Privacy

PRIVACY POLICY

Version 1.11 — Last updated: 2026-10-24 · Effective: 2026-10-24

1. INTRODUCTION

CaseMed Inc. (“CaseMed”, “we”, “us”, “our”) is a corporation incorporated under the laws of the Province of Nova Scotia, Canada. CaseMed operates an artificial intelligence (“AI”) voice-based clinical simulation platform used by health professionals and the organizations responsible for their training.

This Privacy Policy describes the personal information CaseMed collects, the purposes for which it is used, the parties to whom it may be disclosed, how long it is retained, and the choices and rights available to individuals. It applies to the CaseMed website at https://casemed.app and its subdomains (the “Website”), the CaseMed platform (the “Platform”), and all related products and services (collectively, the “Services”).

This Policy is incorporated by reference into the CaseMed End User Licence Agreement (the “EULA”) and the CaseMed Services and Licensing Agreement (the “Services Agreement”), found at https://casemed.app/legal. Capitalized terms used but not defined in this Policy have the meanings given in Schedule A to the EULA; in this Policy "Client" includes both an Organization and an Individual Subscriber.

The Services are not intended for use by minors. CaseMed does not knowingly collect personal information from individuals below the age of majority in their jurisdiction.

1.1 Privacy Officer

CaseMed has designated a Privacy Officer, who is responsible for CaseMed’s compliance with this Policy and with applicable privacy legislation, and who may be contacted at privacy@casemed.app.

Privacy Officer CaseMed Inc. 600-1741 Lower Water Street, P.O. Box 997, Halifax, Nova Scotia B3J 0J2 privacy@casemed.app +1 902 702 3755

Enquiries, requests, and complaints concerning personal information may be directed to the Privacy Officer. CaseMed will acknowledge receipt within 5 business days and will respond within 30 days, or will advise of the reason additional time is required.

2. SCOPE

This Policy applies to personal information collected from all Visitors, including Clients, Account holders, and individuals who use the Website without holding an Account.

2.1 Visitors

A Visitor is any individual who accesses or uses the Website or the Services, regardless of whether they are a Client, hold an Account, or have made Payment.

2.2 Clients

A Client is the party that has purchased access to the Platform. A Client may be an Organization or an Individual Subscriber.

Organizations. Organizations purchase access to the Platform for one or more End Users. They include but are not limited to hospitals, colleges, universities, and other organizations purchasing access to the Platform on behalf of their own clients, students, employees, or other affiliated individuals who are the End Users of the Platform. An Organization is also allocated one or more Administrator Accounts for managing the End Users affiliated with it. An Organization is therefore typically a Client with several associated Accounts.

Individual Subscribers. Individual Subscribers purchase access to the Platform for their own use under Schedule B (Individual Subscriber Terms) to the EULA. An Individual Subscriber holds a single End User Account and manages their own subscription.

2.3 Accounts

Access to the Platform is exercised through the privileges accorded to an Account with valid status. An Account is either an Administrator Account or an End User Account.

Administrator. Administrator Accounts are held by representatives of an Organization Client and afford the privileges set out in the agreements signed with CaseMed. These Accounts are responsible for managing the Organization’s affiliated End Users and content.

End User. End User Accounts are held by individuals affiliated with an Organization Client, or by an Individual Subscriber, and afford the privileges set out in the agreements signed with CaseMed.

An Account is allocated to a single individual. Accounts may not be shared and may not be used by more than one individual in any circumstance; doing so invalidates the Account’s status.

Where an individual holds more than one Account, each Account — and the personal information and privileges associated with it — is treated separately.

2.4 Account status and Payment

Status. To validate an Account, the Account holder must declare their jurisdiction and age, accept the EULA during onboarding, and verify their email address. Until an Account has been validated, the individual may not use Platform features that require valid Account privileges.

Payment. Payment means consideration provided in exchange for some or all of the Services, including one-time payments, subscriptions, and other transfers of value, and is typically provisioned on an agreed basis through a valid Account. For the purposes of this Policy, a reference to Payment for Services means an agreement for Services that is currently in effect.

