Privacy Policy of FrontRx

Effective date: September 16, 2026

Last updated: September 16, 2026

Organization: FrontRx Inc. (in French, FrontRx : Agents Intelligents)

Head office: 8595 Boul. Saint-Laurent, Montréal, QC, H2P 2M9, Canada

Privacy Officer / RPRP contact: [email protected]

1. Who is FrontRx?

   Welcome to FrontRx (hereinafter "FrontRx" or the "Platform"), a service operated by FrontRx Inc. The Platform is designed to transcribe clinical conversations and generate administrative and clinical documents for healthcare professionals, in order to improve the patient-healthcare professional relationship and continuity of care.

   The Platform relies on artificial intelligence ("AI") systems that act exclusively as a clinical and administrative support tool. On this basis, our Platform is not an automated decision-making tool nor an electronic medical record ("EMR"). The Platform ensures transparency by requiring oversight by the healthcare professional. This professional remains solely responsible for validating any generated content and for archiving relevant clinical documents in the official systems of the healthcare institution where the consultation takes place.

2. About this Policy

   This Privacy Policy (hereinafter the "Policy") describes how FrontRx collects, uses, discloses, retains, and destroys your personal information when you, as a patient or healthcare professional, use our Service.

   Personal information means any information that identifies you or that could reasonably be used to identify you. This includes information relating to your health.

   2.1. Who does this Policy apply to?

   This Policy applies to users, meaning healthcare professionals and their patients (collectively referred to as "you"), who accept and access FrontRx's services on an individual basis or as part of a program offered by the healthcare institution where the consultation takes place. It also applies to individuals who accept this Policy on behalf of a dependent, and governs the handling of any questions, requests, or concerns that you or your representative may address to us.

   2.2. Applicable laws

   We will process your personal information in accordance with the applicable privacy and health information laws in all provinces and territories where we operate in Canada.

3. What personal information do we collect?

   3.1. Healthcare professionals. When creating an account, authenticating, and logging in, we collect the following personal information:

   • Professional information: Professional licence number, first and last name, professional email address, electronic signature, specialty, role within the patient care team, photograph of the medical or professional licence, and a government-issued identity document.
   • Contact information: Telephone and fax numbers, as well as the healthcare institution where the healthcare professional practises.

   When browsing the Platform, through cookies and similar technologies, we automatically collect the following information:

   • Platform usage information: IP address, login information, buttons clicked, time spent on the Platform, pages or features used, your feedback, browser and device information, operating system, audit logs, security logs, and metadata.

   3.2. Patients. When registering on the patient list, during the consultation through audio recording and transcription, and when uploading photographs of medical documents provided to the healthcare professional, FrontRx collects the following personal information:

   • Identification data: First and last name, date of birth, gender, medical record number (MRN), provincial health insurance number (RAMQ), and a photograph of the health insurance card.
   • Personal health information: Audio recording of the consultation, transcription of the consultation, medical history, current clinical history, laboratory results, clinical reports, previous clinical notes, ICD-10 codes, medication list, dosage, prescription renewals, drug interactions, and RAMQ billing codes.
   • Clinical site information: Bed number, unit, admission date, and clinic address.

4. Why do we process your personal information?

   4.1. Platform usage information relating to healthcare professionals allows us to ensure the operation, security, ongoing improvement, and optimization of the Platform. It is also used to document the obtaining of the patient's valid consent to the processing of their personal information by FrontRx for the purposes set out in this Policy, as well as to manage the retention and destruction cycle of that information.

   FrontRx uses cookies, access logs, and similar technologies to collect certain technical data, including your IP address, login information, browser and device information, operating system, audit logs, security logs, and Platform usage metadata.

   The collection of the IP address makes it possible to locate the healthcare professional when using the service during the consultation. This essential security measure helps verify that the person accessing the Platform and the patient's personal information is indeed a qualified healthcare professional and forms part of the patient's circle of care.

