PHIA Services & Agent Agreement

This PHIA Services & Agent Agreement (the "Agreement") is entered into between Toothmind Inc. ("Toothmind," "we," "us," or "our"), a company incorporated in Canada, and the custodian identified through the acceptance process described below (the "Custodian"). It applies to custodians practising in Nova Scotia and supplements our Terms of Service and Privacy Policy. If this Agreement conflicts with either of those documents on a matter concerning personal health information, this Agreement governs.

This Agreement is accepted electronically by the individual who creates the primary account for a practice (the "Account Holder"). By accepting, the Account Holder represents and warrants that they are either:

• (a) a custodian within the meaning of clause 3(f) of the Personal Health Information Act, S.N.S. 2010, c. 41 ("PHIA") — that is, a regulated health professional or a person who operates a group practice of regulated health professionals — or a person authorized to bind that custodian (including a professional corporation or group practice) on whose behalf the account is created; or
• (b) an agent of a custodian who has been expressly authorized by that custodian to procure the Services on the custodian's behalf, in which case the Account Holder accepts this Agreement on behalf of, and binds, that custodian.

Where the Account Holder invites additional users to the account ("Authorized Users"), the Account Holder represents that each Authorized User is an agent of a Custodian bound by this Agreement and is authorized by that Custodian to use the Services. Where notes generated through the account are destined for the records of more than one custodian (for example, where associates are custodians of their own patient records), this Agreement applies to each such custodian, and the Account Holder represents that they have authority to bind each of them.

The Account Holder further represents that the Custodian is a private practice and is not a public body, municipality, or other organization subject to Nova Scotia's public-sector privacy legislation (including any restriction under that legislation on storing or accessing personal information outside Canada). A Custodian that is, or becomes, subject to that legislation must notify Toothmind before using or continuing to use the Services, because the processing model described in section 7 may not be suitable for it.

Toothmind relies on these representations. Use of the Services by a person who is neither a custodian nor an authorized agent of one is a breach of this Agreement and of our Terms of Service.

• "PHIA" means the Personal Health Information Act, S.N.S. 2010, c. 41 (Nova Scotia), as amended.
• "Regulations" means the Personal Health Information Regulations, N.S. Reg. 217/2012, made under PHIA, as amended.
• "Personal health information" or "PHI" has the meaning given in clause 3(r) and section 4 of PHIA.
• "Commissioner" means the Information and Privacy Commissioner for Nova Scotia, who exercises the functions of the Review Officer under PHIA, and any successor oversight authority under PHIA.
• "Services" means Toothmind's clinical note drafting service, including text and voice input, cross-device dictation, and note generation, as described in the Terms of Service and Schedule A.
• "Procedural Inputs" means the procedural descriptions submitted to the Services by text or voice for the purpose of generating a draft note.
• "Voice Data" means spoken audio transmitted to the Services for transcription.
• "Generated Notes" means the draft clinical notes produced by the Services and returned to the user.
• "Clinical Data" means, collectively, Procedural Inputs, Voice Data, cross-device dictation text, and Generated Notes.
• "Account Data" means the account information described in our Privacy Policy, including email address, authentication tokens, saved clinical preferences, and custom note templates.
• "Subprocessor" means a third party engaged by Toothmind to process data in the course of providing the Services.
• "Privacy Breach" means any theft or loss of, or unauthorized collection, use, disclosure, copying, modification, retention, access to, or disposal of, Clinical Data or Account Data.

Toothmind provides services that enable the Custodian to use electronic means to prepare draft clinical notes. PHIA does not establish a separate category of electronic service provider; a person who handles personal health information for a custodian does so as the custodian's agent. Accordingly, to the extent that Toothmind collects, uses, retains, destroys, or disposes of personal health information for or on behalf of the Custodian, and for the Custodian's purposes rather than its own, Toothmind acts as an agent of the Custodian within the meaning of clause 3(aaa) of PHIA.

The Custodian permits Toothmind to handle such information solely as set out in this Agreement, in accordance with section 28 of PHIA, and this Agreement sets out the limits imposed by the Custodian for the purposes of clause 28(1)(b). In accordance with subsection 29(2) of PHIA, the provision of personal health information by the Custodian to Toothmind as its agent is a use by the Custodian, and not a disclosure by the Custodian or a collection by Toothmind. As between the parties, the Custodian remains responsible under subsection 28(1) for personal health information in its custody or control.