2.5 Application of this Policy regardless of status or Payment

This Policy applies to all Visitors, including those who request information from or otherwise contact CaseMed.

This Policy applies to Account holders whether or not the Account is valid, and whether or not Payment has been made for Services.

This Policy applies to individuals whose access to the Services has expired, lapsed, or been suspended or terminated.

This Policy continues to apply to personal information retained by CaseMed following the closure, suspension, or termination of an Account, for so long as that information is retained.

Account status and Payment determine what an individual may do on the Platform. They do not affect CaseMed’s obligations in respect of that individual’s personal information or the rights described in section 12.

2.6 Common arrangements and data visibility

The Visitor, Client, Account, status, and Payment definitions above determine whose personal information is visible to whom. Other privileges attaching to each type of Account are governed by the EULA and the Services Agreement rather than by this Policy, and are available at https://casemed.app/legal.

In this section, primary performance data means an End User’s own scores, rubric assessments, narrative feedback, and reports. Secondary performance data means aggregate or derived measures calculated across more than one End User, such as averages, distributions, and trends. Secondary performance data is made available only where it does not identify any individual End User.

The following are common arrangements arising from these definitions.

• 1.Client is an Organization; Account is an Administrator. A valid Administrator whose Organization has made Payment can view the primary performance data of End Users within their Organization and can contact those End Users through the Platform’s messaging system. Section 7.2 sets out what an Organization can see.
• 2.Client is an Organization; Account is an End User. A valid End User whose Organization has made Payment has primary performance data that is visible to the Administrators of their Organization. The End User cannot view the primary performance data of any other Account. Secondary performance data may be made available to them.
• 3.Client is an Individual Subscriber; Account is an End User. A valid End User who has made Payment can view their own primary performance data and reports. The Account is not associated with an Organization; no other Account has access to its primary performance data, and it has no access to the primary performance data of any other Account. Secondary performance data may be made available to them.
• 4.Account status is not valid; no Account; or Account closed, suspended, or terminated. Features requiring valid Account status are unavailable and no new performance data is generated. Privileges become available once the Account is validated.

2.7 Relationship to the agreements

The EULA and the Services Agreement govern access to and use of the Services, including the privileges accorded to each type of Account. This Policy governs CaseMed’s handling of personal information and prevails over those agreements to the extent of any inconsistency on that subject. Nothing in this Policy or in those agreements limits any right an individual has under applicable privacy legislation. The Data Processing Consent prevails over this Policy to the extent of any inconsistency on the subject of the personal information it covers.

3. INFORMATION COLLECTED

3.1 Account and registration information

• •Full legal name
• •Email address
• •Telephone number, where provided
• •Account credentials
• •Organization, role, program, and training level or year
• •Professional designation and specialty
• •Medical licence or college registration number, where continuing professional development (“CPD”) or continuing medical education (“CME”) credit is requested
• •Address, including country and province or state of residence, which determine the jurisdiction applied to the Account holder's rights and notices and the address to which notices are sent
• •Time zone and interface preferences

3.2 Voice and audio information

When the voice-based simulation features (the “Voice Features”) are used, CaseMed collects and processes:

• •audio recordings of the Account holder’s spoken input during simulated clinical encounters;
• •transcripts generated from those recordings; and
• •data derived from those recordings and transcripts.

The Voice Features convert the Account holder's speech to text as they speak, and the transcript is kept. Audio is recorded and kept only where the Account holder has given the Data Processing Consent; otherwise speech is processed as it is spoken and is not stored. CaseMed does not record the voice of residents of Québec, Illinois, Texas or Washington.

3.3 Simulation, performance, and interaction information

• •Responses, questions, and clinical decisions expressed within a case
• •Investigations, imaging, and interventions selected within a case
• •Response times, navigation behaviour, and interaction patterns
• •Scores, rubric assessments, competency ratings, narrative feedback, and generated reports
• •Case assignments, attempts, completion status, and deadlines
• •Answers to questionnaires and tests attached to assignments, with their scores and results

Information in this section, together with the information described in section 3.2, constitutes “Platform Data” as that term is defined in the EULA and the Services Agreement.