   The healthcare professional may authorize and/or enable the collection of this information so that FrontRx can ensure that the Platform is used in accordance with this Policy and our Terms of Use, and to verify that consultations are conducted in compliance with the laws and regulations of the jurisdiction in which you are located. The healthcare professional is free to consent to the collection of this personal information; however, in order to prevent fraud and to guarantee the security, integrity, and compliance of the service, refusal to share this information prevents any use of the Services.

   In the same way, in order to verify the identity and professional qualification of the healthcare professional, the professional email address, telephone number, photograph of the medical or professional licence, and a government-issued identity document are required for authentication at login and for secure access control.

   4.2. The professional information and contact information of healthcare professionals, as well as the identification data, personal health information, and clinical site information of patients, are collected and processed to support the drafting of medical notes and prescriptions. This information also helps ensure the continuity and fluidity of care, ongoing improvement of the accuracy of the information recorded in the clinical documents prepared on the Platform, and generate medical billing reports to be submitted to the RAMQ.

   In the same way, the contact information of healthcare professionals allows us to send them account-related notifications and updates about our services. They also enable us to respond to your questions, requests, or concerns, or to those of your representative.

   Our Platform acts exclusively as a clinical and administrative support tool and does not make any automated decisions. Consequently, the personal information collected is not used for training machine-learning models, software development, testing, or integration into non-production environments.

   In order to improve drafting accuracy, healthcare professionals may report medical documents generated by the Platform that are imprecise and validate the reliable elements. In such cases, the transcription and the medical note in question are de-identified: this means that your name, contact details, and any direct identifiers that would allow you to be immediately recognized are removed in order to protect your privacy. Our team can then assess and correct the technical errors of our Platform, while preventing any regression, in order to provide you with a better service.

   4.3. In addition, personal information may be processed in order to detect, prevent, and investigate security or confidentiality incidents, as well as to audit FrontRx's systems. This information also allows us to trigger security notifications or alerts in the event of unusual behaviour, and to comply with legal, regulatory, and audit obligations, as well as to enforce our Terms of Use.

5. Who can access your personal information?

   We limit access to the personal information we collect to only those members of our staff and authorized third parties who strictly need access to it in order to perform their duties or to provide us with essential services, all in accordance with the purposes set out in section 4 of this Policy.

   Here are the categories of persons who may have access to your personal information:

   5.1. Your circle of care

   Healthcare professionals working within the healthcare institution where your consultation took place, or any healthcare professional who is part of your direct circle of care.

   5.2. FrontRx personnel

   • Privacy Officer: In the event of a confidentiality incident (to conduct the investigation, take the required measures to resolve the incident and prevent its recurrence) or to handle your questions, requests, and concerns. Please refer to section 10 of this Policy.
   • IT security team: This team accesses the professional information as well as the platform usage information of healthcare professionals in order to ensure the operation, security (such as authentication at login), and optimization of the Platform.
   • Ongoing performance improvement team: When a healthcare professional reports an error or validates the reliable elements, this team may access the clinical documents concerned in order to analyse the issue and take measures to improve the drafting accuracy of the Platform or prevent any regression.

   5.3. Our service providers and subcontractors

   • Transcription and drafting services: We may disclose the professional information and contact information of healthcare professionals, as well as the identification data, personal health information, and clinical site information of patients, to the information technology environments of subcontracted companies located in regions other than, or including, your province, territory, or country of residence (including Quebec, Canada, and the United States), in order to transcribe consultations and support the drafting of medical notes and prescriptions, while maintaining our control over your personal information.
   • Infrastructure and hosting services: We disclose platform usage information and encrypted patient identifiers to the secure databases located in Quebec of our physical infrastructure subcontractor. In the same way, we disclose encrypted backup copies of clinical documents to secure databases. In order to protect them from any unintentional loss, this information is replicated inter-regionally between the databases in Quebec and Calgary, while maintaining our control over your personal information.

   5.4. Legal and regulatory requirements

   We may share some of your personal information when required by law, a court, or an authority, or when permitted by law, for example in an emergency situation that endangers your life, health, or safety.

