Legal

Abri EMR — Terms of Service

Including the Alberta Information Manager Agreement, Security and Data Processing Terms, and Record Retention and Exit Policy

Provider: Scribeberry Ltd.
Version: 1.0
Last updated: 2026-10-08
Effective: Date of electronic acceptance

Introduction

Welcome to Abri EMR ("Abri"), an electronic medical records and healthcare practice management platform owned and operated by Scribeberry Ltd.

These Terms of Service ("Terms" or "Agreement") constitute a legally binding agreement between Scribeberry Ltd. ("Scribeberry", "Provider", "we", "us", or "our") and the healthcare professional, clinic, business, or organization accepting this Agreement ("Customer", "you", or "your").

This Agreement governs the Customer's subscription to and use of Abri, including its clinical, administrative, communication, and information management capabilities.

This is a consolidated agreement. It includes all of the following, as applicable:

General Terms of Service.
Customer privacy and regulatory compliance obligations.
Data protection and security commitments.
Alberta Information Manager Agreement (Schedule A).
Security and Data Processing Terms (Schedule B).
Record Retention and Exit Policy (Schedule C).

These schedules are incorporated into this Agreement and do not require separate acceptance where the accepting party has lawful authority to enter into them.

By electronically accepting this Agreement, the accepting individual confirms that they have read and understood its provisions, have authority to enter into it in the capacities represented, and agree to be legally bound by its terms.

Where the accepting individual is an Alberta Custodian, or has valid authority to execute an Information Manager Agreement on behalf of identified Alberta Custodians, that acceptance also executes the Alberta Information Manager Agreement in Schedule A for those Custodians.

Creation of an Abri clinic may occur immediately following acceptance, subject to the requirements of this Agreement.

Part I — General Terms of Service

1. Parties, Definitions, and Acceptance

1.1 Provider

Abri EMR is a product of Scribeberry Ltd., a company incorporated in Alberta, Canada.

"Abri" and "Abri EMR" are product names and do not refer to a separate legal entity.

All contractual obligations undertaken by the Provider under this Agreement are obligations of Scribeberry Ltd.

1.2 Separate Products

Scribeberry Ltd. also owns and operates other products, including Scribeberry Scribe.

Abri EMR and Scribeberry Scribe are separate products with distinct purposes, contractual terms, subscriptions, and data-processing arrangements.

This Agreement applies exclusively to Abri EMR and does not replace or amend the terms governing Scribeberry Scribe.

Using both products does not automatically authorize sharing Patient Information between them.

Any integration or transfer between the products must be appropriately authorized and comply with applicable privacy and health-information laws.

1.3 Definitions

For purposes of this Agreement:

"Applicable Law" means all federal, provincial, and territorial laws, regulations, and legally binding regulatory requirements applicable to a party, activity, or information.

"Authorized User" means an individual authorized to access Abri for a lawful clinical, administrative, or other permitted purpose.

"Clinic" means a healthcare practice or organizational workspace established within Abri, which may include one or more healthcare professionals, locations, and responsible Custodians.

"Customer" means the individual or legal entity identified as the subscriber or contracting organization for an Abri account.

"Custodian" means a person or body having legal custody or control of health information under Applicable Law, including a health information custodian, trustee, or equivalent person or body under provincial or territorial legislation.

"Participating Custodian" means a Custodian whose Patient Information is processed through a Clinic under a lawful arrangement and, where applicable, who has entered into or validly authorized an Information Manager Agreement with the Provider.

"Patient Information" means personal health information, individually identifying health information, medical records, and other patient-related personal information protected by Applicable Law.

"Customer Data" means information submitted to, stored in, or processed through Abri by or on behalf of the Customer, including Patient Information.

"Services" means the subscribed Abri software, hosting, maintenance, support, and related features.

"Subprocessor" means a person or organization engaged by the Provider to process Customer Data on its behalf in delivering the Services.

1.4 Customer and Custodian Responsibilities

The Customer and a Custodian may be different legal persons.

In particular, a clinic corporation, office manager, or person paying the subscription may not be the legal Custodian of the medical records maintained in the Clinic.