Treatment of Procedural Inputs. The Services are designed so that Clinical Data contains no patient names, dates of birth, health-card numbers, or other direct identifiers, and the parties do not concede that Procedural Inputs constitute identifying information or personal health information (clauses 3(l) and 3(r) of PHIA) in Toothmind's hands. However, without conceding that classification, Toothmind agrees to handle all Clinical Data with the protections that PHIA would require if it were personal health information. If a user submits information containing direct identifiers contrary to the Terms of Service, that information nonetheless receives the full protections of this Agreement: it is processed transiently, is not retained beyond the transient processing described in Schedule A, and is subject to every restriction and safeguard herein. The prohibition on identifying inputs governs the user's conduct; it does not reduce the protection applied to whatever is in fact submitted.

Treatment of Voice Data. Voice input is designed for the user to dictate their own procedural summary; the Terms of Service prohibit using it to record patient conversations or ambient audio. If a user does so contrary to the Terms of Service, the resulting audio nonetheless receives the full protections of this Agreement: it is processed transiently, is not retained, and is subject to every restriction and safeguard herein. The prohibition on such use governs the user's conduct; it does not reduce the protection applied to whatever is in fact captured.

No transfer of custody or control. Nothing in this Agreement transfers custody or control of any record of personal health information to Toothmind. The Custodian remains the custodian of, and solely responsible for, the patient record, including any Generated Note the Custodian finalizes and enters into its practice management software.

Toothmind shall collect, use, retain (transiently, as described in Schedule A), and destroy or dispose of Clinical Data only as necessary to provide the Services to the Custodian and its Authorized Users, namely: transcribing Voice Data, transiently holding cross-device dictation text for retrieval, generating a draft note from Procedural Inputs, and returning that note to the user. Without limiting the foregoing, Toothmind shall not:

• use Clinical Data to train, fine-tune, evaluate, or improve any artificial intelligence model;
• disclose Clinical Data to any person, except to Subprocessors as permitted under section 6 or where required by law (in which case Toothmind will, unless legally prohibited, notify the Custodian before complying);
• sell Clinical Data or Account Data, or use either for advertising or marketing;
• de-identify, aggregate, or derive datasets from Clinical Data for any secondary purpose;
• attempt to identify any individual from Clinical Data, or use or disclose Clinical Data in a manner that could reasonably be expected to identify an individual; or
• retain Clinical Data beyond the transient processing described in Schedule A.

Toothmind shall comply with PHIA as applicable to its role as agent, with the restrictions in this Agreement, and with any additional reasonable limits the Custodian communicates in writing, provided they are consistent with the design of the Services.

Toothmind shall maintain administrative, technical, and physical safeguards that are reasonable in the circumstances to protect Clinical Data and Account Data against theft or loss, and against unauthorized access, use, disclosure, copying, or modification, consistent with the Custodian's obligations under sections 61, 62, and 65 of PHIA and section 10 of the Regulations. These safeguards include, at minimum:

• encryption of all data in transit (TLS) and encryption at rest for stored data;
• a transient-only processing architecture for Clinical Data: Procedural Inputs and Voice Data are not written to disk or database; Voice Data is deleted immediately after transcription, and Procedural Inputs are discarded once the Generated Note is returned; cross-device dictation text exists only in server memory and is cleared upon retrieval or within 15 minutes;
• protection of network infrastructure, of hardware and its supporting operating systems, and of application software (including the way it authenticates a user's identity before allowing access), reflecting the categories of safeguards prescribed for electronic information systems by section 10 of the Regulations;
• access controls, including multi-factor authentication, limiting administrative access to authorized personnel, with no standing personnel access to Clinical Data in the ordinary course;
• security and access logging of Toothmind's own systems, limited to metadata (authentication events, note-generation events by user and timestamp, administrative and infrastructure access); Toothmind does not log the content of Clinical Data. Security logs are retained for no longer than 12 months and are used solely for security monitoring, breach detection and investigation, and service integrity;
• secure destruction such that reconstruction of the information is not reasonably foreseeable in the circumstances, consistent with section 49 of PHIA; and
• written confidentiality obligations binding every employee and every person acting on Toothmind's behalf who could access Clinical Data, on terms no less restrictive than this Agreement, before any such access is possible. All such personnel receive privacy and security training.

Toothmind shall review its safeguards regularly and maintain them in line with evolving threats, guidance issued by the Commissioner, and industry practice.