6. How we protect your personal information

   To protect your personal information, we apply security measures adapted to its sensitivity and equivalent to or higher than the highest industry standards:

   6.1. Administrative measures

   • Internal governance: Strict policies governing the protection of personal information, aligned with the healthcare sector context and the responsible use of AI, accompanied by mandatory training for our staff.
   • Subcontractor oversight: Service contracts imposing strict confidentiality, security, and legal compliance obligations, allowing us to maintain control over your personal information at all times.

   6.2. Technical measures

   • Advanced encryption protocols: TLS 1.3 in transit and AES-256 at rest.
   • Immediate destruction of consultation recordings and photographs of documents, as well as immediate de-identification of direct identifiers before the creation of the medical note and the prescription.
   • Access is limited exclusively to authorized persons according to their roles, mandatory multi-factor authentication (MFA) for login, detailed logging of all actions, and continuous monitoring.
   • Proactive vulnerability management processes and investigation of security incidents.
   • The virtual workspace intended for the transcription and drafting of clinical documents is strictly isolated at the subcontractors. Only authorized FrontRx personnel and healthcare professionals may access it to fulfil the purposes set out in this Policy.
   • The information technology environments of our subcontractors in which we process and host your personal information comply with strict international standards, including those of the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). In addition, they successfully pass independent security audits, including SOC 1, SOC 2 (including Type II), and SOC 3 audits.

   6.3. Physical safeguards

   • Ultra-secure physical access to databases. Any third-party intervention requires an approved business justification, is strictly time-limited, and must be conducted under constant escort by authorized personnel.

7. Retention of your personal information

   Your personal information is retained only for the period necessary to fulfill the purposes described in section 4 of this Policy for which it was collected, used, or disclosed.

   This retention period is determined based on the lifecycle of the clinical document containing your personal information, subject to any mandatory minimum retention period required by law or necessary to ensure our compliance with legal and regulatory obligations. If the patient requests the deletion of their clinical documents during this mandatory period, we will not be able to fulfill the request until this timeframe has elapsed. Once the period expires, we will proceed with their deletion.

   When the retention period ends, we permanently destroy your personal information. To this end, we apply secure erasure methods aligned with National Institute of Standards and Technology (NIST) standards, supplemented by manual verification to ensure the process is irreversible.

8. Where your personal information is hosted

   Your personal information is primarily hosted in Quebec and Calgary. As indicated in section 5.3 of this Policy, we thoroughly assess the security and privacy practices of our service providers to ensure we retain control over your information and that it is protected by safeguards equivalent to those required in Quebec, until it is destroyed once the purposes for collection have been fulfilled.

9. Cookies and similar technologies

   When your healthcare professional visits or uses our Platform from a computer or mobile phone, we may use cookies or similar technologies.

   Any personal information collected using cookies is handled with the same level of confidentiality as any other personal information held by FrontRx.

   These files help us:

   • Identify where the consultation takes place and understand the type of browser, operating system, and device used to access the platform.
   • Analyze navigation and usage patterns to identify pages visited, features used, buttons clicked, and time spent on our interfaces.
   • Ensure Platform security by generating audit and security logs to monitor actions taken and detect fraudulent activity.
   • Gather your feedback and comments to continuously optimize drafting accuracy and the overall user experience of the Platform.

10. Rights of patients and healthcare professionals

    Subject to prior verification of your identity or that of your representative, you have several rights regarding your personal information we collect. You may submit your request directly, either to the relevant healthcare institution or healthcare professional, or to our Privacy Officer using the contact information provided in section 13 of this Policy.

    These rights may be exercised by:

    • You, your legal representative, or the holder of parental authority.
    • In the event of death: your heir or successor, the liquidator of succession, the beneficiary of a life insurance policy or death benefit, as well as your spouse or a close relative.

    Please note that all such requests, when concerning clinical content, are subject to clinical review. These rights include, in particular:

    10.1. You have the right to fully understand the scope of your consent. We encourage you to ask your healthcare professional for any necessary information when this Policy is explained to you. If you have any ongoing questions or concerns, you may also address them directly to our Privacy Officer.

