Alberta Information Manager Agreement

Alberta Information Manager Agreement

(Health Information Act, section 66, and Health Information Regulation, section 7.2 — the sync server and patient portal)

This agreement is between the custodian named below ("Custodian") — a practice or practitioner in Alberta that is a custodian under the Health Information Act (Alberta) ("the Act") — and SideClick (Pty) Ltd ("Information Manager"). It applies whenever the Custodian's people sign in to the sync server or the Custodian enables the patient portal. It is entered into when the Custodian accepts the Terms of Service and uses those services, and forms part of the Sync Server Data Processing Agreement (Annex D, Canada). Either party may request a countersigned copy using the signature block below. Nothing in it reduces the protection the Act gives health information.

1. The services, stated plainly

The Information Manager provides the sync server, which keeps a sealed copy of the Custodian's records so that the Custodian's own devices and the people the Custodian chooses can receive them, and the patient portal. Every record is sealed on the Custodian's device before it is sent; the Information Manager holds no key and cannot read, correct, extract or selectively delete health information. What the sync server holds and what it can see is inventoried in the Sync Server Data Processing Agreement Annex A: sealed entries, the keys of each file wrapped for the people who may open it, the structure of the practice, and delivery metadata (which sign-in sent each sealed entry, when, and which sealed file it belongs to — never a patient's name or what the entry says).

2. The Information Manager's duties (Regulation s 7.2)

The Information Manager:

1. uses the health information only to provide the services in §1 to the Custodian, and for no purpose of its own; it does not use or disclose health information except as this agreement or the Act permits;
2. complies with the Act and the Regulation in respect of the health information it holds for the Custodian, and with the Custodian's written instructions given through the software;
3. protects the health information against unauthorised access, use, disclosure, alteration and loss by the measures in the Sync Server Data Processing Agreement Annex B — end-to-end sealing under keys the Information Manager never holds, encrypted storage, access controls, logging and monitoring — and keeps them for as long as it holds the information;
4. notifies the Custodian of any loss of, unauthorised access to, or unauthorised disclosure of health information at the first reasonable opportunity and in any event within 72 hours of becoming aware, with the information the Custodian needs to meet its own duties under section 60.1 of the Act, and assists the Custodian with them; a compromise of the sync server's storage alone exposes sealed data and service metadata, which bears on the Custodian's assessment, made per incident;
5. engages no other person to hold health information for the Custodian except the sub-processors in the sub-processor register, each bound in writing to protection no less than this agreement's, and remains responsible for them;
6. gives the Custodian access to, and the means to retrieve, the health information at all times through the software — every record can be read and exported from the Custodian's own devices whatever the state of the subscription, and the sealed copy on the sync server stays readable and exportable for 90 days after the subscription ends (Terms of Service §5);
7. makes available to the Custodian, on request, information needed to show compliance with this agreement, and allows the Custodian's reasonable audit as the Sync Server Data Processing Agreement §9 provides;
8. at the end of this agreement, returns the health information by the means in item 6 and then destroys the sealed copy it holds, as the Sync Server Data Processing Agreement §8 provides; the Custodian's own copies on its devices are never touched.

3. Storage and use outside Alberta (Regulation s 8(4))

The sealed copy is stored in the United States, in the regions the sub-processor register names, and its backup copies in a second United States region. The Custodian records that it has considered the risks of storage outside Alberta and decided that the safeguards in §2 — above all that the information leaves the Custodian's devices only sealed, under keys the Information Manager and its sub-processors never hold — are reasonable protection, and authorises that storage. The Information Manager will not move the sealed copy to any other country without 30 days' notice to the Custodian and a right to object under the Sync Server Data Processing Agreement §4.

4. The Custodian's duties

The Custodian remains the custodian of the health information under the Act: it decides who in its practice may open which records, obtains the consents the Act requires, keeps the records for the period its college and the Act require (the software's retention tooling supports that duty and destroys nothing without a confirmed action by the Custodian), answers individuals' access and correction requests from its own devices, and uses the software's access controls and audit log as its own safeguards. It will not ask the Information Manager to do anything the Act prohibits.

5. Term, changes and precedence

This agreement runs with the services and ends when they end (§2 item 8). It changes only as the Sync Server Data Processing Agreement §10 provides: never by the Terms of Service's change clause, and never so as to reduce the protection it gives health information. For health information under the Act, this agreement prevails over the Terms of Service and over any marketplace or app-store terms.

---

Signatures (optional — this agreement takes effect on acceptance of the Terms of Service; a countersigned copy is available on request)

	Custodian	Information Manager
Entity	______________________	SideClick (Pty) Ltd
Name, title	______________________	______________________
Date, signature	______________________	______________________

Version 1.0 · Published 2026-11-01