Privacy

PRIVACY POLICY

Last updated: 2026-09-07 Effective: 2026-09-07

1. INTRODUCTION

CaseMed Inc. (“CaseMed”, “we”, “us”, “our”) is a corporation incorporated under the laws of the Province of Nova Scotia, Canada. CaseMed operates an artificial intelligence (“AI”) voice-based clinical simulation platform used by health professionals and the organizations responsible for their training.

This Privacy Policy describes the personal information CaseMed collects, the purposes for which it is used, the parties to whom it may be disclosed, the periods for which it is retained, and the choices and rights available to individuals. It applies to the CaseMed website at https://casemed.app and its subdomains (the “Website”), the CaseMed platform (the “Platform”), and all related products and services (collectively, the “Services”).

This Policy is incorporated by reference into the CaseMed End User Licence Agreement (the “EULA”) and the CaseMed Services and Licensing Agreement (the “Services Agreement”), found at https://casemed.app/legal. Capitalized terms used but not defined in this Policy have the meanings given to them in those agreements.

The Services are not intended for use by minors. CaseMed does not knowingly collect personal information from individuals below the age of majority in their jurisdiction.

1.1 Privacy Officer

CaseMed has designated a Privacy Officer, who is responsible for CaseMed’s compliance with this Policy and with applicable privacy legislation, and who may be contacted at privacy@casemed.app.

Privacy Officer CaseMed Inc. 600-1741 Lower Water Street Halifax, Nova Scotia B3J 0J2 privacy@casemed.app +1 902 702 3755

Enquiries, requests, and complaints concerning personal information may be directed to the Privacy Officer. CaseMed will acknowledge receipt within 5 business days and will respond within 30 days, or will advise of the reason additional time is required.

2. SCOPE

This Policy applies to personal information collected from all Visitors, including Clients, Account holders, and individuals who use the Website without holding an Account.

2.1 Visitors

A Visitor is any individual who accesses or uses the Website or the Services, regardless of whether they are a Client, hold an Account, or have made Payment.

2.2 Clients

A Client is the party that has purchased access to the Platform. A Client may be an Organization or an Individual.

Organizations. Organizations purchase access to the Platform for one or more End Users. They include but are not limited to hospitals, colleges, universities, and other organizations purchasing access to the Platform on behalf of their own clients, students, employees, or other affiliated individuals who are the End Users of the Platform. An Organization is also allocated one or more Administrator Accounts for managing the End Users affiliated with it. An Organization is therefore typically a Client with several associated Accounts.

Individuals. Individuals purchase access to the Platform for their own use. An Individual holds a single End User Account and manages their own subscription.

2.3 Accounts

Access to the Platform is exercised through the privileges accorded to an Account with valid status. An Account is either an Administrator Account or an End User Account.

Administrator. Administrator Accounts are held by representatives of an Organization Client and afford the privileges set out in the agreements signed with CaseMed. These Accounts are responsible for managing the Organization’s affiliated End Users and content.

End User. End User Accounts are held by individuals affiliated with an Organization Client, or by an Individual Client, and afford the privileges set out in the agreements signed with CaseMed.

An Account is allocated to a single individual. Accounts may not be shared and may not be used by more than one individual in any circumstance; doing so invalidates the Account’s status.

Where an individual holds more than one Account, each Account — and the personal information and privileges associated with it — is treated separately.

2.4 Account status and Payment

Status. To validate an Account, the Account holder must accept the EULA during onboarding and verify their email address. Until an Account has been validated, the individual may not use Platform features that require valid Account privileges.

Payment. Payment means consideration provided in exchange for some or all of the Services, including one-time payments, subscriptions, and other transfers of value, and is typically provisioned on an agreed basis through a valid Account. For the purposes of this Policy, a reference to Payment for Services means an agreement for Services that is currently in effect.

2.5 Application of this Policy regardless of status or Payment

This Policy applies to all Visitors, including those who request information from or otherwise contact CaseMed.

