Privacy Policy

Effective Date: November 13, 2024

Aivida Inc. ("Aivida," "we," "our," or "us") operates the websites www.aivida.com and www.scribblehealth.com (the "Websites") and provides products and services, including our application, Scribble (the "Product"). This Privacy Policy outlines how we collect, use, disclose, and safeguard personal information, ensuring compliance with U.S. HIPAA, Canadian PIPEDA, and SOC 2 standards. This policy applies to all users of our Websites and Products. By using our websites or services, you agree to the collection, use, and disclosure of your personal information in accordance with this Privacy Policy. If you do not agree with this Privacy Policy, please do not use our Websites or Products.

1. Scope This Privacy Policy applies to:
● Website Users: Visitors who access and interact with the Websites.
● Product Users: Health professionals, registered users, and patients whose data is processed through our Products.

2. Information
We Collect Personal Information You Provide We may collect the following personal information:
● Name, company name, hospital affiliation, email address, postal address, telephone number, and country of residence.
● Username, billing address, and payment method for subscriptions.
● Communications with our team regarding the Websites or Product. Technical Information Collected Automatically
● IP address, browser type, operating system, screen resolution, location, and language settings.
● Cookies to enhance Website functionality (see Section 8 for details). Patient Information Provided by Product Users Registered users may provide Patient Information, including:
● Audio recordings for transcription.
● Clinical notes or related personal health information (PHI).

3. How We Use Your Information
We use personal information to:
● Website Users: Improve the website experience, respond to inquiries, and ensure security.
● Product Users: Operate the Scribble application, process patient data in compliance with HIPAA and PIPEDA, and provide customer support.

4. Information Disclosure
● We do not disclose your personal information to any third parties. None of the user data (ie.emails, usage data) is shared with third-party groups. Health information is shared with third-parties in a privacy compliant manner.

5. Your Responsibilities
As a user of the product, you are solely responsible for the accuracy, confidentiality, and security of any patient-sensitive data or other data you submit through the App. By using the App, you represent and warrant that:
a. You have the necessary permissions, consents, and patient informed consents to submit the data through the App.
b. You will comply with all applicable data protection and privacy laws and regulations in relation to the data you submit through the App.
c. You will not submit any data that is false, misleading, defamatory, or otherwise inappropriate. Aivida shall not be liable for any unauthorized access, loss, or disclosure of patient or other sensitive data submitted through the App.

6. Third Parties with Authorized Access
We may share personal information with trusted third parties for the purposes outlined in this policy. These third parties include, but are not limited to:
● Cloud Service Providers: For data storage and application hosting (e.g., AWS, Google Cloud).
● Payment Processors: For handling subscription and billing information (e.g., Stripe).
● Customer Support Platforms: For managing customer inquiries and support tickets. Compliance and Legal Advisors: For ensuring regulatory compliance and handling legal obligations.
● IT and Security Consultants: For maintaining the integrity and security of our systems. All third parties are bound by agreements requiring them to safeguard personal information in compliance with applicable U.S. HIPAA and Canadian PIPEDA regulations.Aivida's privacy practices include a list of third parties authorized to receive personal information, available on our public-facing website.

7. Data Retention and Deletion
7.1 Retention
● Website Users: Information is retained for as long as necessary to provide services or comply with legal obligations.
● Product Users:
     ○ Audio files are stored for up to seven days post-transcription.
     ○ Clinical notes and summaries are retained for as long as the registered user remains a customer.
7.2 Deletion
● Upon request, we will delete personal information unless retention is required by law. Contact us at privacy@aivida.com to make a request.

8. Your Rights
You have the following rights:
● Access and Correction: Access, correct, or delete your personal information.
● Opt-Out (Canada): Canadian users may opt out of receiving marketing communications or certain data processing activities by contacting privacy@aivida.com with "Opt-Out Request" as the subject line.
● Opt-In (U.S.): U.S. users must explicitly opt in to allow their personal information to be used for marketing or data processing activities by providing express consent during account setup or by contacting privacy@aivida.com.
● Objection to Processing: Object to data processing for direct marketing purposes by contacting privacy@aivida.com with "Data Subject Objection" as the subject line.
● Access Through Application: Access your personal information, usage history, and agreements (e.g., EULA) through the application by navigating to your settings and profile. 

