1. Overview

Your healthcare provider uses ListenMD (operated by ECA Tech Incorporated), a secure, Canadian-hosted artificial intelligence platform, to assist with clinical documentation. ListenMD transcribes ambient dialogue during your appointment to draft accurate medical notes for your physician or clinic.

2. What Information Is Collected

• Audio Processing: During your consultation, audio is streamed securely to record spoken medical conversation.
• Clinical Summaries: Transcripts and structured clinical summaries (e.g., SOAP notes) are generated solely for review and approval by your treating healthcare professional.

3. How Your Information Is Used & Protected

• Care Coordination: Information is used strictly to support your healthcare provider in delivering quality medical care and maintaining medical records.
• No AI Training: Your personal health information is never used to train public AI models.
• High-Level Encryption: All data in transit and at rest is protected using AES-256 and TLS 1.3 encryption. Application and database infrastructure is hosted in Canada; note generation is processed under Microsoft's Data Protection Addendum as described in Section 4.
• No Long-Term Audio Retention: Audio recordings are processed in real-time and deleted immediately after the verified clinical draft is delivered to your provider.

4. Third-Party Service Providers

To deliver this service, ListenMD relies on the following processors, all of which operate under contractual confidentiality and data protection terms:

• Microsoft Azure Speech Services (Canada Central): converts your spoken conversation into text in real time.
• Microsoft Azure AI Language (Canada Central): extracts clinical terms from the transcript to support note drafting. This processing stays within Canada.
• Microsoft Azure OpenAI Service: generates the structured clinical note from your transcript. Unlike the services above, this processing is not guaranteed to remain within Canadian borders; it is governed by the Microsoft Online Services Data Protection Addendum, which applies equivalent privacy and security obligations regardless of where processing occurs.
• Twilio and SendGrid: used only to deliver login security codes and account alerts to your healthcare provider's staff. These providers never receive your health information.

For more information about these service providers or our data protection agreements with them, contact our Privacy Office (Section 6).

5. Data Ownership & Governance

Your healthcare provider (the Health Information Custodian) remains the legal custodian of your health records. ListenMD acts strictly as a Service Provider / Health Information Network Provider (HINP) bound by strict confidentiality agreements, PHIPA, and PIPEDA.

6. Your Rights & Contacts

You have the right to request access to or correction of your medical record through your healthcare provider’s office. You may also withdraw consent for ambient audio transcription at any time prior to or during your visit by informing your provider. 

For questions regarding ListenMD’s security standards or privacy safeguards, contact our Privacy Office:

• Email: privacy@listenmd.com
• Address: ECA Tech Incorporated, Vaughan, Ontario, Canada