiver application (such as chat and usage history) is deleted, while clinical records the clinic owns are preserved for the custodian. We will explain this routing on request.

11. Your Rights

Subject to law, you may request access to, or correction of, your personal information, and may withdraw consent (which may affect our ability to provide some features).

• Account Data: contact us directly (see Section 18). We respond within 30 days or as required by law.
• Clinic PHI: because your care partner is the custodian, requests to access, correct, or delete patient or caregiver health information are generally directed to and fulfilled by that care partner; we assist the custodian as their service provider.

You may also raise concerns with the Office of the Privacy Commissioner of Canada or your provincial privacy commissioner (in Ontario, the Information and Privacy Commissioner of Ontario).

12. Consent

Under PIPEDA and the applicable provincial or territorial health-privacy legislation, we and the custodian clinics rely on consent for the collection, use, and disclosure of personal information and personal health information, except where the law permits or requires otherwise. The form of consent reflects the sensitivity of the information; personal health information is treated as sensitive.

13. Children’s Privacy

Clarity supports pediatric care. We do not knowingly collect information directly from children. Information about children is provided by their caregivers and by the custodian clinics responsible for their care, who are responsible for obtaining any consent required under applicable law. We do not use children’s information for marketing.

14. Electronic Communications (CASL)

Where we send commercial electronic messages, we do so in accordance with Canada’s Anti-Spam Legislation, including providing an unsubscribe mechanism. Transactional and service messages (for example, verification codes and invite and intake messages) are sent to operate the Services.

15. Provider Access and Shared Data

Where you or a custodian shares information with a care partner or other recipient through the Services, we cannot guarantee that the recipient will delete copies of information it has already received; the recipient’s handling is governed by its own obligations.

16. Breach Notification

If a privacy breach involving personal information under our control creates a real risk of significant harm, we will notify affected individuals and the appropriate regulator(s) as required by law, and will document the breach. Where NeuroAI acts as a service provider or network provider to a custodian, we will notify the affected custodian clinic(s) so they can meet their own health-privacy obligations.

17. Changes to This Policy

We may update this Policy. Material changes will be communicated through the Services or by other reasonable means, with an updated effective date.

18. Contact

Brad Wasson, Privacy Officer, NeuroAI Inc.

29 Main Street, Fredericton, NB E3A 1B7, Canada

Email: privacy@neuroai.ca