This Policy applies to Account holders whether or not the Account is valid, and whether or not Payment has been made for Services.

This Policy applies to individuals whose access to the Services has expired, lapsed, or been suspended or terminated.

This Policy continues to apply to personal information retained by CaseMed following the closure, suspension, or termination of an Account, for so long as that information is retained.

Account status and Payment determine what an individual may do on the Platform. They do not affect CaseMed’s obligations in respect of that individual’s personal information or the rights described in section 12.

2.6 Common arrangements and data visibility

The Visitor, Client, Account, status, and Payment definitions above determine whose personal information is visible to whom. Other privileges attaching to each type of Account are governed by the EULA and the Services Agreement rather than by this Policy, and are available at https://casemed.app/legal.

In this section, primary performance data means an End User’s own scores, rubric assessments, narrative feedback, and reports. Secondary performance data means aggregate or derived measures calculated across more than one End User, such as averages, distributions, and trends. Secondary performance data is made available only where it does not identify any individual End User.

The following are common arrangements arising from these definitions.

• 1.Client is an Organization; Account is an Administrator. A valid Administrator whose Organization has made Payment can view the primary performance data of End Users within their Organization and can contact those End Users through the Platform’s messaging system. Section 7.2 sets out what an Organization can see.
• 2.Client is an Organization; Account is an End User. A valid End User whose Organization has made Payment has primary performance data that is visible to the Administrators of their Organization. The End User cannot view the primary performance data of any other Account. Secondary performance data may be made available to them.
• 3.Client is an Individual; Account is an End User. A valid End User who has made Payment can view their own primary performance data and reports. The Account is not associated with an Organization; no other Account has access to its primary performance data, and it has no access to the primary performance data of any other Account. Secondary performance data may be made available to them.
• 4.Account status is not valid; no Account; or Account closed, suspended, or terminated. Features requiring valid Account status are unavailable and no new performance data is generated. Privileges become available once the Account is validated.

2.7 Relationship to the agreements

The EULA and the Services Agreement govern access to and use of the Services, including the privileges accorded to each type of Account. This Policy governs CaseMed’s handling of personal information and prevails over those agreements to the extent of any inconsistency on that subject. Nothing in this Policy or in those agreements limits any right an individual has under applicable privacy legislation.

3. INFORMATION COLLECTED

3.1 Account and registration information

• •Full legal name
• •Email address
• •Telephone number
• •Account credentials
• •Organization, role, program, and training level or year
• •Professional designation and specialty
• •Medical licence or college registration number, where continuing professional development (“CPD”) or continuing medical education (“CME”) credit is requested
• •Address, which determines the jurisdiction applied to the Account holder’s rights and to any retention period required by local law
• •Time zone and interface preferences

3.2 Voice and audio information

When the voice-based simulation features (the “Voice Features”) are used, CaseMed collects and processes:

• •Audio recordings of the Account holder’s spoken input during simulated clinical encounters;
• •Transcripts generated from those recordings; and
• •Data derived from those recordings and transcripts.

The Voice Features cannot operate without audio recording. Users who do not consent to audio recording may continue to use all non-voice features of the Platform.

3.3 Simulation, performance, and interaction information

• •Responses, questions, and clinical decisions expressed within a case
• •Investigations, imaging, and interventions selected within a case
• •Response times, navigation behaviour, and interaction patterns
• •Scores, rubric assessments, competency ratings, narrative feedback, and generated reports
• •Case assignments, attempts, completion status, and deadlines

Information in this section, together with the information described in section 3.2, constitutes “Platform Data” as that term is defined in the EULA and the Services Agreement.

3.4 Client Content

Administrators may upload the following on behalf of an Organization (collectively, “Client Content”, which includes Assessment Materials as defined in the Services Agreement):

• •Case Information — fictional or de-identified non-fictional medical and case information, and case templates;
• •Assessment Materials — rubrics, scoring methods, objectives, and similar materials; and
• •Administrative Information — Account lists, email addresses, and other personal information relating to the Organization’s End Users.