Custody and control of Patient Information are determined by Applicable Law, not solely by account ownership, subscription payment, or administrative privileges.

Each Custodian retains its statutory and professional responsibilities.

Nothing in this Agreement makes an individual Custodian personally responsible for a separate Customer entity's subscription fees unless that Custodian has separately accepted those financial obligations.

1.5 Authority to Accept

The individual accepting this Agreement represents and warrants that:

They are at least the age of majority and have legal capacity to enter into this Agreement.
They have authority to bind the Customer.
Where accepting the Agreement on behalf of one or more Custodians, they have valid legal authority to do so.
Any Custodians purportedly represented under the Alberta Information Manager Agreement have actually authorized that representation.
Any required authority, delegation, or appointment has been obtained and can be demonstrated if reasonably requested.

A physician serving as an authorized lead Custodian may enter into this Agreement on behalf of other participating physicians where such representation is legally valid.

An individual who is not a Custodian and lacks authority to represent a Custodian cannot bind that Custodian merely by declaring such authority or accepting these Terms.

The Customer must ensure that no Patient Information belonging to or controlled by an unrepresented Custodian is provided to Abri where a separate agreement is legally required.

1.6 Electronic Agreement and Signature

The parties consent to forming and executing this Agreement electronically.

Scribeberry Ltd. offers to be bound by this Agreement as published in the applicable acceptance flow.

The Customer's affirmative electronic acceptance constitutes acceptance of that offer.

For any Participating Custodian validly represented in the acceptance, that same action constitutes acceptance of Schedule A in the relevant legal capacity.

Electronic acceptance is intended to serve as an electronic signature associated with this Agreement, subject to the applicable legal requirements for identification, authority, and electronic execution.

We may maintain records of:

The accepted Agreement and version.
The date and time of acceptance.
The accepting individual's identity and account.
The Customer and Clinic associated with acceptance.
The capacity and represented Custodians identified in the acceptance records.
The electronic acceptance action.
Relevant technical evidence reasonably necessary to establish acceptance.

These records may be retained and produced where reasonably required to establish contractual obligations or demonstrate legal compliance.

The parties agree that no separate handwritten signature or vendor countersignature is required for an electronically executed agreement unless Applicable Law specifically requires another form of execution.

1.7 Additional Custodians

The Customer must ensure that each Custodian subsequently participating in a Clinic is covered by a legally valid agreement and authorization before Patient Information subject to that Custodian's control is processed where such an agreement is legally required.

A Custodian may participate through an existing valid delegation to a lead Custodian or another legally valid arrangement.

The Customer must maintain accurate records of participating Custodians and their authority arrangements.

Adding a user account does not, by itself, establish legal custody of records or execute an agreement on behalf of a Custodian who has not accepted or been validly represented.

1.8 Contractual Documents and Priority

This Agreement consists of the General Terms and all applicable schedules contained in this document.

The subscription confirmation identifies the selected plan, fees, subscription term, and applicable commercial limits.

Where provisions conflict, mandatory Applicable Law prevails.

For Alberta Patient Information, Schedule A prevails over inconsistent general contractual provisions.

Schedule B governs security and data processing, and Schedule C governs record retention and exit, to the extent more specific than the General Terms.

A separately negotiated written agreement may override identified provisions where legally permissible.

Our published Privacy Notice provides further information about our privacy practices but does not independently authorize additional processing of Patient Information.

2. Subscription and Use of Abri

2.1 License

Subject to this Agreement and payment of applicable fees, we grant the Customer and its Authorized Users a limited, non-exclusive, non-transferable right to access and use the subscribed Services for lawful healthcare and associated practice operations.

No ownership rights in Abri software or technology are transferred.

2.2 Services

Abri may include electronic medical records, clinical documentation, patient administration, scheduling, tasks, forms, communications, integrations, and other clinical or administrative functionality.

Available features depend on the subscription, configuration, jurisdiction, and technical capabilities.

Certain features may be optional or require separate configuration.