The Custodian authorizes Toothmind to use Subprocessors in the following categories, as further described in Schedule A: (a) AI inference infrastructure; (b) application hosting; and (c) account data storage. Toothmind shall:

• bind each Subprocessor by written agreement to data protection obligations no less protective than those in this Agreement, including prohibitions on retention of Clinical Data after processing and on the use of Clinical Data to train or improve AI models;
• configure Subprocessor services to process Clinical Data in Canadian regions, subject only to the transient cross-border routing described in section 7;
• remain fully responsible to the Custodian for the acts and omissions of its Subprocessors as if they were Toothmind's own; and
• give the Custodian at least 30 days' notice (by email or in-application notice) before any change of Subprocessor or material change to a Subprocessor's role that affects the handling of Clinical Data. If the Custodian reasonably objects on privacy grounds, the Custodian may terminate under section 10.

Processing elsewhere in Canada. Toothmind and its Subprocessors do not operate data centres in Nova Scotia. The Canadian cloud regions used to provide the Services are located in other Canadian provinces, and Clinical Data and Account Data are therefore processed outside Nova Scotia, within Canada. The parties understand and intend that, because Toothmind handles Clinical Data as the Custodian's agent (section 3), this processing is a use by the Custodian through its agent under subsection 29(2) of PHIA rather than a disclosure to a person outside the Province under section 44 of PHIA.

Transient United States routing. Toothmind's AI inference infrastructure is configured to use Canadian cloud regions with a geography-bound routing profile limited to Canada and the United States. To manage capacity, an individual inference request may be transiently routed to and processed in a United States region before the result is returned. Where this occurs: the data is transmitted encrypted over the provider's private network; it is not stored in the destination region; it is designed to contain no direct patient or clinician identifiers, and their entry is prohibited; and it remains subject to the contractual protections described in section 6. While in the United States, data may be subject to United States legal process. Clinical Data is not stored anywhere, in Canada or elsewhere, beyond the transient processing described in Schedule A; Account Data is stored only in Canadian regions.

The Custodian acknowledges this processing model and can describe it to patients using the plain-language text in Schedule B. Toothmind shall notify the Custodian in advance, as a material change under section 9, of any change that would expand the geographic scope of processing.

Toothmind shall notify the Custodian at the first reasonable opportunity upon becoming aware of a Privacy Breach or a reasonably suspected Privacy Breach affecting the Custodian's account or Clinical Data, consistent with subsection 28(3) of PHIA. Notification will describe, to the extent then known: the nature and scope of the breach, the data and accounts affected, the period involved, the containment measures taken, and a contact for follow-up, with reasonable updates as the investigation proceeds.

Toothmind shall further:

• take immediate steps to contain the breach and mitigate its effects;
• investigate the cause and implement remedial measures to prevent recurrence;
• cooperate with the Custodian in meeting the Custodian's own obligations under sections 69 and 70 of PHIA, including the Custodian's assessment of whether there is potential for harm or embarrassment to an individual, notice to affected individuals, and notice to the Commissioner where the Custodian decides that individual notification is not required;
• provide the Custodian with the information it reasonably requires to maintain its record of security breaches, including the corrective procedures taken, under section 10 of the Regulations; and
• provide the Custodian with the information reasonably required in connection with any review or investigation by the Commissioner, including relevant security log extracts.

The parties acknowledge that statutory notification of individuals and of the Commissioner is the Custodian's responsibility as custodian; Toothmind will not make such notifications on the Custodian's behalf except as agreed or required by law.

Draft-only outputs and human review. Generated Notes are drafts. The Custodian is responsible for ensuring that every Generated Note is reviewed, edited as needed, and approved by the treating clinician before it is entered into any patient record, consistent with the Terms of Service and the recordkeeping expectations of the Nova Scotia Regulator of Dentistry and Dental Assisting.

Notification of quality issues. Toothmind shall notify Custodians proactively (by email or in-application notice) if it identifies a systematic accuracy, reliability, or output-quality issue in the Services that could reasonably affect the content of Generated Notes, and shall suspend or correct the affected functionality as appropriate.

Material changes. Toothmind shall give advance notice of any material change to its data practices, data flows, Subprocessors, processing locations, or the categories of data handled by the Services, before the change takes effect. New features involving new collections, uses, or disclosures of Clinical Data will be described in such notice and, where reasonably practicable, made opt-in.