Under the Services Agreement, the Client represents and warrants that all Client Content is handled in compliance with applicable laws. Where patient information is concerned, the Client represents and warrants that the information has been properly de-identified in accordance with applicable privacy and health information legislation, and that all necessary consents, authorizations, and ethics approvals have been obtained.

CaseMed treats all Case Information and Assessment Materials as de-identified information. Administrative Information is personal information and is handled in accordance with this Policy.

CaseMed handles Client Content in accordance with the safeguards described in section 10.

3.5 Payment and billing information

Payment card details are collected and processed by CaseMed’s payment processor. CaseMed does not receive or store full payment card numbers. CaseMed retains transaction records, the card brand and final four digits, billing name and address, and invoice history.

3.6 Technical and log information

• •IP address and derived approximate geographic region
• •Browser type and version, operating system, and device type
• •Audio device configuration
• •Pages and features accessed, timestamps, and referring URLs
• •Authentication events, session records, and security and audit logs
• •Error diagnostics and performance telemetry

3.7 Third-party information

The Platform presents simulated clinical scenarios only. No Account holder, Client, or other individual may speak, enter, or upload information identifying any other person, including but not limited to information identifying a real patient. Doing so is a violation of the agreements signed with CaseMed.

Where CaseMed becomes aware that information identifying another person has been submitted, CaseMed will isolate the affected record, remove the information from active systems, exclude it from any training corpus, record the matter in its incident register, and notify the Client and Account holder concerned so that they may meet any obligations of their own. CaseMed reserves the right to suspend an Account or terminate the Services where third-party information has been submitted, regardless of the reason for the submission.

4. VOICE AND BIOMETRIC INFORMATION

This section describes CaseMed’s collection and use of voice information and constitutes CaseMed’s notice regarding biometric information for the purposes of applicable legislation, including the Illinois Biometric Information Privacy Act, 740 ILCS 14.

Information collected. Audio recordings of the Account holder’s speech during simulated clinical encounters, transcripts derived from those recordings, and data derived from those recordings and transcripts.

Purposes. To operate the voice simulation and generate simulated patient responses; to manage conversational flow within a session; to generate performance assessments, scores, feedback, and reports; to enable review of completed sessions by the End User and, where applicable, the Administrator of the End User’s Organization; for quality assurance of CaseMed’s assessment methods; and for research and development, including the training, fine-tuning, evaluation, and commercialization of CaseMed’s AI models.

Consent. Consent to audio recording and to the purposes described above is obtained through a data processing consent presented separately during onboarding, before the first recorded session. Consent is required in order to access the Voice Features.

Length of term. Raw session audio is retained until the earlier of 12 months after expiry or termination of the subscription under which it was recorded, and 24 months after the Account holder last used the Services. Where an Account holder has opted out under section 5.5, their raw session audio is retained only for the period necessary to deliver and assess the case in which it was recorded.

CaseMed does not retain raw session audio beyond the applicable period. At the end of that period the audio is permanently deleted. Transcripts and derived data are retained for the periods set out in section 9.

Speaker representations. Operating the Voice Features and developing CaseMed’s models may involve generating numerical representations of speech, some of which encode characteristics of an Account holder’s voice (“speaker representations”). Where CaseMed generates speaker representations, it does so only for:

• 1.operating and improving the Platform’s simulation and assessment features; and
• 2.training, fine-tuning, and evaluating CaseMed’s AI models.

Each session is processed independently. Any speaker representation generated in the course of delivering a session exists only for the duration of that session and is not retained afterwards or carried over to any other session. Speaker representations arising in the course of model training are intermediate to that process and are not retained as a record associated with an identifiable individual.

