Privacy Policy

Effective Date: January 1, 2026

Canadian Shield Health Care Services ("Canadian Shield," "we," "us," or "our") provides Poly Voice Companion ("PVC"), a voice-enabled healthcare documentation and communication platform.

This Privacy Policy explains how PVC collects, uses, processes, discloses, stores, and protects personal information and personal health information when healthcare professionals, healthcare organizations, patients or clients, and other authorized users interact with PVC.

PVC includes mobile and web-based functionality. Depending on the PVC service and the configuration selected by a healthcare organization, PVC may provide voice recording, speech-to-text transcription, multilingual translation, patient and case organization, clinical documentation support, AI-assisted documentation, companion functions, and transfer of information to an electronic medical record ("EMR") or other clinical information system.

This Privacy Policy should be read together with any applicable agreement between Canadian Shield Health Care Services and the healthcare organization using PVC.

1. Our Role

PVC is provided primarily to healthcare professionals, healthcare organizations, and other authorized healthcare users.

Depending on the service and deployment, Canadian Shield may process personal information and personal health information on behalf of a healthcare organization that is responsible for determining how and why patient or client information is collected and used.

Healthcare organizations and authorized users are responsible for ensuring that they have the appropriate authority, consent, notices, and permissions required to collect, record, use, and disclose patient or client information through PVC.

Where PVC is used in connection with patient care, requests relating to an official patient or client clinical record should generally be directed to the healthcare organization responsible for that record.

2. PVC Services

PVC provides different functions depending on the service selected by the healthcare organization.

Mobile Application

The PVC mobile application may allow authorized users to:

• record spoken information or clinical conversations;
• use Scribe for same-language clinical encounters;
• convert speech into text; 
• use Transcribe for multilingual communication;
• translate supported text between languages;
• identify or organize speakers within a session where supported; 
• support clinical documentation workflows.

Web Application

The PVC web application may allow authorized users to:

• create and manage patient or client records;
• organize information into cases;
• associate recorded sessions with patients or cases;
• upload or use attachments and assessments;
• review transcripts and other captured information;
• generate or prepare structured clinical documentation;
• review and edit documentation;
• manage users, access, templates, and organizational settings; and
• transfer information to an EMR or other clinical information system according to the applicable workflow.

AI-assisted clinical documentation is intended to support professional workflows. Healthcare professionals remain responsible for reviewing and correcting clinical documentation before relying on it for clinical purposes.

3. Information We Collect and Process

The information processed by PVC depends on the service, feature, and organizational configuration being used.

A. User and Account Information

PVC may process information about authorized users, including:

• name;
• work email address; 
• organization;
• professional or organizational role;
• account and authentication information;
• user permissions; and
• information required to administer and secure access to PVC.

B. Patient and Client Information

Where PVC is used in connection with healthcare services, PVC may process patient or client information including:

• patient or client ID within PVC where required by the applicable workflow;
  
• patient, client, visit, case, or session identifiers;
  
• clinical observations;
  
• symptoms and concerns;
  
• care provided;
  
• medical or treatment-related information;
  
• health measurements; 
  
• progress or clinical notes;
  
• information recorded between visits; 
  
• attachments and assessments; and
  
• other personal information or personal health information entered, recorded, uploaded, or generated through PVC.

C. Audio, Transcripts, and Translation Information

Depending on the PVC feature being used, PVC may process:

• audio recordings;
• healthcare professional speech;
• patient or client speech;
• clinical conversations;
• transcripts produced from recorded audio;
• text submitted for translation;
• translated text; and
• clinical information contained within recordings, transcripts, or translations. Audio recordings and transcripts may contain sensitive personal information and personal health information.

D. Attachments, Assessments, and Clinical Context

The PVC web application may allow authorized users to associate additional information with a patient or case.
Where selected by an authorized user, session information, attachments, assessments, templates, and other clinical context may be used to support the creation of clinical documentation.

E. EMR and Clinical System Information

Where PVC is configured to interact with an organization's EMR or another clinical information system, PVC may process information required to identify visits, associate records, prepare documentation, and transfer information according to the configured workflow.
The information exchanged depends on the PVC service and the healthcare organization's configuration.

F.Technical, Security, and Audit Information

PVC may process technical and security information necessary to:

• authenticate users;
• control access;
• maintain system security;
• troubleshoot technical issues; 
• monitor application activity;
• investigate security events; and
• maintain audit records.