Records of user activity. Toothmind does not store Clinical Data beyond the transient processing described in Schedule A, and does not organize or index any data by patient. The Custodian's practice management software remains its system of record, and the Custodian remains responsible for the record of user activity required by section 63 of PHIA and section 11 of the Regulations in respect of that system. On request, Toothmind will provide the Custodian with the account-level metadata logs described in section 5 (for example, note-generation events by user and timestamp) to support the Custodian's own auditing.

Support for the Custodian's information practices. Schedule A is intended to support the Custodian's information practices under sections 48 and 62 of PHIA and its written retention schedule under section 50. Because Toothmind does not store any record of personal health information about any individual, it cannot respond to requests for access or correction under PHIA; Toothmind will promptly refer any such request, and any privacy complaint it receives from a patient, to the Custodian.

Annual attestation. Upon request, and no more than once per year, Toothmind will make available to the Custodian a summary attestation of its security and privacy practices sufficient to support the Custodian's oversight of its agents under PHIA and guidance issued by the Commissioner. This attestation is provided in place of individual audit rights, which are impracticable for a multi-tenant service; Toothmind may additionally make available summaries of third-party security assessments as they are completed.

Reporting by the Custodian. The Custodian and its Authorized Users should report suspected inaccuracies, unexpected outputs, or privacy concerns to info@toothmind.com; Toothmind will investigate reports in good faith.

This Agreement takes effect upon acceptance and continues for as long as the Custodian or any of its Authorized Users has an active account. Either party may terminate as set out in the Terms of Service; the Custodian may additionally terminate on written notice if Toothmind materially breaches this Agreement and fails to cure within 30 days, or as provided in section 6. The Custodian may close its account and initiate deletion at any time directly within the application.

Upon termination or account closure:

• Clinical Data: the parties acknowledge that, by design, Toothmind does not store Clinical Data beyond the transient processing described in Schedule A, and there is accordingly no Clinical Data to return or destroy;
• Account Data: deleted within 30 days of account closure, subject to legal retention obligations, and disposed of in accordance with section 5; and
• Security logs: retained only for the balance of their retention period in section 5, then disposed of securely.

Sections 3, 4, 5 (as to residual data), 8, 11, and 12 survive termination.

Privacy breach liability. Notwithstanding the limitations of liability in the Terms of Service, Toothmind is liable to the Custodian for direct damages arising from a Privacy Breach caused by Toothmind's failure to comply with this Agreement, up to an aggregate cap of the greater of (a) two times the fees paid by the Custodian in the 12 months preceding the event, and (b) CAD $10,000.

General cap. Toothmind's aggregate liability for all other claims under this Agreement is limited to the fees paid by the Custodian in the 12 months preceding the event giving rise to the claim.

Clinical content. Nothing in this Agreement alters the allocation of responsibility for the clinical content of notes: as set out in the Terms of Service, the Custodian and its clinicians are solely responsible for reviewing, editing, and approving Generated Notes before use in any patient record, and Toothmind is not liable for loss arising from reliance on a Generated Note without adequate review. The Custodian's indemnity in the Terms of Service respecting prohibited inputs and uses remains in effect.

Governing law. This Agreement is governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein, and the parties attorn to the exclusive jurisdiction of the courts of Ontario, consistent with the Terms of Service. Nothing in this Agreement limits the application of PHIA to the Custodian or to Toothmind as its agent, or the jurisdiction of the Commissioner or of the courts of Nova Scotia under PHIA.

Electronic acceptance. This Agreement may be accepted electronically, and electronic acceptance is valid and enforceable in accordance with applicable electronic commerce legislation, including the Electronic Commerce Act (Nova Scotia) and the Electronic Commerce Act, 2000 (Ontario). The Custodian may download or print a copy of this Agreement at any time for its privacy program records; the version and acceptance date are recorded against the account.

Amendments. Toothmind may amend this Agreement on advance notice by email or in-application notice. Amendments that materially reduce the protections in this Agreement do not take effect for an existing Custodian until accepted, or until the Custodian continues use of the Services after 30 days' notice, whichever is earlier. The Custodian may terminate rather than accept a material amendment.

Order of precedence. On matters concerning personal health information or the handling of Clinical Data, this Agreement prevails over the Terms of Service and Privacy Policy to the extent of any conflict.

Contact. Privacy Officer, Toothmind Inc. — info@toothmind.com.