3.4 Client Content

Administrators may upload the following on behalf of an Organization (together, "Client Content", as defined in the EULA and the Services Agreement):

• •Case Information — fictional or de-identified non-fictional medical and case information, and case templates; and
• •Assessment Materials — rubrics, scoring methods, objectives, and similar materials.

Under the Services Agreement, the Organization represents and warrants that all Client Content complies with applicable law; that any Client Content derived from real clinical encounters or patient records has been properly de-identified in accordance with applicable privacy and health-information legislation; and that all necessary consents, authorizations, and ethics approvals have been obtained.

CaseMed treats all Client Content as de-identified information. Separately, an Organization supplies CaseMed with Administrative Information: the names, email addresses, program, training level, and roster status of its End Users. Administrative Information is personal information, is not Client Content, and is handled in accordance with this Policy.

CaseMed handles Client Content in accordance with the safeguards described in section 10.

3.5 Payment and billing information

Payment card details are collected and processed by CaseMed’s payment processor. CaseMed does not receive or store full payment card numbers. CaseMed retains transaction records, the card brand and final four digits, billing name and address, and invoice history.

3.6 Technical and log information

• •IP address
• •Browser type and version, operating system, and device type
• •Audio device configuration
• •Pages and features accessed, timestamps, and referring URLs
• •Authentication events, session records, and security and audit logs
• •Error diagnostics and performance telemetry

3.7 Third-party information

The Platform presents simulated clinical scenarios only. No Account holder, Client, or other individual may speak, enter, or upload information identifying any other person, including but not limited to information identifying a real patient. Doing so is a violation of the agreements signed with CaseMed.

Where CaseMed becomes aware that information identifying another person has been submitted, CaseMed will isolate the affected record, remove the information from active systems, exclude it from any training corpus, record the matter in its incident register, and notify the Client and Account holder concerned so that they may meet any obligations of their own. CaseMed reserves the right to suspend an Account or terminate the Services where third-party information has been submitted, regardless of the reason for the submission. If CaseMed becomes aware that a recording contains the voice of a person other than the Account holder, it deletes that recording, audio and transcript, and excludes it from any training corpus.

4. VOICE INFORMATION

Without the Data Processing Consent, the Account holder's speech is converted to text as it is spoken and is not recorded; the transcript is used to run the session, produce the assessment and show the results, and is not used to train CaseMed's AI models.

With the Data Processing Consent, CaseMed also records the Account holder's spoken input ("Recordings"), and keeps Recordings, transcripts and Derived Data for as long as they are needed for quality assurance of CaseMed's assessment methods and to train, fine-tune, evaluate and commercialize its AI models, including related research, publications and marketing in which individuals are not identified, and then deletes or de-identifies them.

Residents of Québec, Illinois, Texas and Washington. CaseMed never records the voice of residents of Québec, Illinois, Texas or Washington, and does not use their transcripts, Derived Data or results to train its AI models, whatever choice is shown to them.

Speaker representations. To run a session or train a model, CaseMed's systems compute numerical representations of speech. Each exists only for the session or training run in which it arises, is never stored as a record of an individual or linked to an Account, and is not used to identify anyone.

CaseMed does not:

• •use speaker representations, or any other voice data, to identify or verify the identity of any individual. Identity on the Platform is established by Account credentials;
• •maintain an enrolment database of speaker representations against which recordings are compared or matched;
• •retain a persistent speaker representation for an Account holder, whether within or across sessions;
• •use speaker representations to link an Account holder across separate sessions or Accounts;
• •use speaker representations or voice data to develop voice-cloning, voice-synthesis, or voice-impersonation products for commercial sale or licensing;
• •use voice data to generate synthetic audio misrepresenting an Account holder’s voice; or
• •make employment, credentialing, licensure, certification, or disciplinary determinations about an Account holder, or provide voice data to any person for that purpose, beyond the reporting to Organizations and accrediting bodies described in sections 7.2 and 7.3.