4. How We Collect Information

PVC may receive information:

• directly from authorized users;

• through voice recordings and spoken conversations;

• from patients or clients participating in a recorded encounter;

• from healthcare organizations that provision accounts or provide workflow information;

• through configured EMR or clinical system integrations;

• through documents, assessments, or other information uploaded to PVC; and

• through the technical operation and security of the PVC platform.

PVC does not independently access an organization's EMR unless an authorized integration or workflow has been configured.

5. How We Use Information

PVC may use personal information and personal health information to:

• create and administer user accounts;

• authenticate authorized users;

• control access to information and functionality;

• record spoken information;

• convert speech into text;

• translate text between supported languages;

• organize sessions, patients, cases, and related information;

• allow healthcare professionals to review transcripts and translations;

• assist with clinical documentation;

• support companion and between-visit functions where configured;

• synchronize information between PVC components;

• transfer information to an EMR or other clinical information system where configured;

• provide technical support;

• troubleshoot system issues;

• maintain the security and integrity of PVC;

• maintain appropriate audit records; and

• meet applicable contractual, operational, legal, and regulatory requirements.

6. Microsoft Azure Processing

PVC uses Microsoft Azure infrastructure and services.

PVC's primary production environment is hosted in Microsoft Azure Canada Central.

Azure AI Speech

The PVC mobile application uses Microsoft Azure to convert spoken audio into text.

When transcription is requested, applicable audio is transmitted to Azure AI Speech for processing.

PVC does not send patient or client names or other direct patient/client identifiers to Microsoft Azure as separate data fields for this mobile transcription process.

However, if identifying information is spoken during a recorded conversation, it may be contained within the audio or resulting transcript processed by Microsoft Azure.

For the Azure AI Speech configuration used by PVC, Microsoft processes the audio and resulting transcription for the requested operation and discards them after the request is completed.

Azure AI Translator

PVC uses Microsoft Azure when translation is requested.

Text requiring translation may be transmitted to Azure AI Translator and returned to PVC in translated form.

The information submitted for translation may contain personal information or personal health information depending on the content provided through PVC.

7. AI-Assisted Processing in the Web Application

PVC's web application may use Microsoft Azure services to support AI-assisted clinical documentation and related functionality.

Depending on the applicable PVC service, information used for these functions may include:

• transcripts;

• selected sessions;

• clinical information;

• case information;

• attachments;

• assessments; and

• other information selected or provided by an authorized user.

AI-assisted output is intended to support clinical documentation workflows and must be reviewed by an authorized healthcare professional before being relied upon for clinical purposes.

8. Use of Information for AI Training

PVC does not use patient or client clinical information to train, fine-tune, evaluate, or improve general-purpose artificial intelligence models.

Patient or client clinical information is processed only for the applicable PVC service and authorized healthcare workflow.

9. Recording Patients and Clients

Certain PVC functions, including Scribe, may record conversations between a healthcare professional and a patient or client.

Healthcare organizations and authorized users are responsible for complying with applicable privacy, consent, professional, and organizational requirements before recording or processing another person's voice or personal health information.

PVC may require an authorized user to confirm that appropriate patient or client consent has been obtained before a recording begins.

Other PVC services may allow a healthcare professional to dictate information after a patient encounter without recording the patient directly.

10. Mobile Application Consent

Before an authorized user can use the PVC mobile application for the first time, the user is presented with PVC's Voice Processing and Data Sharing Consent.

The user must affirmatively accept the consent before accessing the application.

The consent describes the use of Microsoft Azure services and explains the types of information that may be transmitted for transcription or translation.

If a user does not agree to the consent, the user will not be permitted to continue into the PVC mobile application.

PVC may record:

• the user's consent status;

• the date and time of acceptance;

• the applicable consent or disclosure version; and

• other information required to demonstrate which consent was accepted.

If PVC materially changes the service provider, purposes of processing, or categories of information transmitted, PVC may require users to review and accept an updated consent before continuing to use the affected functionality.

11. Electronic Medical Record and Clinical System Transfers

Depending on the PVC service and the healthcare organization's configuration, information created through PVC may be transferred to the organization's EMR or another authorized clinical information system.

For some PVC services, including configured HomeLink AI workflows, information may be transferred automatically.

For other PVC services, an authorized healthcare professional may be required to review and transfer the information through the workflow configured for that service.

Once information has been transferred to an organization's EMR or another clinical information system, the receiving organization's privacy, records-management, and retention practices apply to that information.

12. Service Providers and Recipients

PVC may make information available to service providers or third parties where necessary to provide the applicable service or authorized workflow.