CaseMed does not:

• •use speaker representations, or any other voice data, to identify or verify the identity of any individual. Identity on the Platform is established by Account credentials;
• •maintain an enrolment database of speaker representations against which recordings are compared or matched;
• •retain a persistent speaker representation for an Account holder, whether within or across sessions;
• •use speaker representations to link an Account holder across separate sessions or Accounts;
• •use speaker representations or voice data to develop voice-cloning, voice-synthesis, or voice-impersonation products for commercial sale or licensing;
• •use voice data to generate synthetic audio misrepresenting an Account holder’s voice; or
• •make employment, credentialing, licensure, certification, or disciplinary determinations about an Account holder, or provide voice data to any person for that purpose, beyond the educational reporting described in section 7.2.

CaseMed’s AI models are not designed or used to reconstruct, reproduce, or identify the voice of any individual.

Model training outputs. Deletion of raw session audio does not reverse model training already carried out using that audio. Derived training outputs, including the parameters (weights) of CaseMed’s AI models, persist after the audio from which they were derived has been deleted. Those outputs are not a record of any individual and are not used to reconstruct or identify an Account holder’s voice. Section 12.2 sets out the effect of this on deletion requests.

Voice Biometrics under the agreements. “Voice Biometrics” means an Account holder’s acoustic features and voiceprint, as defined in the EULA and the Services Agreement. As provided in those agreements, CaseMed does not sell, licence, or transfer Voice Biometrics to third parties, and does not use them for any commercial purpose other than operating and improving the Platform. Disclosure of voice data to service providers and to parties engaged to support model development is described in sections 7.1 and 7.4.

Changes. CaseMed will not materially expand the purposes for which speaker representations or voice data are used without giving at least 30 days’ advance notice and, where the change would extend beyond what an Account holder has already consented to, obtaining fresh express consent.

5. PURPOSES FOR WHICH INFORMATION IS USED

CaseMed uses personal information for the following purposes.

5.1 Provision of the Services

• •Creating, administering, and authenticating Accounts
• •Delivering simulation sessions
• •Generating scores, feedback, and reports
• •Making results available to the End User and, where applicable, the Administrator of the End User’s Organization
• •Administering assignments, deadlines, and completions, and issuing related notifications
• •Providing technical support and responding to enquiries

5.2 Security and integrity

• •Detecting, investigating, and preventing unauthorized access, account sharing, fraud, and misuse
• •Maintaining audit logs and monitoring for security incidents
• •Enforcing the EULA, the Services Agreement, and this Policy

5.3 Business operations

• •Processing payments, issuing invoices, and maintaining financial records
• •Reporting CPD and CME credit to accrediting bodies where credit has been requested
• •Meeting legal, tax, accounting, regulatory, and accreditation obligations

5.4 Product improvement and analytics

• •Diagnosing errors and monitoring performance, reliability, and availability
• •Analysing usage patterns to improve case design, scoring calibration, and user experience

5.5 Research, development, and AI model training

CaseMed uses Platform Data, including audio recordings, transcripts, derived data, interaction data, and evaluative outputs, to conduct research and to develop, train, fine-tune, evaluate, improve, and commercialize its AI models, and for related publications and marketing.

As set out in the EULA and the Services Agreement, Platform Data is the exclusive property of CaseMed and may be used for any lawful purpose. Use of the Platform is subject to acceptance of those agreements, and the purposes described in this section form part of them. Platform Data that could personally identify an individual is handled in accordance with this Policy and applicable law.

Audio recorded during a session is used for these purposes for the period set out in section 9, unless the Account holder opts out.

Opting out of model training. An Account holder may opt out of the use of their data for the training of CaseMed’s AI models by written request to privacy@casemed.app, identifying the Account concerned. CaseMed will acknowledge the request within five business days and action it within 30 days. On an opt-out taking effect, CaseMed will cease using that Account holder’s data for training and exclude it from all future training runs; will delete raw audio already held rather than retaining it for the balance of the period in section 9; and will thereafter retain that Account holder’s raw audio only for the period necessary to deliver and assess each case. Opting out does not affect access to the Platform or any assessment. It does not require the retraining of models developed before the request was actioned, and derived training outputs already produced are retained. Section 12.2 sets out the scope and limits of deletion and opt-out requests.