Procedural Inputs (typed text)

Procedure-level descriptions (e.g., tooth number, procedure type, anesthesia, materials, findings). The input is not structured to capture patient or clinician identifiers, and their entry is prohibited. In particular, health-card numbers must never be entered; Toothmind does not seek to collect or use them (see section 27 of PHIA). Transmitted encrypted to AI inference infrastructure; processed transiently; discarded once the Generated Note is returned; never written to disk or database; never used for model training.

Voice Data

Spoken audio transmitted for transcription; deleted immediately after transcription; the audio never persists on any system. The resulting text is handled as a Procedural Input. A cancel control stops recording without transmission.

Cross-device dictation text

Held transiently in server memory only (never disk or database) to permit retrieval on another device; cleared upon retrieval or automatically within 15 minutes.

Generated Notes

Returned to the user and not retained by Toothmind. The Custodian's copy, once entered in its practice management software, is a record of personal health information in the Custodian's custody and is subject to the Custodian's own retention schedule.

Account Data

Full name, email address, province of licensure or practice, practice name (if provided), role (if applicable), authentication tokens, saved clinical preferences, custom note templates, and free-trial credits. Stored encrypted in Canadian cloud regions; retained for the life of the account; deleted within 30 days of closure.

Security logs and usage data

Metadata-only security and access logs (section 5), a daily usage counter, and error logs. No Clinical Data content is logged. Retained no longer than 12 months (logs) or as operationally necessary (counters, error logs), then securely disposed of.

Processing locations

Canadian cloud regions located outside Nova Scotia, with transient United States routing for AI inference only, as described in section 7. No data is stored outside Canada.

Subprocessors

• AI inference: Amazon Web Services (Amazon Bedrock), Canada region with Canada/US geography-bound routing; zero retention of prompts and outputs; no use of inputs or outputs for model training; model providers do not receive or access the data. Governed by the AWS Data Processing Addendum and the AWS Business Associate Addendum.
• Application hosting: Microsoft Azure (App Service), Canadian region. Clinical Data transits the application layer in memory only in the course of routing requests and responses; it is not written to disk, database, or logs. Governed by the Microsoft Products and Services Data Protection Addendum.
• Account data storage: MongoDB Atlas, Canadian cloud region. Stores Account Data only; does not receive Clinical Data. Governed by the MongoDB Data Processing Agreement.

The following plain-language text may be incorporated by the Custodian into the written statement about its information practices that section 68 of PHIA requires it to make available to the public, included in or posted alongside its notice of purposes (section 15 of PHIA), or used by the Custodian's designated contact person (section 67 of PHIA) to answer patient questions. Adapt bracketed text to your practice. This text describes Toothmind only and not other AI tools you may use.

Template notice

Our practice uses Toothmind, a Canadian software tool that helps your dentist prepare written treatment notes. Toothmind is a post-procedural tool. It is not designed to listen to or record your conversations with your dentist. After your treatment, your dentist types or dictates a short technical description of the procedure — with no names, birthdates, or health card numbers — and the tool produces a draft note. Your dentist reviews and finalizes every note before it goes into your chart, which stays in our practice's own record system. Toothmind does not keep any of this information: it is processed briefly and then discarded, and it is never used to train AI systems. Processing occurs on Canadian servers located outside Nova Scotia, although an individual request may briefly pass through secure U.S. infrastructure before being returned; nothing is stored there. Questions or concerns? Ask [contact person] at [contact details], or see our full privacy statement. If we are unable to resolve a concern, you may ask the Office of the Information and Privacy Commissioner for Nova Scotia to review it.

Contact-person quick answers

• Is my visit recorded? No. Toothmind is not designed to hear or record patient conversations. Your dentist types or dictates a short technical summary after your treatment.
• Is my name or health card number sent anywhere? No. The tool isn't designed to capture that information, and our clinicians and staff are prohibited from entering it.
• Where is my chart kept? In our own practice management system, as always. Toothmind does not store any information about your visit after the draft note is returned.
• Is anything used to train AI? No. That is contractually prohibited.
• Does data leave Nova Scotia or Canada? It is processed on Canadian servers in other provinces and is not stored outside Canada. A request may be briefly processed on secure U.S. servers and immediately discarded.
• Who reviews the notes? Your dentist reviews, edits, and approves every note before it enters your record.
• Who do I complain to? Start with our practice's contact person, [contact person]. If your concern isn't resolved, you can ask the Information and Privacy Commissioner for Nova Scotia to review it.