CaseMed’s AI models are not designed or used to reconstruct, reproduce, or identify the voice of any individual.

Model training outputs. Deletion of Recordings does not reverse model training already carried out using them. Derived training outputs, including the parameters (weights) of CaseMed’s AI models, persist after the data from which they were derived has been deleted. Those outputs are not a record of any individual and are not used to reconstruct or identify an Account holder’s voice. Section 12.2 sets out the effect of this on deletion requests.

Voice Biometrics under the agreements. "Voice Biometrics" means a voiceprint, speaker template, or other persistent representation that could identify an individual by voice, as defined in the EULA and the Services Agreement. CaseMed does not derive, retain, or hold Voice Biometrics and does not sell, licence, or transfer them to anyone. Disclosure of voice recordings to service providers and to parties engaged to support model development is described in sections 7.1 and 7.4.

5. PURPOSES FOR WHICH INFORMATION IS USED

CaseMed uses personal information for the following purposes.

5.1 Provision of the Services

• •Creating, administering, and authenticating Accounts
• •Delivering simulation sessions
• •Generating scores, feedback, and reports
• •Making results available to the End User and, where applicable, the Administrator of the End User’s Organization
• •Administering assignments, deadlines, and completions, and issuing related notifications
• •Providing technical support and responding to enquiries

5.2 Security and integrity

• •Detecting, investigating, and preventing unauthorized access, account sharing, fraud, and misuse
• •Maintaining audit logs and monitoring for security incidents
• •Enforcing the EULA, the Services Agreement, and this Policy

5.3 Business operations

• •Processing payments, issuing invoices, and maintaining financial records
• •Reporting CPD and CME credit to accrediting bodies where credit has been requested
• •Meeting legal, tax, accounting, regulatory, and accreditation obligations

5.4 Product improvement and analytics

• •Diagnosing errors and monitoring performance, reliability, and availability
• •Analysing usage patterns to improve case design, assessment quality, and user experience

5.5 Research, development, and AI model training

CaseMed uses Recordings, transcripts, Derived Data, interaction data and evaluative outputs to train, fine-tune, evaluate and commercialize its AI models only where the Account holder has given the Data Processing Consent, and only as that Consent describes. An Account holder may withdraw it at any time by writing to privacy@casemed.app; from receipt no new Recordings are made and no later training run includes their data, and within 30 days CaseMed deletes the Recordings it holds. Withdrawal does not require the retraining of models already trained. Answers to questionnaires and tests are never used to train CaseMed's AI models.

As set out in the EULA and the Services Agreement, CaseMed owns the Platform, its AI models, and all De-identified Data, aggregate data, and Derived Data that cannot identify an individual, and may use them for any lawful purpose. Platform Data that is personal information relating to an Account holder is not owned by CaseMed: CaseMed holds and uses it, under the licence granted in the EULA, only for the purposes and periods stated in this Policy and in that Account holder's Data Processing Consent. The model-training purpose applies only where the Account holder has given the Data Processing Consent.

Where CaseMed publishes or presents research, the information used is aggregated, de-identified, or anonymized such that individuals are not identified.

5.6 Marketing communications

CaseMed sends marketing communications about its products, cases, and events only to individuals who have given express consent, for example by checking the marketing box at registration, which is unchecked by default. Each marketing message identifies CaseMed and includes an unsubscribe mechanism that takes effect within 10 business days. Administrative, service, and security notifications relating to an Account are not marketing communications and are sent for the duration of the Account. Where an Account is issued by an Organization, the End User also receives messages from that Organization’s Administrator through the Platform’s messaging system in connection with assignments, Account status, and related activities.

6. CONSENT

Consent is obtained during onboarding through three instruments:

• •the Services Agreement, accepted by the Client;
• •the EULA, accepted individually by each Account holder; and
• •the separate, optional Data Processing Consent, offered to each Account holder during onboarding.