Where CaseMed publishes or presents research, the information used is aggregated, de-identified, or anonymized such that individuals are not identified.

5.6 Marketing communications

Where an email address has been provided, CaseMed may send information regarding its products, cases, and events. Each marketing message includes an unsubscribe mechanism. Administrative, service, and security notifications relating to an Account are not marketing communications and are sent for the duration of the Account. Where an Account is issued by an Organization, the End User also receives messages from that Organization’s Administrator through the Platform’s messaging system in connection with assignments, Account status, and related activities.

6. CONSENT

Consent is obtained during onboarding through three instruments:

• •the Services Agreement, accepted by the Client;
• •the EULA, accepted individually by each Account holder; and
• •a separate data processing consent, presented to each Account holder after the EULA and before their first recorded session.

The data processing consent sets out what is collected, the purposes for which it is used, the periods for which audio and other data are retained, that raw audio is permanently deleted at the end of that period, and the opt-out described in section 5.5.

Where a seat has been purchased by an Organization, the End User accepts the EULA and the data processing consent themselves. An Organization cannot give these consents on an End User’s behalf.

Renewal. Subscriptions renew automatically in accordance with the applicable agreement. Continued payment renews the subscription; it does not renew consent to the processing described in section 4. The data processing consent is re-affirmed by the Account holder at each renewal. An Account holder who does not complete that re-affirmation is treated as having opted out under section 5.5 from that point forward, and their access to the Platform is unaffected.

Where an Account is issued by an Organization, the Organization and its Administrator are responsible for authorizing access and for notifying End Users of the EULA, including the audio recording consent required to use the Voice Features, before Accounts are activated.

Withdrawal. Consent to the Voice Features may be withdrawn at any time by discontinuing use of those features. Use of voice data for AI model training may be withdrawn separately, by written request under section 5.5. Subject to section 5.5, and as provided in the EULA, withdrawal of consent does not affect CaseMed’s right to use Platform Data already generated prior to withdrawal. Consent to marketing communications may be withdrawn at any time using the unsubscribe mechanism in any marketing message or by contacting the Privacy Officer. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal, and does not extend to information CaseMed is required or permitted to retain under section 9 or applicable law.

7. DISCLOSURE OF PERSONAL INFORMATION

CaseMed does not disclose personal information for advertising purposes and does not disclose personal information to data brokers or advertising networks. Personal information may be disclosed in the following circumstances.

7.1 Service providers and processors

CaseMed engages service providers to perform functions on its behalf. These providers are bound by contract to process personal information only on CaseMed’s instructions and to maintain appropriate confidentiality and security safeguards.

Certain processing is performed by CaseMed on its own infrastructure and does not involve disclosure to a third party.

CaseMed maintains a current list of service providers, available on request.

7.2 Organizations

Where an Account has been issued by an Organization, that Organization’s Administrators may access:

• •The End User’s name, email address, program, and training level;
• •Cases assigned and the status, date, and number of attempts;
• •Scores, rubric assessments, competency ratings, and feedback reports;
• •Session transcripts, where enabled by the Organization; and
• •Cohort-level analytics that may include the End User’s results.

Administrators do not have access to raw session audio.

Administrators may also contact End Users within their Organization through the Platform’s messaging system in connection with assignments, Account status, and related activities.

An Organization’s use of this information is governed by its own policies and by its Services Agreement with CaseMed.

Where the Client is an Individual, no Administrator or other Account has access to that Account’s performance data.

7.3 Accrediting and credentialing bodies

Where an Account holder requests CPD or CME credit, CaseMed submits to the relevant accrediting body the information required for the award of credit, which typically comprises the Account holder’s name, licence or member number, the activity completed, the date of completion, and the credits earned. Participation is reported only where credit has been requested.

7.4 Research and model development partners

CaseMed may disclose Platform Data, including audio recordings, transcripts, and derived data, to third parties engaged by CaseMed to support model development, fine-tuning, evaluation, annotation, or related research. Such parties are bound by contract to confidentiality and security obligations and to use the information solely for the purposes for which it was provided. Disclosure of Voice Biometrics is subject to the limitations in section 4.