9. Security Measures
We implement robust security measures to protect personal information, including:
● Encryption of data in transit and at rest.
● Access controls based on the principle of least privilege.
● Regular audits and monitoring.

10. Cookies and Tracking Technologies
Our website uses cookies to enhance your experience. You can adjust your browser settings to disable cookies. For more information, refer to our Cookie Policy.

11. Children's Privacy
Our services are not intended for individuals under the age of 13. If you believe your child has provided personal information, contact us immediately at privacy@aivida.com.

12. Consent and Choice
● Aivida obtains express consent from users prior to using any personal information for marketing and advertising. Such consent is optional and not a condition for service use.
● Optional data collection and processing are disabled by default and can only be enabled by explicit user choice.
● Users are responsible for capturing patient consent, as outlined in the EULA and Terms of Use Agreement, which are accepted during sign-up.

13. Updates to This Policy
We may update this Privacy Policy periodically. The "Effective Date" at the top of this page reflects the latest changes. We encourage regular reviews to stay informed.

14. Contact Us
For questions or concerns about this Privacy Policy:
● Email: privacy@aivida.com
● Address: 441-100 Innovation Drive, Winnipeg, Manitoba, R3T 6G2 15. Monitoring and Enforcement
● Aivida reviews its privacy practices annually to ensure compliance and accuracy.
● Security commitments are communicated to external users as appropriate. 
● Privacy notices are regularly reviewed and updated to remain transparent and accurate.

16. Purpose and Use of Personal Information
● Personal information is only used for purposes identified in this Privacy Policy.
● Third parties to whom personal information is disclosed are bound by policies and agreements that communicate handling requirements.

17. Rights of Data Subjects
● Aivida has documented policies and procedures to handle and respond to requests from data subjects exercising their rights, including access, correction, deletion, or objections to processing.
● Users can request a copy of their personal information or receive notice of deletion or de-identification of such data.

18. Transparency
● This Privacy Policy outlines the purpose of data collection, choice and consent, types of information collected, methods of collection, use, retention, access, disclosure, security, quality, and enforcement.
● The Privacy Policy is publicly available and accessible to all external users and internal employees.

19. Data BreachNotification
In the event of a data breach that compromises personal information, Aivida Inc. will promptly notify affected individuals and relevant authorities in accordance with applicable laws and regulations. Notifications will include details of the breach, the nature of the compromised data, and recommended steps for individuals to protect themselves.

20. International Data Transfers
Aivida Inc. may transfer personal information to jurisdictions outside of your country of residence for processing and storage. When transferring data internationally, we implement appropriate safeguards, such as standard contractual clauses or participation in recognized frameworks, to ensure the protection of your personal information in compliance with applicable data protection laws.

21. User Consent Management
Users have the right to manage their consent preferences regarding the collection and use of their personal information. You may withdraw or modify your consent at any time by accessing your account settings or contacting us at privacy@aivida.com. Please note that withdrawing consent may affect your ability to use certain features of our services. 

22. Third-Party Processors
We engage trusted third-party service providers to perform functions on our behalf, such as cloud storage, payment processing, and customer support. These third parties are contractually obligated to protect your personal information and process it solely for the purposes specified by Aivida Inc. A list of these third parties is available upon request.

23. Data Minimization
Aivida Inc. is committed to collecting only the personal information necessary for the purposes outlined in this Privacy Policy. We regularly review our data collection practices to ensure they align with the principle of data minimization, thereby reducing the risk of unnecessary data processing.

24. Automated Decision-Making
Our services do not involve automated decision-making processes that produce legal effects concerning individuals or similarly significantly affect them. Should this practice change, we will update this Privacy Policy accordingly and inform affected individuals of their rights related to such processing.