    10.2. You have the right to access your personal information and to know what information about you is retained in our system, which categories of individuals have access to it, as well as its retention period. While access to this information is free of charge, reasonable fees may be charged for its transcription, reproduction, or transmission [1].

    10.3. You have the right to request the correction or updating of your personal information if it is inaccurate, incomplete, or equivocal [2].

    10.4. You may request to receive, in a structured, commonly used technological format, a copy of the computerized personal information you have provided to us concerning yourself, unless fulfilling this request raises serious practical difficulties [3].

    10.5. You may, at any time, withdraw your consent to the use or disclosure of your collected personal information.

    However, this right is subject to limits and practical consequences:

    • Service interruption: Because your personal information is necessary for the conclusion and performance of our service contract, its processing is essential. If you withdraw your consent, your information will no longer be processed, rendering it impossible to provide the clinical conversation transcription and drafting support service [4].
    • Legal exceptions: It is important to note that withdrawing your consent cannot prevent the disclosure of your information where required or permitted by law. For example, we must be able to demonstrate to competent public bodies that we obtained your initial express consent, in accordance with the strict obligations governing sensitive information, such as health and clinical site information [5].

    10.6. The healthcare professional may close their account directly within the Platform or by sending an email to [email protected]. Once the account is closed, we will cease using their personal information as well as that of their patients in the future, subject to our legal retention obligations.

11. Privacy incident notification

    If FrontRx experiences a privacy incident that presents a risk of serious injury or a real risk of significant harm to you, we will notify you as well as the applicable privacy regulator. We will inform you of what happened, which personal information was involved, and the steps taken to remedy the situation.

12. Protection of minors' privacy

    Our services are directed exclusively to healthcare professionals who are of legal age or at least 14 years old.

    Through our platform and website, healthcare professionals are expressly instructed on their regulatory obligation to verify the patient's age and to obtain the consent of the holder of parental authority or legal guardian when the patient concerned is a minor under 14 years of age [6].

    If you are a parent or legal guardian and have reason to believe that your child under 14 years of age has provided us with personal information without your consent, we invite you to contact our Privacy Officer immediately so that we can take the necessary measures to destroy it.

13. Contacting us and managing your requests

    For any questions, complaints, requests, or comments regarding the processing of your personal information or the exercise of your rights, you may communicate directly with our Privacy Officer, Abhinav Sharma:

    • Email: [email protected]
    • Mailing address: 8595 Boul. Saint-Laurent, Montréal, QC, H2P 2M9

14. Mandatory notification by concerned healthcare professionals and healthcare institutions

    The healthcare professional and the Privacy Officer of the healthcare institution must immediately notify our Privacy Officer of any decision, complaint, or request regarding the exercise of a patient's rights concerning their personal information.

    This notification is essential to allow us to jointly take the necessary measures to effectively respond within 30 days of its receipt, in accordance with legal requirements.

15. Amendments and updates to the Policy

    This Policy will be reviewed, amended, or supplemented on a regular basis to reflect updates to our Platform or changes affecting our subcontractors' services. These updates will be communicated to you through our website or through the healthcare professional or healthcare institution that is part of your direct circle of care. The most recent version of this policy is always available at https://www.frontrx.com/.

    We encourage our healthcare professional users to review the Policy regularly to convey their agreement or disagreement. Please note, however, that the continuation of our clinical conversation transcription and medical drafting support services remains contingent upon obtaining your consent, for the reasons detailed in section 10.5 of this Policy.

Notes

1. See sections 8, 30, and 33 of the Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1).
2. See section 28 of the Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1).
3. See section 27 of the Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1).
4. See section 9, paragraph 1, subparagraph 1 of the Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1).
5. See sections 12 and 18 of the Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1).
6. FrontRx, FrontRx Tutorials, "Obtain AI scribe consent for minor patients in Quebec", online: https://www.frontrx.com/tutorials/ai-scribe-consent-minors