Qlynic Legal

Subscriber Agreement

1.Parties, formation & scope

1. This Subscriber Agreement (the “Agreement”) is between Arxeon Inc., 2705 225 11 Ave SE, Calgary, Alberta T2G 0G3 (“Arxeon”), operator of the Qlynic platform, and the clinic or practitioner identified in the Qlynic account (the “Clinic”).
2. The Agreement is formed when the Clinic’s authorized representative accepts it electronically during clinic setup (or otherwise in writing), or on the Clinic’s first use of the Services, whichever occurs first. Acceptance is recorded with the accepting account, date, and time, and the Clinic may request a copy of its acceptance record at any time. The parties agree that electronic acceptance is valid and enforceable under Alberta’s Electronic Transactions Act.
3. The person accepting represents that they are authorized to bind the Clinic and, where the Clinic is a Custodian, that they are (or act with the authority of) the Custodian.
4. The Agreement incorporates by reference the Terms of Service, the Clinic’s Order, the Privacy Policy, and, where applicable, the AHCIP Billing Terms. If documents conflict, precedence is: (1) this Agreement (Schedule A first), (2) AHCIP Billing Terms, (3) Terms of Service, (4) other policies.

2.Definitions

Capitalized terms not defined here have the meanings in the Terms of Service. In this Agreement:

HIA

Alberta’s Health Information Act, RSA 2000, c H-5, and its regulations, as amended.

Custodian, Affiliate, Health Information, Information Manager

Have the meanings given in the HIA.

IMA

The Information Manager Agreement set out in Schedule A.

Personnel

Arxeon’s employees and contractors who act under Arxeon’s direction.

Subprocessor

A third-party service provider engaged by Arxeon to help deliver the Services, listed in Schedule B.

3.Roles under the HIA

1. The Clinic and its physicians are and remain the Custodians of Health Information processed through the Services. Nothing in this Agreement transfers custody or control of Health Information to Arxeon.
2. The Clinic designates Arxeon, and Arxeon agrees to act, as the Clinic’s Information Manager within the meaning of section 66 of the HIA, on the terms of the IMA in Schedule A.
3. Where the Clinic uses electronic claims submission, Arxeon also acts as an accredited H-Link submitter and, in that capacity, as an Affiliate of the Custodian under the HIA, subject to the AHCIP Billing Terms and Schedule A.
4. Under the HIA, Custodians are responsible for oversight of their affiliates. The Clinic will exercise that oversight through this Agreement, the reports and documentation Arxeon provides, and its own internal policies.

4.Clinic responsibilities

1. Designate and maintain an account owner authorized to administer the subscription, manage Authorized Users and their roles, and promptly deactivate users who leave the Clinic or no longer require access.
2. Ensure information entered into the Platform is collected with lawful authority under the HIA, is accurate to the best of the Clinic’s knowledge, and is used by its Authorized Users only for authorized purposes.
3. Maintain the privacy policies, training, and administrative practices the HIA and the Clinic’s regulatory college require of Custodians, including preparing and submitting any required privacy impact assessment (PIA) to the Office of the Information and Privacy Commissioner of Alberta before implementing the Services in practice. On request, Arxeon will provide reasonable documentation about the Platform’s architecture, safeguards, and Subprocessors to support the Clinic’s PIA.
4. Obtain any patient consents the Clinic’s use of features requires (for example, communications preferences, telehealth, or the patient portal), and honour withdrawals of consent.
5. Use the export tools and its own procedures to satisfy the Clinic’s records-retention obligations, which remain the Clinic’s.
6. AI outputs are assistive only. Ensure that a qualified member of the Clinic reviews every AI-generated output — drafted notes, summaries, suggested medications, and suggested diagnostic or service codes — before it is relied on, saved to a record, prescribed, or submitted. The Clinic is solely responsible for all clinical content and decisions, however drafted.
7. Ambient Scribe consent. Before using the Ambient Scribe in any encounter, obtain the informed consent of the patient (or their authorized representative) to AI-assisted transcription of that visit, record the attestation the Platform prompts for, and honour any withdrawal or standing do-not-record preference. Recording without valid consent is prohibited and is the Clinic’s sole responsibility. Schedule C governs the feature in detail.
8. AHCIP claim accuracy. Bear sole responsibility for the accuracy, completeness, and supportability of every claim submitted through the Platform — including codes suggested by any AI feature, which are drafting aids until the submitting practitioner confirms them — and reconcile Assessments, refusals, and remittances as the AHCIP Billing Terms require.