2.3 Regulated Interfaces

Subscription to Abri does not automatically confer access to government health networks, provincial databases, billing interfaces, electronic prescribing services, laboratory systems, or other regulated services.

Any such integration may require separate authorization, credentials, agreements, certification, or regulatory requirements.

Features will be represented as certified or formally approved only where such status has actually been obtained.

2.4 Account Administration

The Customer is responsible for designating appropriate administrators and maintaining accurate account, organization, contact, and Authorized User information.

The Customer must ensure that:

Users have individual credentials.
Access permissions correspond to lawful responsibilities.
Administrative privileges are appropriately restricted.
Authentication requirements are followed.
Departing staff and other unauthorized users promptly lose access.
Suspected unauthorized access is reported promptly.

Administrative authority within Abri does not supersede legal Custodian control of Patient Information.

2.5 Acceptable Use

The Services must not be used to:

Violate Applicable Law.
Access or disclose records without authority.
Circumvent authentication or security controls.
Introduce malicious code.
Disrupt the Services or other customers.
Misrepresent a person's identity or professional status.
Extract information for unauthorized purposes.
Process Patient Information without a lawful basis.
Infringe the rights of others.

The Customer is responsible for activities performed through its accounts to the extent attributable to its users, acts, omissions, or failure to maintain required safeguards.

2.6 Clinical Responsibility

Abri is a technology platform, not a healthcare provider.

Healthcare professionals remain responsible for clinical decisions, patient care, record accuracy, prescriptions, diagnosis, treatment, and professional obligations.

The Customer must maintain reasonable downtime and contingency procedures appropriate to its clinical operations.

3. Customer Privacy and Regulatory Compliance

3.1 General Responsibility

The Customer and each responsible Custodian are responsible for ensuring that their use of Abri complies with all Applicable Law and legally binding professional or regulatory requirements.

This includes requirements governing:

Privacy and protection of health information.
Patient consent and notices.
Collection, use, disclosure, and retention of records.
Professional recordkeeping.
Access and correction rights.
Privacy and security assessments.
Regulatory filings and agreements.
Staff access and confidentiality.
Communication with patients.
Clinic operations and professional standards.

The Provider remains independently responsible for laws and contractual obligations applicable to its own activities.

3.2 Privacy Impact Assessments

The Customer and each responsible Custodian are responsible for determining whether a Privacy Impact Assessment or equivalent privacy assessment is required and for arranging its preparation, completion, maintenance, updating, and submission wherever required by Applicable Law.

Unless separately agreed in writing, Scribeberry Ltd. does not undertake to prepare, submit, obtain regulatory review of, or maintain a Customer-specific PIA.

Responsibility for a PIA remains with the legally responsible Customer or Custodian even if external consultants or other professionals assist in its preparation.

The Customer is responsible for any applicable costs of its assessments, filings, or compliance activities.

3.3 Alberta Requirements

Customers and Custodians subject to Alberta's Health Information Act ("HIA") must comply with the HIA and its regulations.

Where section 64 of the HIA applies, the responsible Custodian must prepare and submit the required PIA to the Office of the Information and Privacy Commissioner of Alberta ("OIPC") before implementing Abri as an information system involving individually identifying health information.

The Custodian must maintain appropriate supporting policies and procedures and assess material changes that may require additional or amended submissions.

Participating Custodians may use a joint PIA where permitted by the OIPC and where its applicable conditions are satisfied.

The Custodian is not ordinarily required to wait until the OIPC completes its review and comment process before implementation, provided the legally required submission has occurred and no separate legal requirement or regulatory direction prevents implementation.

Where the HIA requires an Information Manager Agreement, Schedule A forms that agreement between Scribeberry Ltd. and each Custodian that validly enters into or is represented under it.

3.4 Other Canadian Jurisdictions

Customers operating in other provinces or territories are responsible for determining and satisfying the requirements applicable to their operations.