The Data Processing Consent sets out whether the Account holder's voice is recorded, how Recordings, transcripts and Derived Data are used and kept, and how it is withdrawn.

Where a seat has been purchased by an Organization, the End User accepts the EULA and the Data Processing Consent themselves. An Organization cannot give these consents on an End User’s behalf.

Where an Account is issued by an Organization, the Organization and its Administrator are responsible for authorizing access and for notifying End Users, before Accounts are activated, that they must accept the EULA and that they will be offered the optional Data Processing Consent, which only they can give or decline.

Withdrawal. The Data Processing Consent may be withdrawn at any time as described in section 5.5; the Voice Features remain available without it. Consent to marketing communications may be withdrawn at any time using the unsubscribe mechanism in any marketing message or by contacting the Privacy Officer. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal, and does not extend to information CaseMed is required or permitted to retain under section 9 or applicable law.

7. DISCLOSURE OF PERSONAL INFORMATION

CaseMed does not disclose personal information for advertising purposes and does not disclose personal information to data brokers or advertising networks. Personal information may be disclosed in the following circumstances.

7.1 Service providers and processors

CaseMed engages service providers to perform functions on its behalf. These providers are bound by contract to process personal information only on CaseMed’s instructions and to maintain appropriate confidentiality and security safeguards.

CaseMed's current service providers are: Amazon Web Services, Inc. (United States, US East region) — hosting, database, file storage, transactional email, and hosted AI models (Amazon Bedrock), operated within AWS infrastructure; Cartesia AI, Inc. (United States) — text-to-speech for the simulated patient's voice, receiving text only and never the Account holder's audio; Stripe, Inc. (United States) — payment processing; and Microsoft Corporation — business email (Microsoft 365). CaseMed updates this list before a new service provider receives personal information.

Certain processing is performed by CaseMed on its own infrastructure and does not involve disclosure to a third party.

7.2 Organizations

Where an Account has been issued by an Organization, that Organization’s Administrators may access:

• •the End User’s name, email address, program, and training level;
• •cases assigned and the status, date, and number of attempts;
• •scores, rubric assessments, competency ratings, and feedback reports;
• •answers to questionnaires and tests attached to their assignments, with scores and results;
• •Session transcripts, unless the Organization has disabled transcript access; and
• •cohort-level analytics that may include the End User’s results.

Administrators do not have access to raw session audio.

Administrators may also contact End Users within their Organization through the Platform’s messaging system in connection with assignments, Account status, and related activities.

An Organization’s use of this information is governed by its own policies and by its Services Agreement with CaseMed.

Where the Client is an Individual Subscriber, no Administrator or other Account has access to that Account's performance data.

7.3 Accrediting and credentialing bodies

Where an Account holder requests CPD or CME credit, CaseMed submits to the relevant accrediting body the information required for the award of credit, which typically comprises the Account holder’s name, licence or member number, the activity completed, the date of completion, and the credits earned. Participation is reported only where credit has been requested.

7.4 Research and model development partners

CaseMed may disclose Platform Data, including audio recordings, transcripts, and Derived Data, to third parties engaged by CaseMed to support model development, fine-tuning, evaluation, annotation, or related research. Such disclosure is made only in respect of Account holders who have given the Data Processing Consent. Such parties act only as CaseMed's processors, on CaseMed's written instructions, are bound by contract to confidentiality and security obligations, and may not use the information for their own purposes. No Voice Biometrics are disclosed, because CaseMed creates none (section 4).

7.5 Legal and protective disclosures

CaseMed may disclose personal information where required or permitted by law, including in response to a court order, subpoena, warrant, or other lawful demand; to enforce its agreements; to investigate suspected fraud, misuse, or a security incident; or to protect the rights, property, or safety of any person.

7.6 Corporate transactions

In connection with a merger, acquisition, financing, reorganization, or sale of all or part of its business or assets, CaseMed may transfer personal information to the counterparty or its advisors, subject to appropriate confidentiality protections. The successor is bound by this Policy and by each Account holder's Data Processing Consent; any change is made only as section 14 and the Data Processing Consent provide.