5.Arxeon responsibilities

1. Provide the Services with reasonable skill and care, substantially as described in the Terms and in-app documentation.
2. Handle Health Information only as the Clinic’s Information Manager under Schedule A, and personal information in accordance with the Privacy Policy.
3. Maintain the safeguards described in Schedule A, manage Subprocessors under Schedule B, and notify the Clinic of privacy or security breaches as Schedule A provides.
4. Provide support to the Clinic as described in the Terms.

6.Fees

Fees, billing, taxes, Credits, and cancellation are governed by the Clinic’s Order and Sections 6–7 of the Terms of Service. This Agreement adds no separate fees.

7.Term & termination

1. This Agreement starts on formation (Section 1) and continues for as long as the Clinic maintains a Qlynic subscription, unless terminated earlier under the Terms.
2. Suspension, termination, and the 60-day data export window are governed by Section 15 of the Terms.
3. Survival. Schedule A survives termination for as long as Arxeon has custody of, or access to, any Health Information of the Clinic, together with Sections 8–9 and any provision that by its nature should survive.

8.Liability & indemnity

The disclaimers, limitation of liability (including the 12-month fee cap), and indemnities in Sections 16–18 of the Terms of Service apply equally to this Agreement and Schedule A, and state each party’s entire liability in connection with them, to the maximum extent permitted by law. Nothing in this Section limits either party’s statutory obligations under the HIA.

9.General

1. Amendments. Arxeon may amend this Agreement as Section 19 of the Terms provides (at least 30 days’ notice for material changes). Material amendments to Schedule A will additionally be highlighted in the notice.
2. Notices, assignment, force majeure, severability, interpretation, governing law and jurisdiction are as set out in Sections 20–21 of the Terms (Alberta law; courts of Alberta sitting in Calgary).
3. Contact. Arxeon Inc., 2705 225 11 Ave SE, Calgary, Alberta T2G 0G3 · legal@qlynic.com.
4. Independent parties. The parties are independent contractors. Nothing here creates a partnership, joint venture, or employment relationship, or authorizes either party to bind the other except as this Agreement expressly provides.

Schedule A.Information Manager Agreement (HIA s.66)

A1. Designation and purpose

1. The Clinic (as Custodian) designates Arxeon as its Information Manager pursuant to section 66 of the HIA, and Arxeon accepts the designation, for the purpose of providing the Services — including processing, storing, retrieving, transmitting, backing up, and disposing of Health Information, and providing information management and information technology services relating to it.
2. This Schedule constitutes the agreement contemplated by section 66(2) of the HIA and is intended to satisfy the requirements for information manager agreements under the HIA and its regulations.
3. In accordance with section 66(5) of the HIA, Arxeon will comply with the HIA and its regulations, and with this Schedule, in respect of Health Information it handles for the Clinic.

A2. Permitted handling — and nothing more

1. Arxeon will collect, use, and disclose Health Information only: (i) as necessary to provide, secure, support, and maintain the Services for the Clinic; (ii) on the Clinic’s documented instructions given through the Platform or in writing; (iii) as required by law, in which case Arxeon will notify the Clinic before disclosure unless the law prohibits it; or (iv) as this Schedule expressly permits.
2. Arxeon will not sell Health Information, use it for advertising, use it to train artificial-intelligence models, or use or disclose it for Arxeon’s own purposes — except that Arxeon may create and use non-identifying (aggregated or de-identified) information for operating, securing, planning, and improving the Services, in a manner consistent with the HIA.
3. Where the Clinic uses AI-assisted features, Health Information contained in the content the Clinic submits to those features is processed by Arxeon’s contracted AI provider solely to return the requested output to the Clinic, subject to Schedule B and clause A4(d). AI providers are contractually prohibited from using that content to train their models.

A3. Safeguards

Arxeon will maintain administrative, physical, and technical safeguards that are reasonable and appropriate to protect the confidentiality, integrity, and availability of Health Information, consistent with section 60 of the HIA, including:

1. Encryption of Health Information in transit (TLS) and at rest;
2. Access control: role-based permissions, unique named accounts, authentication protections (including two-factor authentication where offered), and the principle of least privilege for Personnel;
3. Audit logging of security-relevant events and administrative access;
4. Network and application security: segregation of environments, vulnerability management, and edge protections;
5. Personnel measures: confidentiality obligations binding all Personnel, privacy and security training, and access limited to those who need it to perform their duties;
6. Physical security for hosting infrastructure through the certified data centres of the hosting Subprocessor identified in Schedule B;
7. Resilience: routine encrypted backups and documented recovery procedures.

