Custodians, information managers and the HIA
The clinic and its physicians remain the custodians of health information; Arxeon is the clinic's information manager under section 66 of Alberta's HIA (and, for H-Link claims, an affiliate of the custodian) under the Information Manager Agreement in Schedule A — handling health information only to provide the service or on the clinic's instructions, never selling it, never using it for advertising or to train AI, keeping the safeguards listed there, notifying confirmed breaches within 72 hours, supporting the clinic's PIA, and returning or destroying data on exit.
2705
The roles
- Custodian: the clinic and its physicians. Nothing transfers custody or control of health information to Arxeon.
- Information manager: Arxeon, designated under HIA section 66, on the terms of Schedule A of the Subscriber Agreement (the IMA).
- Affiliate: Arxeon, when it submits the clinic's AHCIP claims as an accredited H-Link submitter.
Permitted handling — and nothing more
Arxeon collects, uses and discloses health information only as necessary to provide, secure, support and maintain the services, on the clinic's documented instructions, or as required by law (with notice to the clinic unless prohibited). It will not sell health information, use it for advertising, use it to train AI models, or use it for its own purposes — aggregated or de-identified information for operating and improving the service is the one exception. AI providers are contractually prohibited from training on content.
Safeguards
Encryption in transit and at rest; role-based access and unique named accounts; audit logging of security-relevant events; segregated environments and vulnerability management; personnel confidentiality obligations and training; physical security through the hosting provider's certified data centres; routine encrypted backups and documented recovery.
Breaches and requests
Confirmed unauthorized access, loss or disclosure of the clinic's health information is notified without unreasonable delay and within 72 hours of confirming it, with what is known, what was contained and what is recommended, supporting the clinic's own duties under HIA section 60.1. An individual's access or correction request received by Arxeon is referred to the clinic within 5 business days. Compelled disclosures are limited to what is legally required, with notice to the clinic first unless prohibited.
Your PIA, and verification
The clinic prepares and submits any required privacy impact assessment to the OIPC before implementing the service; on request Arxeon provides reasonable documentation about the architecture, safeguards and subprocessors to support it. Once a year (absent an incident) the clinic may request a summary of controls, available third-party attestations for the hosting provider, and answers to a reasonable security questionnaire.
On exit
Export for 60 days; deletion from active systems within 90 days; encrypted backups overwritten within a further 35 days; written confirmation of destruction on request. Schedule A survives for as long as Arxeon has custody of any health information.
Where to look