7.5 Legal and protective disclosures

CaseMed may disclose personal information where required or permitted by law, including in response to a court order, subpoena, warrant, or other lawful demand; to enforce its agreements; to investigate suspected fraud, misuse, or a security incident; or to protect the rights, property, or safety of any person.

7.6 Corporate transactions

In connection with a merger, acquisition, financing, reorganization, or sale of all or part of its business or assets, CaseMed may transfer personal information to the counterparty or its advisors, subject to appropriate confidentiality protections. Information transferred in such a transaction remains subject to this Policy until the individual is notified of any change.

8. INTERNATIONAL TRANSFER AND STORAGE

CaseMed is a Canadian corporation. Personal information collected through the Services, including audio recordings, transcripts, and performance data, is stored and processed on servers located in the United States and operated by the service providers identified in section 7.1. Under specific circumstances where a Services Agreement stipulates regional data processing and storage, the data will be handled and processed in the regions stipulated in that agreement.

While personal information is located in the United States, it is subject to the laws of that jurisdiction and may be accessible to United States courts, law enforcement agencies, regulators, and national security authorities in accordance with those laws. Those laws may differ from the laws of Canada or of an individual’s province, state, or country of residence.

CaseMed remains accountable for personal information transferred to a third party for processing and uses contractual and technical measures, including written data protection terms, encryption in transit and at rest, and access controls, to provide a comparable level of protection.

Before personal information relating to residents of Quebec is communicated outside Quebec, CaseMed conducts and documents a privacy impact assessment in accordance with section 17 of the Act respecting the protection of personal information in the private sector, and the transfer is governed by a written agreement reflecting that assessment.

Certain Organizations, including public bodies in Nova Scotia and British Columbia, are subject to requirements that personal information be stored and accessed only in Canada. A Canadian-hosted deployment is available on request under a Services Agreement. Organizations subject to a data residency requirement should contact CaseMed prior to entering into a Services Agreement.

9. RETENTION

CaseMed retains personal information for the periods set out below, or for such longer period as is required by law.

Voice audio. Raw session audio is retained until the earlier of:

• •12 months after expiry or termination of the subscription under which it was recorded; and
• •24 months after the Account holder last used the Services.

Subscriptions renew automatically in accordance with the applicable agreement, and consent to the processing described in section 4 is re-affirmed at each renewal. Where an Account holder has opted out under section 5.5, their raw session audio is retained only for the period necessary to deliver and assess the case in which it was recorded, and the opt-out is applied to audio already held.

At the end of the applicable period the raw audio is permanently deleted. The same period applies in every jurisdiction; where the law of an Account holder’s jurisdiction requires a shorter period, that shorter period applies. As set out in section 4, deletion of raw audio does not reverse model training already carried out using it, and derived training outputs persist.

Transcripts, derived data, and evaluative outputs. Transcripts, derived data, interaction data, and scores, rubric assessments, and reports are retained for as long as necessary for the purposes set out in section 5, which include model integrity, research reproducibility, longitudinal assessment validity, and accreditation and audit defensibility. Where CPD or CME credit has been claimed, these records are retained for a minimum of 6 years from the date of the session. Retention is subject to any shorter period required by the law of the Account holder’s jurisdiction.

Derived measures. Measures computed from session audio that cannot be used to reconstruct the audio and are not capable of distinguishing one speaker from another — for example aggregate timing, pacing, and conversational-flow measures used in assessment — are not personal information once separated from the Account record, and are retained indefinitely.

Client Content. Where a Services Agreement expires or is terminated, the Client may elect within 30 days to have Client Content returned in a commercially reasonable format or deleted from CaseMed’s active production systems. Copies residing in routine backup systems are deleted as those backups expire in the ordinary course, currently within 35 days.

Other categories.