A4. Data residency and cross-border processing

1. Health Information stored by the Platform is hosted in Microsoft Azure’s Canadian regions (Canada Central), including backups.
2. Content-delivery and security services may route encrypted traffic through international network points in transit.
3. Message delivery providers (SMS and email) process message content and recipient contact details, which may occur outside Canada, as required to deliver the message.
4. AI processing: content submitted to AI-assisted features is processed by the AI Subprocessor identified in Schedule B, which may occur in the United States, under a data processing agreement that prohibits training on the content and minimizes retention. The Clinic authorizes this processing each time it chooses to use an AI-assisted feature, and can avoid it entirely by not using those features.
5. Arxeon will not otherwise store Health Information outside Canada without the Clinic’s prior written authorization.

A5. Subprocessors

1. The Clinic authorizes the Subprocessors listed in Schedule B. Arxeon will bind each Subprocessor that handles Health Information to obligations materially as protective as this Schedule.
2. Arxeon will update Schedule B and give the Clinic at least 30 days’ notice (by email or in-app) before a new Subprocessor handles Health Information. If the Clinic reasonably objects on privacy grounds and Arxeon cannot offer an alternative, the Clinic may terminate the affected Services and receive a pro-rata refund of prepaid, unused fees for them.
3. Arxeon remains responsible to the Clinic for its Subprocessors’ handling of Health Information.

A6. Breach reporting and incident response

1. The notice will describe, to the extent known: the nature of the incident, the information and individuals affected, the steps taken to contain it, and recommended measures. Arxeon will supplement the notice as its investigation progresses.
2. Arxeon will investigate, contain, and remediate incidents, preserve relevant evidence, and reasonably cooperate with the Clinic so the Clinic can meet its own duties under section 60.1 of the HIA (notification of the Commissioner, the Minister, and affected individuals where there is a risk of harm). Statutory breach-notification duties of a Custodian remain the Clinic’s.
3. Arxeon will not make public statements identifying the Clinic in connection with an incident without the Clinic’s consent, except as required by law.

A7. Individual rights, the Commissioner, and requests

1. If Arxeon receives a request from an individual to access or correct Health Information, it will refer the request to the Clinic within 5 business days and will not respond substantively on the Clinic’s behalf unless instructed.
2. Arxeon will reasonably assist the Clinic in responding to access and correction requests, and to inquiries, investigations, or orders of the Information and Privacy Commissioner of Alberta, and will notify the Clinic promptly of any such inquiry or order concerning the Clinic’s Health Information unless prohibited by law.
3. If a court, tribunal, or authority compels disclosure of the Clinic’s Health Information, Arxeon will disclose only what is legally required and, unless prohibited, will notify the Clinic first so it may seek protective measures.

A8. Retention, return, and destruction

1. Arxeon will retain Health Information only as long as necessary to provide the Services, plus the wind-down periods below, and any period required by law.
2. On termination or expiry of the subscription: the Clinic may export its Customer Data for 60 days (Terms, Section 15). Thereafter Arxeon will delete Health Information from active systems within 90 days, with encrypted backups overwritten in the ordinary backup cycle (not exceeding 35 further days), except where a legal hold or statutory requirement applies.
3. On the Clinic’s written request, Arxeon will confirm destruction in writing.
4. Records-retention obligations of Custodians (including college requirements) remain the Clinic’s; the export window exists so the Clinic can meet them.

A9. Verification

1. On the Clinic’s reasonable written request (no more than once per year, absent an incident), Arxeon will provide a summary of its security and privacy controls, relevant available third-party attestations for its hosting Subprocessor, and answers to a reasonable security questionnaire, sufficient for the Clinic’s HIA oversight and PIA obligations.
2. Nothing in this Schedule requires Arxeon to disclose information that would compromise the security of the Platform or other clinics.

A10. Priority and survival

1. If this Schedule conflicts with any other document between the parties regarding Health Information, this Schedule prevails.
2. This Schedule survives termination of the Agreement for as long as Arxeon has custody of, or access to, the Clinic’s Health Information.

Schedule B.Subprocessors & data locations

Current as of the effective date above. Section A5 governs changes to this list.