These may include obligations under, as applicable:

Ontario's Personal Health Information Protection Act.
British Columbia's Personal Information Protection Act and applicable healthcare legislation.
Saskatchewan's Health Information Protection Act.
Manitoba's Personal Health Information Act.
Nova Scotia's Personal Health Information Act.
New Brunswick's Personal Health Information Privacy and Access Act.
Newfoundland and Labrador's Personal Health Information Act.
Québec's Act respecting the protection of personal information in the private sector, Act respecting health and social services information, and other applicable legislation.
The federal Personal Information Protection and Electronic Documents Act.
Other applicable provincial and territorial laws.

The obligations imposed by these laws are not identical.

Customers must arrange any assessments, agreements, authorizations, notices, filings, or regulatory submissions required for their own use.

3.5 Québec-Specific Assessments and Transfers

Where Québec law applies, the Customer must determine and complete any legally required privacy impact assessments associated with acquiring or implementing an information system and with entrusting personal information to an organization outside Québec.

The Customer is responsible for making any required determination about adequate protection before the relevant transfer or entrusted processing.

The Provider will cooperate by supplying reasonably available information about processing activities, locations, security measures, and contractual protections.

Any mandatory contractual safeguards, language requirements, or statutory obligations remain applicable notwithstanding this Agreement.

3.6 Customer Compliance Declaration

By accepting this Agreement and initiating production use of Abri with real Patient Information, the Customer represents and warrants that:

It has identified the laws and regulatory requirements applicable to its intended use.
It and the responsible Custodians have completed all legally required steps that must precede such use.
Any PIA required to be prepared and submitted before implementation has been prepared and submitted.
Required information management and data processing agreements are legally in effect.
Appropriate clinical privacy and security policies and procedures have been established.
The Customer has authority to provide the relevant Patient Information for processing through Abri.
The accepting individual has lawful authority to make these representations on behalf of the parties they represent.

These representations are continuing obligations while the Services are used.

A representation that a requirement has been completed does not replace the actual legal requirement.

3.7 Immediate Self-Service Provisioning

The Customer may create and provision a Clinic electronically upon acceptance of this Agreement.

We do not ordinarily require submission of PIA documentation, regulatory correspondence, or other Customer-specific filings as a condition of routine self-service provisioning.

We may rely on the Customer's contractual representations in providing self-service access.

However, we may request reasonable evidence of compliance where required by law, a regulator, a contractual obligation, or where we have reasonable grounds to question the accuracy of the Customer's representations.

We may restrict affected functionality where necessary to address a serious legal or security concern.

Automatic provisioning and availability of the software do not constitute certification or confirmation that the Customer has complied with all applicable requirements.

If the required prerequisites have not actually been completed, the Customer must not use the Clinic with real Patient Information until those requirements are satisfied.

3.8 Ongoing Compliance

The Customer must continue to comply with Applicable Law throughout its use of Abri.

It must reassess its legal and regulatory obligations when its operations, Custodians, integrations, information practices, or relevant legal requirements materially change.

3.9 Provider Documentation

We will make reasonably available information necessary for Customers to assess Abri, including appropriate details of:

Hosting and processing arrangements.
Relevant data flows.
Security controls.
Categories of Subprocessors.
Processing locations.
Retention and export procedures.
Incident notification procedures.
Other information reasonably required for applicable PIA preparation.

We may provide standard documentation through published resources, secure customer communications, or on reasonable request.

Our assistance does not transfer the Customer's statutory or professional compliance responsibilities to Scribeberry Ltd.

4. Patient Information and Data Rights

4.1 Custody and Control

Patient Information remains under the legal custody or control of the responsible Custodian, subject to Applicable Law and the rights of patients.

The Provider does not acquire ownership of medical records through the provision of Abri.

4.2 Processing Authority

The Customer and participating Custodians authorize us to process Customer Data to the extent necessary to:

Deliver the subscribed Services.
Store, retrieve, organize, and transmit authorized records.
Perform authorized instructions.
Maintain the security and reliability of Abri.
Provide support and troubleshooting.
Maintain backups and business continuity.
Fulfil legal obligations.

Such processing remains subject to this Agreement, Schedule A where applicable, and Applicable Law.

4.3 Restrictions

We will not sell Patient Information or use it for unrelated advertising, commercial profiling, or unrelated research.