Information that has been aggregated or anonymized such that no individual can be identified, directly or indirectly, is not personal information and may be retained indefinitely.

10. SECURITY

10.1 Safeguards

CaseMed maintains administrative, technical, and physical safeguards designed to protect personal information against loss and unauthorized access, use, disclosure, alteration, or destruction. These include:

• •Encryption of personal information in transit and at rest
• •Role-based access controls, with access limited to personnel whose role requires it
• •Multi-factor authentication for administrative access
• •Audit logging of access to Accounts, session data, and Client Content
• •Network and system access controls
• •Periodic security reviews and vulnerability management
• •Documented incident detection and response procedures
• •Confidentiality obligations and privacy and security training for personnel and contractors

No method of transmission or storage is entirely secure, and CaseMed does not warrant that personal information will not be subject to unauthorized access.

10.2 Certification status

CaseMed is implementing its control environment against the AICPA Trust Services Criteria for Security, Availability, and Confidentiality and is working toward a SOC 2 Type II examination. CaseMed does not currently hold a SOC 2 report. When a report is issued, it will be made available to Clients and prospective Clients under a non-disclosure agreement and this section will be updated.

10.3 Incident notification

Where a confidentiality or security incident creates a real risk of significant harm, or a risk of serious injury under applicable Quebec legislation, CaseMed will notify affected individuals and the Office of the Privacy Commissioner of Canada and, in respect of Quebec residents, the Commission d’accès à l’information du Québec, as soon as feasible, and will notify affected Clients in accordance with their Services Agreements. CaseMed maintains a register of confidentiality incidents whether or not notification is required.

11. AUTOMATED PROCESSING AND ASSESSMENT

Scores, competency ratings, and feedback reports generated by the Platform are produced by automated systems, using the Account holder’s session information and a case rubric authored and reviewed by physicians.

Assessment is based on the Account holder’s clinical performance and communication within the case. An Account holder may request information regarding the personal information used to produce a particular assessment by contacting CaseMed.

Automated systems are subject to error, and performance may vary across accents, dialects, speech patterns, and first languages. CaseMed carries out periodic assessments for such variation but cannot guarantee deterministic outcomes for AI-generated responses under real use conditions at all times.

As stated in the EULA and the Services Agreement, the Services are intended for educational and professional development purposes. Assessments generated by the Platform do not constitute medical advice. Where an activity is specifically identified as accredited, completion may be reported for continuing professional development or continuing medical education credit as described in section 7.3. Except where an activity is so identified, assessments generated by the Platform are not a licensure, credentialing, certification, or fitness-to-practise determination.

Enquiries regarding an assessment, and requests to access or correct personal information used in an assessment, may be directed to CaseMed at https://casemed.app/contact or to the Privacy Officer.

12. ACCESS, CORRECTION, AND OTHER RIGHTS

12.1 General

Subject to applicable law and to the terms of the EULA and Services Agreement, an individual may:

• •Request access to the personal information CaseMed holds about them, and information regarding its use and disclosure;
• •Request correction of personal information that is inaccurate or incomplete;
• •Withdraw consent, as described in section 6; and
• •Request deletion of personal information, which CaseMed will action except where retention is required or permitted under section 9, the EULA, the Services Agreement, or applicable law. Section 12.2 sets out what a deletion request covers and what it does not.

Requests should be directed to the Privacy Officer. CaseMed may require verification of identity before acting on a request. CaseMed does not charge a fee for access requests.

12.2 Scope and limits of deletion requests

A request for deletion is actioned against the personal information CaseMed holds at the time the request is received. It extends to:

• •raw session audio still within the retention period set out in section 9;
• •transcripts, derived data, interaction data, and evaluative outputs;
• •Account and profile information; and
• •Client Content of the kind described in section 3.4,

except where CaseMed is required or permitted by law, or by section 9, to retain the information.