Provider	Role	Processing location	Data touched
Microsoft Azure	Cloud hosting, storage, backups (all Qlynic portals)	Canada (Canada Central region)	All Customer Data, including Health Information (encrypted at rest)
Microsoft Azure AI Speech	Real-time speech-to-text for the Ambient Scribe	Canada (Canada Central region)	Encounter audio, processed in real time to text only; configured so that audio is not retained by the service and is never stored by Arxeon
Cloudflare	Network security, DDoS protection, content delivery	Global network (encrypted transit)	Traffic metadata; encrypted content in transit
Stripe	Payment processing and tax calculation	Canada / United States	Billing contact, address, payment details. No Health Information.
Twilio	SMS delivery and phone-number verification	United States / carrier networks	Phone numbers and SMS content the Clinic or the platform sends
Twilio SendGrid	Email delivery	United States	Email addresses and message content
Anthropic	AI processing for AI-assisted features (drafting of clinical notes and summaries, coding and medication suggestions)	United States	Content submitted to AI features, only when used — including scribe transcripts and encounter context for note drafting; no model training; minimized retention under a data processing agreement
Daily.co	Live video and audio transport for telehealth visits	United States / global media edge	Real-time call media between patient and clinician, encrypted in transit. No Health Information is stored by this Subprocessor and calls are not recorded.
MaxMind	IP geolocation for security features	Local database lookup (no data sent)	IP addresses only. No Health Information.

Schedule C.AI-assisted features & the Ambient Scribe

This Schedule governs the Platform’s AI-assisted features, and in particular the Ambient Scribe — real-time transcription of a clinical encounter and AI drafting of the visit note. It forms part of this Agreement; where it concerns the handling of Health Information, Schedule A prevails to the extent of any conflict.

C1. Consent before recording

1. The Clinic must obtain the informed, contemporaneous consent of the patient (or their authorized representative, including a parent or guardian for minors) before the Ambient Scribe is started for an encounter, and must record the attestation the Platform prompts for. The Platform logs who attested and when, for each session, as the Clinic’s record.
2. Consent may be withdrawn at any time; on withdrawal the recording must be stopped. The Clinic is responsible for its personnel’s compliance.
3. The Platform honours a standing do-not-record preference on a patient’s record: while set, scribe sessions cannot be started for that patient anywhere on the Platform. The Clinic must apply the preference on a patient’s request.
4. Recording without valid consent is prohibited. As between the parties, responsibility for any recording made without the consent this Schedule and applicable law require rests solely with the Clinic, and the indemnity in Section 18 of the Terms applies.

C2. Audio & transcript handling

1. During a session, microphone audio streams from the provider’s browser directly to Microsoft Azure AI Speech in the Canada Central region, where it is converted to text in real time. Silence detection on the device limits streaming to voiced audio.
2. Audio is not recorded. Arxeon does not receive, record, or store encounter audio, and the speech service is configured so that audio is not retained after transcription. What exists after a session is text, not sound.
3. The transcript exists transiently for the purpose of drafting the note and is not stored by Arxeon as a server-side record. Arxeon retains only the session’s operational metadata: the consent attestation (who and when), duration, and character/token metrics used for quality and billing.
4. Note drafting is performed by Arxeon’s contracted AI provider under Schedule B, with model training prohibited and retention minimized.

C3. Drafts & professional responsibility

1. Every AI-drafted note, summary, or suggestion is a draft until a qualified member of the Clinic reviews it and saves it through the Clinic’s normal record workflow. The Platform does not save AI drafts to the patient record automatically.
2. Drafts may flag uncertain content for verification; the absence of a flag is not an assurance of accuracy. Section 5 of the Terms (medical & professional responsibility) applies in full.

C4. Metering & fees

1. The Ambient Scribe is an add-on priced per enrolled provider, with included scribe minutes each monthly allowance cycle. Minutes are metered on voiced audio streamed for transcription, rounded up per session.
2. Usage beyond the included minutes accrues as overage and is billed under Section 7 of the Terms (monthly in arrears, charged automatically). The Platform’s session and metering records are authoritative absent manifest error.

C5. Clinic representations

The Clinic represents and warrants, each time the Ambient Scribe is used, that: it has lawful authority to collect the information; the consent required by C1 and applicable law has been obtained and documented; its privacy impact assessment covers ambient documentation to the extent required; its personnel are trained on this Schedule; and it will not use the feature where recording is prohibited by law, court order, or the direction of the patient.

C6. Suspension of the feature

Arxeon may suspend the Ambient Scribe for a Clinic, without suspending the wider Services, where Arxeon reasonably believes it is being used without consent, contrary to this Schedule, or in a way that creates legal risk — in addition to the usage-based suspensions in Section 7 of the Terms.