8. INTERNATIONAL TRANSFER AND STORAGE

CaseMed is a Canadian corporation. Personal information collected through the Services, including audio recordings, transcripts, and performance data, is stored and processed on servers located in the United States and operated by the service providers identified in section 7.1. Under specific circumstances where a Services Agreement stipulates regional data processing and storage, the data will be handled and processed in the regions stipulated in that agreement.

While personal information is located in the United States, it is subject to the laws of that jurisdiction and may be accessible to United States courts, law enforcement agencies, regulators, and national security authorities in accordance with those laws. Those laws may differ from the laws of Canada or of an individual’s province, state, or country of residence.

CaseMed remains accountable for personal information transferred to a third party for processing and uses contractual and technical measures, including written data protection terms, encryption in transit and at rest, and access controls, to provide a comparable level of protection.

Before personal information relating to residents of Québec is communicated outside Québec, CaseMed conducts and documents a privacy impact assessment in accordance with section 17 of the Act respecting the protection of personal information in the private sector, and the transfer is governed by a written agreement reflecting that assessment.

Certain Organizations, including public bodies in Nova Scotia and British Columbia, are subject to requirements that personal information be stored and accessed only in Canada. CaseMed stores and processes personal information in the United States unless a separately negotiated Services Agreement provides for another region. Organizations subject to a data residency requirement should contact CaseMed before entering into a Services Agreement.

9. RETENTION

CaseMed retains personal information for as long as it is needed for the purposes described in this Policy, including after an Account is closed, and then deletes or de-identifies it. CaseMed may delete information it no longer needs at any time, at its discretion.

Recordings. Audio is recorded only where the Account holder has given the Data Processing Consent, and is kept as long as needed for the purposes in that Consent, then deleted or de-identified; it is deleted within 30 days of withdrawal. No audio is recorded for residents of Québec, Illinois, Texas or Washington. Copies in routine backups expire within 35 days of deletion.

Transcripts, Derived Data, and evaluative outputs. Transcripts, Derived Data, interaction data, and scores, rubric assessments, and reports are retained while the Account is open and afterwards for as long as CaseMed needs them: to provide the Services and maintain the Account holder's record of results; to meet legal, regulatory, tax and accreditation requirements, including for at least 6 years from the date of the session where CPD or CME credit has been claimed; and to establish or defend legal claims. Where the Account holder has given the Data Processing Consent, they are also retained for as long as needed for the purposes in that Consent, including the integrity of CaseMed's AI models and the reproducibility of its research. Without the Consent, they are never used to train, fine-tune or evaluate CaseMed's AI models. Where the Account was issued by a United States educational institution that elects deletion of its education records when its agreement with CaseMed ends, these records are deleted with them (De-identified Data excepted); Recordings follow the paragraph above.

Derived measures. Measures computed from session audio that cannot be used to reconstruct the audio and are not capable of distinguishing one speaker from another are retained indefinitely where they have been anonymized such that no individual can be identified, directly or indirectly.

Client Content. Where a Services Agreement expires or is terminated, the Client may elect within 30 days to have Client Content returned in a commercially reasonable format or deleted from CaseMed’s active production systems. Copies residing in routine backup systems are deleted as those backups expire in the ordinary course, currently within 35 days.

Other categories. Account and profile information, payment and billing records, records of consent, opt-out and jurisdiction, support correspondence, and security and audit logs are retained on the same basis; payment and billing records for at least the period required by tax and corporate record-keeping law. Copies in routine backups expire within 35 days. Transient speaker representations (section 4) are destroyed at the end of the session or training run in which they arise.

Information that has been aggregated or anonymized such that no individual can be identified, directly or indirectly, is not personal information and may be retained indefinitely.