A request for deletion does not extend to:

• •information that has already been deleted in the ordinary course under section 9. Raw session audio in particular is deleted on the schedule in section 9 and is not held indefinitely;
• •derived training outputs, including the parameters (weights) of AI models trained before the request is actioned. As described in section 4, those parameters are not a record of any individual, are not attributable to any single Account holder, and are not used to reconstruct or identify any individual’s voice; or
• •aggregated, de-identified, or anonymized information that can no longer be attributed to an individual.

CaseMed does not retrain, roll back, or withdraw an AI model, or delete a model’s parameters, in response to a deletion request or an opt-out under section 5.5. Deletion and opt-out operate prospectively from the date the request is actioned.

CaseMed’s AI models are developed incrementally, each version building on versions that preceded it. The influence of data used in earlier training cannot be isolated within, or removed from, later versions. Exclusion under section 5.5 therefore applies to training carried out after a request is actioned, and does not reverse the effect of training already completed.

Nothing in this section limits a right that applicable privacy legislation confers on an individual and that cannot be limited by agreement.

12.3 Quebec residents

In addition to section 12.1, residents of Quebec may request that computerized personal information they have provided to CaseMed be communicated to them, or to a designated third party, in a structured, commonly used technological format. This right applies to information collected from the individual and does not extend to information created or inferred by CaseMed, including assessments and evaluative outputs. Residents of Quebec may also exercise the rights provided under section 28.1 of the Act respecting the protection of personal information in the private sector.

12.4 United States residents

Residents of states with biometric privacy legislation, including Illinois, Texas, Colorado, and Washington, may exercise the notice and consent provisions described in section 4 and may contact the Privacy Officer regarding the personal information CaseMed holds. Residents of Washington may request confirmation as to whether CaseMed collects or shares consumer health data, and may request deletion of such data.

CaseMed does not currently meet the applicability thresholds of most comprehensive United States state privacy statutes. The rights described in section 12.1 are extended to all users.

12.5 Students of United States educational institutions

Where an Organization is a United States educational institution and CaseMed maintains education records on its behalf, CaseMed acts as a school official with a legitimate educational interest under the Family Educational Rights and Privacy Act, 34 CFR §99.31(a)(1)(i)(B), under the direct control of that Organization with respect to the use and maintenance of those records and subject to the redisclosure limitations of 34 CFR §99.33(a). Rights of access and correction under that Act are exercised through the Organization.

12.6 Complaints

Complaints should first be directed to the Privacy Officer. An individual who is not satisfied with CaseMed’s response may contact:

• •Office of the Privacy Commissioner of Canada — priv.gc.ca — 1-800-282-1376
• •Commission d’accès à l’information du Québec — cai.gouv.qc.ca — 1-888-528-7741
• •The privacy regulatory authority in the individual’s province, state, or country of residence

13. COOKIES AND SIMILAR TECHNOLOGIES

CaseMed uses cookies and similar technologies for the following purposes:

• •Strictly necessary — authentication, session management, security, and load balancing. These are required for the Platform to function.
• •Functional — retaining user preferences, including language and interface settings.
• •Analytics — CaseMed does not use third-party analytics, advertising, or session-replay technologies.

Cookies may be managed through browser settings. Disabling strictly necessary cookies will prevent sign-in.

14. AMENDMENTS

CaseMed may amend this Policy from time to time. The revised Policy will be posted on the Website with an updated “Last updated” date and will take effect upon posting. Where an amendment is material, CaseMed will provide notice by email or by other means it considers appropriate given the nature of the change. Continued use of the Services following notice constitutes acceptance of the amended Policy.

Previous versions of this Policy are available at https://casemed.app/legal.

15. CONTACT

CaseMed Inc. 600-1741 Lower Water Street Halifax, Nova Scotia B3J 0J2 privacy@casemed.app +1 902 702 3755

CaseMed has designated a Privacy Officer, who may be contacted at privacy@casemed.app.

General enquiries may be directed to CaseMed at https://casemed.app/contact.

This Policy should be read together with the CaseMed End User Licence Agreement and the CaseMed Services and Licensing Agreement.