Schedule D.Clinic website & minor enhancements

Arxeon offers two things to subscribing clinics that are not part of the Platform itself: a clinic website, and minor enhancements to Qlynic requested by the Clinic. Both are offered in good faith at no additional charge. This Schedule sets out what they are, so that neither side is relying on a conversation.

D1. The clinic website

1. Where the Clinic subscribes to Qlynic, Arxeon will design and build a public website for the Clinic at no additional charge, and connect it to the Clinic’s Qlynic online booking.
2. The offer covers a standard informational site — typically pages such as home, services, practitioners, contact and hours, together with booking integration. It does not include e-commerce, patient-facing portals other than Qlynic’s own, custom application development, content written for regulated advertising, translation, photography, or ongoing marketing services.
3. The Clinic supplies its content, logo and practitioner information, and is responsible for the accuracy of that content and for its compliance with the advertising and professional standards of its regulatory college.
4. Arxeon will complete a reasonable number of revision rounds during the initial build. Continuing redesign after handover is outside this Schedule and may be quoted separately.
5. Domain registration and third-party costs the Clinic chooses (a domain name, a paid font, a stock image) are the Clinic’s own. Hosting of a site built under this Schedule is included while the Clinic’s subscription is active.

D2. Minor enhancements

1. Arxeon will consider Clinic requests for small changes to the Platform — an additional field, a column, different wording, a report laid out differently — and will build them at no charge where, in Arxeon’s reasonable judgement, the work is minor, is technically safe, and does not conflict with other clinics’ use of the Platform.
2. Larger requests are handled as roadmap items rather than as work owed under this Agreement. Arxeon will say which of the two a request is, rather than leaving it open.
3. Nothing here is a commitment to deliver a particular feature, to deliver by a particular date, or to keep a feature indefinitely. Enhancements built under this Schedule become part of the Platform and are governed by Section 4 of the Terms like any other feature.
4. Enhancements are built for the Platform generally. Arxeon does not undertake to keep a change exclusive to the requesting Clinic, and the Clinic acquires no ownership of, or exclusive right to, anything built under this Schedule.

D3. Ownership, and what happens if the Clinic leaves

1. The Clinic owns the content, branding and domain name of a website built under D1, and owns the site files as delivered. On termination for any reason, Arxeon will, on the Clinic’s written request made within 90 days, provide the site files and reasonable cooperation to transfer the site and domain to the Clinic or its nominee.
2. Features of the site that depend on the Platform — online booking, intake forms, patient messaging — cease when the subscription ends. Arxeon has no obligation to replace them.
3. Arxeon retains ownership of the Platform, of any enhancement built under D2, and of any reusable template, component or code used to build the site.

D4. Nature of the offer

1. Both offers are tied to an active paid subscription and are made available at Arxeon’s discretion. They are not a credit, are not exchangeable for a fee reduction, and have no cash value.
2. Arxeon may change or withdraw either offer for new clinics at any time. Where a website has already been built for a Clinic under D1, D3 continues to apply regardless.
3. Work under this Schedule is provided as is. Section 8 (liability & indemnity) applies, and for certainty Arxeon is not liable for lost bookings, lost revenue or reputational harm arising from a website built under this Schedule.

Related documents

§Version history

Version	Date	Summary
1.3	August 14, 2026	Added Schedule D (clinic website & minor enhancements): scope of the free website and of no-charge minor enhancements, Clinic ownership of the site content and domain, a 90-day handover right on termination, and the discretionary nature of both offers.
1.2	August 14, 2026	Schedule B updated: Daily.co added as the telehealth media-transport Subprocessor, with processing location and the express statement that no Health Information is stored by it and calls are not recorded.
1.1	August 11, 2026	Added Schedule C (AI-assisted features & the Ambient Scribe): consent-before-recording regime with logged attestations and the do-not-record preference; audio processed in real time in Canada and never stored; transient transcripts with only operational metadata retained; draft-until-reviewed rule; per-provider minute metering and overage under the Terms; Clinic representations and feature-level suspension. Section 4 gains AI-review, scribe-consent, and AHCIP-accuracy duties; Schedule B adds Microsoft Azure AI Speech and details Anthropic’s role.
1.0	July 12, 2026	First publication: clinic subscription contract with the section 66 Information Manager Agreement (Schedule A) — permitted handling, safeguards, Canadian data residency with disclosed cross-border processing, 72-hour breach notification, subprocessor list and change rights (Schedule B), retention/return/destruction, and OIPC cooperation.

© 2026 Arxeon Inc. All rights reserved. “Qlynic” and the Qlynic mark are trade-marks of Arxeon Inc.