These may include:

• Microsoft Azure;

• infrastructure and hosting services used to operate PVC;

• an organization's EMR or other clinical information system;

• authorized technical or support providers;

• professional advisers subject to confidentiality obligations; and

• government, regulatory, or legal authorities where disclosure is required or authorized by law.

• PVC does not sell patient or client personal information or personal health information.

13. Data Location

PVC's primary production infrastructure is hosted in Microsoft Azure Canada Central.

PVC uses Microsoft Azure services to support its application, transcription, translation, and web-based processing functionality.

Where another authorized service or integration is used, information may also be processed according to the configuration and contractual arrangements applicable to that service.

14. Retention and Deletion

Retention depends on the PVC service being used.

HomeLink AI

PVC does not retain the applicable HomeLink AI transcription, translation, or resulting clinical information after it has been processed and transferred through the configured workflow.

The healthcare organization's EMR or clinical information system may retain the information according to the organization's own records-management and legal requirements.

AI Scribe

AI Scribe may retain sessions, transcripts, patient or case information, and related clinical content within PVC.

The healthcare organization using the service is responsible for managing and deleting this information according to its applicable retention requirements and organizational policies.

Microsoft Azure Processing

For the Azure AI Speech configuration used by PVC, Microsoft discards the applicable audio and resulting transcript after the transcription request has been completed.

Audit Logs and Backups

Audit logs and backups are retained for the period required to support operational, security, legal, contractual, and records-management requirements.

The retention of information in backups or audit logs may differ from the retention of active application records.

Deletion from the active PVC application may therefore not result in immediate deletion of information contained in protected backup or audit environments.

15. Security Safeguards

PVC uses administrative, technical, and organizational safeguards designed to protect personal information and personal health information from unauthorized access, use, disclosure, alteration, loss, or destruction.

PVC uses authenticated user accounts and access controls to restrict access to authorized users.

Access may vary according to:

• organizational role;

• user permissions;

• patient or client assignment;

• administrative responsibilities; and

• the PVC service being used.

Users are responsible for protecting their credentials, securing their devices, and promptly reporting suspected unauthorized access or security incidents.

No electronic system can be guaranteed to be completely secure.

16. Access and Correction

Individuals may have rights under applicable privacy laws to request access to or correction of their personal information.

Where PVC processes patient or client information on behalf of a healthcare organization, requests concerning the official clinical record should normally be directed to that organization.

Canadian Shield may refer a request to the applicable healthcare organization where that organization is responsible for the information.

Authorized PVC users may contact Canadian Shield regarding:

• PVC account information;

• correction of account information;

• questions regarding PVC's privacy practices;

• consent-related questions;

• privacy complaints; and

• security or privacy concerns.

Requests may be subject to appropriate identity verification and applicable legal requirements.

17. Withdrawal of Consent

Where processing is based on consent, consent may be withdrawn subject to applicable legal, clinical, contractual, and records-management requirements.

Withdrawal of consent does not necessarily require deletion of information that has already been lawfully processed or transferred to an organization's clinical record.

Consent to the disclosed Microsoft Azure processing is required to use the PVC mobile application.

If a user declines or withdraws the consent required for the PVC mobile application, the user will no longer be able to use the application functionality that depends on that processing.

18. Cookies and Website Tracking

The PVC website does not use analytics cookies, advertising cookies, tracking pixels, or similar technologies for advertising or visitor analytics.

If this practice changes, this Privacy Policy will be updated to describe the applicable technology and purpose.

19. Changes to This Privacy Policy

Canadian Shield may update this Privacy Policy from time to time to reflect changes to PVC, its technology, service providers, privacy practices, or applicable requirements.

The updated Privacy Policy will identify the applicable effective date.

Where a material change affects the categories of information processed, the purposes for which information is processed, or the third parties receiving information, PVC may provide additional notice and obtain updated consent where appropriate.

20. Contact Us

Questions, requests, complaints, or concerns regarding this Privacy Policy or PVC's handling of personal information may be directed to:

Canadian Shield Health Care Services

Privacy Officer: Alain Leclair

Email: aleclair@canadianshieldhealth.com

Telephone: 705-618-7233 ext 0

Address: New Sudbury Shopping Centre, Second Floor, 1033 Barrydowne Road Unit 206A, Sudbury, ON P3A 5Z9.

Where a question relates to information contained in an official clinical record, individuals may also contact the healthcare organization responsible for that record.