AI Data Processing Policy

1. PURPOSE AND SCOPE

This policy explains how IVONNE, Inc. ("IVONNE") uses artificial intelligence ("AI") to process client communications and data, which AI providers are involved, and how clients can exercise their rights under the Personal Information Protection and Electronic Documents Act (PIPEDA) and the Personal Health Information Protection Act (PHIPA).

This policy supplements our Privacy Policy and should be read alongside it. In the event of a conflict, the Privacy Policy governs.

2. PRINCIPLES

Our use of AI is guided by PIPEDA's 10 Fair Information Principles and the following commitments:

• Accountability: IVONNE is responsible for personal information processed by our AI technology partners. Their use of your data is governed by written agreements and this policy.
• Purpose limitation: AI is used only for the specific purposes described in this policy. Your data is never used for purposes beyond what is disclosed here without your consent.
• Consent: Where AI processing is optional, we obtain your consent and provide meaningful controls to withdraw it at any time.
• Data minimization: Only the minimum data necessary for the specific task is shared with AI providers. We do not send passwords, payment information, or unnecessary personal details.
• Transparency: This policy discloses which providers process your data, for what purpose, and where that processing occurs.

3. HOW WE USE AI

We use AI to support our operations in the following ways:

• Message classification: Understanding the intent of messages you send us (e.g., confirming, cancelling, or rescheduling an appointment) so we can respond faster.
• Writing assistance: Helping our team draft and refine responses to your inquiries for clarity and accuracy.
• Call handling: An AI voice concierge may assist with appointment rescheduling when you call the clinic.
• Transcription: Transcribing voicemail, call recordings, and appointment recordings to improve care documentation.
• Clinical notes: Summarizing consultation notes for your care provider.

The majority of our data processing — including scheduling, reminders, status updates, and notifications — is handled by deterministic systems that do not involve AI. These systems follow fixed rules and do not learn from or analyze the content of your communications.

4. AI TECHNOLOGY PARTNERS

When AI processing is used, your data may be processed by one or more of the following providers:

5. CROSS-BORDER TRANSFERS

Our AI technology partners process data on servers located in the United States. Under PIPEDA, organizations may transfer personal information to service providers in other jurisdictions provided that comparable protections are in place. We ensure comparable protection through:

• Written agreements with each provider that restrict the use of your data to the specific services we have engaged them for.
• Provider API terms that prohibit the use of your data for model training.
• Technical controls including encryption in transit (TLS) and at rest.
• Data retention limits — providers retain data only for the minimum period required for abuse monitoring (typically 7–55 days), after which it is deleted.

By using our services and consenting to AI processing, you acknowledge that your personal information may be processed in the United States, where it may be subject to the laws of that jurisdiction, including the possibility of access by law enforcement authorities under applicable U.S. law.

6. DATA AND MODEL TRAINING

None of our AI technology partners use your data to train their AI models. Data submitted through their APIs is processed under terms that prohibit the use of inputs and outputs for model improvement by default. We do not opt in to any voluntary data sharing or model training programs offered by these providers.

7. YOUR CONTROLS

In accordance with PIPEDA Principle 4.3 (Consent), you have the following controls over how AI is used to process your data:

• Channel preferences: You can enable or disable AI processing of your email and SMS communications independently (inbound and outbound) through your account settings.
• Provider exclusions: You can exclude specific AI providers from processing your data. If you exclude a provider, your data will only be processed by the remaining permitted providers.
• Appointment recording: You can choose whether your appointments may be recorded and/or transcribed using AI through your account settings.
• Interest-based marketing: You can opt out of personalized marketing based on your activity and preferences through your account settings or by adjusting your cookie preferences.
• Withdrawal of consent: You may withdraw consent for AI processing at any time by updating your preferences. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal, and may affect our ability to respond to your communications as quickly.

8. TELEPHONE CALLS

All telephone calls to and from our clinic are recorded and transcribed using AI for quality assurance, service improvement, and care documentation. In accordance with Ontario's one-party consent framework under section 184(2)(a) of the Criminal Code, IVONNE records calls as a party to the conversation. Callers are notified of recording at the start of each call.

Call recording and AI transcription are integral to our telephone service and cannot be disabled on a per-client basis. If you prefer to communicate without call recording, you may contact us through the client portal or by email.

9. SAFETY FILTERING

Independently of your marketing preferences, we use automated systems to filter treatments, products, and services based on your health profile and known contraindications. This is a safety measure required under our duty of care and cannot be disabled. Safety filtering does not involve sharing your data with third-party AI providers.

10. COOKIE CONSENT AND MARKETING PREFERENCES

Our website uses a cookie consent system that allows you to control marketing and personalization cookies. If you disable marketing cookies, interest-based advertising will be suppressed during your browsing session.

If you later log in to your client account and have not yet set an explicit marketing preference, your cookie choice will be used as the initial default. Your explicit account settings always take precedence over cookie preferences and will not be overwritten.

11. PROTECTED HEALTH INFORMATION

Where AI processes information that constitutes personal health information under PHIPA — including clinical notes, treatment records, and health-related communications — the same protections described in this policy apply. Additionally:

• Health information is only processed by AI when there is a direct clinical or operational purpose (e.g., transcribing a consultation for your care record).
• AI providers do not have access to your complete health record — only the specific content required for the task.
• Clinical records, including AI-generated transcriptions, are retained in accordance with PHIPA's 10-year minimum retention requirement.

12. BREACH NOTIFICATION

In the event of a breach of security safeguards involving personal information processed by an AI technology partner, IVONNE will notify affected individuals and the Office of the Privacy Commissioner of Canada in accordance with PIPEDA's breach notification requirements (Division 1.1). We maintain incident response procedures that include our AI technology partners.

13. ACCESS AND CORRECTION

Under PIPEDA Principle 4.9 (Individual Access), you have the right to request access to any personal information we hold about you, including information processed by AI. You may also request correction of inaccurate information. Requests can be submitted through the client portal or using the contact information in our Privacy Policy.

14. CHANGES TO THIS POLICY

We may update this policy periodically to reflect changes in our AI usage, technology partners, or applicable regulations. Material changes will be communicated through our website or client portal. The effective date below reflects the most recent update.

15. CONTACT

If you have questions about our use of AI or wish to exercise your privacy rights, please contact us through the client portal or at the contact information provided in our Privacy Policy.

Effective date: May 5, 2026

Contact Information About This Policy

For any questions or complaints in relation to this agreement or any product or treatment you purchase, you may contact IVONNE at the following:

By Regular Mail:
IVONNE, Inc.
0116-320 Queen Street, Ottawa ON K1R 5A3

By Email:
legal@ivonne.ca

By Phone:
(613) 695-6662

By Social Media:
@ivonneclinic