10. SECURITY

10.1 Safeguards

CaseMed maintains administrative, technical, and physical safeguards designed to protect personal information against loss and unauthorized access, use, disclosure, alteration, or destruction. These include:

• •Encryption of personal information in transit and at rest
• •Role-based access controls, with access limited to personnel whose role requires it
• •Two-step sign-in (multi-factor authentication) required for CaseMed's administrative access and for every Account holder before starting a voice session
• •Audit logging of access to Accounts, session data, and Client Content
• •Network and system access controls
• •Periodic security reviews and vulnerability management
• •Documented incident detection and response procedures
• •Confidentiality obligations for personnel and contractors

No method of transmission or storage is entirely secure, and CaseMed does not warrant that personal information will not be subject to unauthorized access.

10.2 Certification status

CaseMed is building its control environment against the AICPA Trust Services Criteria for Security, Availability, and Confidentiality. CaseMed does not currently hold a SOC 2 report. If and when a report is issued, it will be made available to Clients and prospective Clients under a non-disclosure agreement and this section will be updated.

10.3 Incident notification

Where a confidentiality or security incident creates a real risk of significant harm, or a risk of serious injury under applicable Québec legislation, CaseMed will notify affected individuals and the Office of the Privacy Commissioner of Canada and, in respect of Québec residents, the Commission d’accès à l’information du Québec, as soon as feasible, and will notify affected Clients in accordance with their Services Agreements. CaseMed maintains a register of confidentiality incidents whether or not notification is required.

11. AUTOMATED PROCESSING AND ASSESSMENT

Scores, competency ratings, and feedback reports generated by the Platform are produced by automated systems, using the Account holder's session information and the case's assessment criteria, except where those criteria are supplied by an Organization, in which case they are subject to that Organization's own processes.

Assessment is based on the Account holder’s clinical performance and communication within the case. An Account holder may request information regarding the personal information used to produce a particular assessment by contacting CaseMed. CaseMed informs the Account holder that a score was produced by automated processing. On request, CaseMed will inform the Account holder of the personal information used to produce the assessment and of the reasons and principal factors and parameters that led to it, and will correct inaccurate personal information. An Account holder may submit observations to a member of CaseMed's personnel who is able to review the assessment, by writing to privacy@casemed.app; CaseMed responds within 30 days.

Automated systems are subject to error, and performance may vary across accents, dialects, speech patterns, and first languages. CaseMed cannot guarantee deterministic outcomes for AI-generated responses under real use conditions at all times.

As stated in the EULA and the Services Agreement, the Services are intended for educational and professional development purposes. Assessments generated by the Platform do not constitute medical advice. Where an activity is specifically identified as accredited, completion may be reported for continuing professional development or continuing medical education credit as described in section 7.3. Except where an activity is so identified, assessments generated by the Platform are not a licensure, credentialing, certification, or fitness-to-practise determination.

Enquiries regarding an assessment, and requests to access or correct personal information used in an assessment, may be directed to CaseMed at https://casemed.app/contact or to the Privacy Officer.

12. ACCESS, CORRECTION, AND OTHER RIGHTS

12.1 General

Subject to applicable law, an individual may:

• •request access to the personal information CaseMed holds about them, and information regarding its use and disclosure;
• •request correction of personal information that is inaccurate or incomplete;
• •withdraw consent, as described in section 6; and
• •request deletion of personal information, which CaseMed will action except where retention is required or permitted under section 9, the EULA, the Services Agreement, or applicable law. Section 12.2 sets out what a deletion request covers and what it does not.

Requests should be directed to the Privacy Officer. CaseMed may require verification of identity before acting on a request. CaseMed does not charge a fee for access requests.

12.2 Scope and limits of deletion requests

A request for deletion is actioned against the personal information CaseMed holds at the time the request is received. It extends to:

• •Recordings;
• •transcripts, Derived Data, interaction data, and evaluative outputs;
• •Account and profile information; and
• •Administrative Information relating to the individual,

except where CaseMed is required or permitted by law, or by section 9, to retain the information.

A request for deletion does not extend to:

• •information that has already been deleted in the ordinary course under section 9;
• •derived training outputs, including the parameters (weights) of AI models trained before the request is actioned. As described in section 4, those parameters are not a record of any individual, are not attributable to any single Account holder, and are not used to reconstruct or identify any individual’s voice; or
• •aggregated, de-identified, or anonymized information that can no longer be attributed to an individual.

CaseMed does not retrain, roll back, or withdraw an AI model, or delete a model’s parameters, in response to a deletion request or a withdrawal of the Data Processing Consent under section 5.5. Deletion and withdrawal operate prospectively from the date the request is actioned.

CaseMed’s AI models are developed incrementally, each version building on versions that preceded it. The influence of data used in earlier training cannot be isolated within, or removed from, later versions. Exclusion under section 5.5 therefore applies to training carried out after a request is actioned, and does not reverse the effect of training already completed.

Nothing in this section limits a right that applicable privacy legislation confers on an individual and that cannot be limited by agreement.

12.3 Québec residents

In addition to section 12.1, residents of Québec may request that computerized personal information they have provided to CaseMed be communicated to them, or to a designated third party, in a structured, commonly used technological format. This right applies to information collected from the individual and does not extend to information created or inferred by CaseMed, including assessments and evaluative outputs. Residents of Québec may also exercise the rights provided under section 28.1 of the Act respecting the protection of personal information in the private sector.

12.4 United States residents

CaseMed does not record the voice of residents of Illinois, Texas or Washington (section 4). Residents of Colorado are entitled to the notice in section 4 and may contact the Privacy Officer regarding the personal information CaseMed holds. Residents of Washington may request confirmation as to whether CaseMed collects or shares consumer health data, and may request deletion of such data.

The rights described in section 12.1 are available to all Account holders and are exercised by contacting the Privacy Officer. Where an Account was issued by an Organization, CaseMed may coordinate its response with the Organization and responds within 30 days; section 12.5 applies to students of United States educational institutions. Nothing in this section limits any right an individual has under applicable privacy legislation.

12.5 Students of United States educational institutions

Where an Organization is a United States educational institution and CaseMed maintains education records on its behalf, CaseMed acts as a school official with a legitimate educational interest under the Family Educational Rights and Privacy Act, 34 CFR §99.31(a)(1)(i)(B), under the direct control of that Organization with respect to the use and maintenance of those records and subject to the redisclosure limitations of 34 CFR §99.33(a). Rights of access and correction under that Act are exercised through the Organization.

12.6 Complaints

Complaints should first be directed to the Privacy Officer. An individual who is not satisfied with CaseMed's response may contact the privacy regulatory authority of their province, state, or country of residence.

13. COOKIES AND SIMILAR TECHNOLOGIES

CaseMed uses cookies and similar technologies for the following purposes:

• •Strictly necessary — authentication, session management, security, and load balancing. These are required for the Platform to function.
• •Functional — retaining user preferences, including language and interface settings.
• •Analytics — CaseMed does not use third-party analytics, advertising, or session-replay technologies.

Cookies may be managed through browser settings. Disabling strictly necessary cookies will prevent sign-in.

14. AMENDMENTS

CaseMed may amend this Policy from time to time. The revised Policy will be posted at https://casemed.app/privacy with an updated "Last updated" date and will take effect upon posting. Where an amendment is material, CaseMed will provide notice by email or by other means it considers appropriate given the nature of the change; where an amendment would expand the purposes for which voice data is used or extend a retention period, it takes effect for an Account holder only on their fresh consent through the Data Processing Consent. Continued use of the Services following notice constitutes acceptance of the amended Policy.

15. CONTACT

CaseMed Inc. 600-1741 Lower Water Street, P.O. Box 997, Halifax, Nova Scotia B3J 0J2 privacy@casemed.app +1 902 702 3755

CaseMed has designated a Privacy Officer, who may be contacted at privacy@casemed.app.

General enquiries may be directed to CaseMed at https://casemed.app/contact.

This Policy should be read together with the CaseMed End User Licence Agreement and the CaseMed Services and Licensing Agreement.