We will not use identifiable Patient Information to train general-purpose AI models.

Secondary uses requiring a separate legal basis or authorization are not permitted merely because the Customer accepted these Terms.

4.4 Customer Instructions

The Customer must provide lawful instructions and maintain appropriate permissions.

We are not required to carry out instructions that we reasonably believe are unlawful or inconsistent with the rights of a Custodian or patient.

Where practicable, we will explain the concern and cooperate in identifying a lawful approach.

4.5 Competing Claims to Records

Where multiple persons claim authority over the same records, we may require reasonable verification of legal entitlement before processing disputed transfers, disclosures, or deletion instructions.

We will not knowingly use account ownership, subscription payment, or administrative privileges as the sole basis for resolving disputed Custodian rights.

We will preserve appropriate access for undisputed lawful purposes, including patient care, subject to security and legal requirements.

4.6 Confidentiality

Each party must protect the other party's confidential information with reasonable care.

Personnel and contractors receiving confidential information must have a legitimate need for access and be subject to appropriate confidentiality obligations.

Patient Information remains protected by Applicable Law regardless of ordinary contractual confidentiality exclusions.

5. Security and Data Protection

5.1 Provider Obligations

We will maintain reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of the information processed.

Our binding security and processing commitments are further described in Schedule B.

5.2 Customer Obligations

The Customer must maintain appropriate safeguards for its users, devices, networks, clinical workflows, and exported information.

These include appropriate authentication, role management, training, confidentiality practices, and oversight of access.

5.3 Incidents

We will notify affected Customers or Custodians of security incidents involving their Patient Information in accordance with Applicable Law and Schedule B.

Each party retains responsibility for mandatory notifications and reports imposed on that party by law.

5.4 Subprocessors

We may engage Subprocessors for functions reasonably necessary to provide the Services, subject to contractual confidentiality, security, lawful-processing, and accountability requirements.

We remain responsible for our own contractual obligations when using Subprocessors.

5.5 Data Residency

Production Patient Information held within Abri's core clinical records and associated persistent backups will be stored in Canada.

Any processing arrangement involving access, use, storage, or disclosure outside the relevant province or Canada must comply with Applicable Law, including applicable contractual safeguards, notices, and authorizations.

Customer-directed communications and independently selected external integrations may involve additional locations and risks, which the Customer must assess.

5.6 Material Processing Changes

We will provide appropriate notice of material changes to the processing of Patient Information, including new purposes, significant Subprocessor changes, or materially different processing locations.

Where Applicable Law or Schedule A requires additional consent, agreement, or assessment, the change will not be implemented for affected information until the relevant legal requirements are satisfied.

6. Artificial Intelligence and Integrations

6.1 Optional AI Functionality

Abri may include optional AI-powered features.

The Customer is responsible for determining whether those features are appropriate and lawful for its practice.

Healthcare professionals must appropriately review and verify AI-generated clinical content before relying on it.

6.2 Patient Consent

The Customer must obtain any consent, provide any notices, and maintain any other lawful authority required for recording, transcription, patient communications, AI processing, or related activities.

Acceptance of these Terms does not substitute for patient consent where it is legally required.

6.3 AI Training Restrictions

Patient Information processed through Abri will not be used by us or our contracted AI providers to train general-purpose AI models without a separate specific lawful authorization.

6.4 Integration Authorization

Integrations with other healthcare systems, including Scribeberry Scribe, must be appropriately enabled and authorized.

The Customer determines the lawful purposes, recipients, scope, and permissions for integrations it activates.

6.5 Third-Party Services

Independently operated services may be governed by separate agreements.

The Provider is not responsible for services independently controlled by the Customer or unrelated third parties, except to the extent imposed by Applicable Law or our express contractual commitments.

7. Clinical Records and Patient Communications

7.1 Accuracy

Healthcare professionals remain responsible for reviewing documentation and ensuring the accuracy and completeness of clinical records.

The Customer must validate migrated or imported records before clinical reliance.

7.2 Patient Communications

The Customer is responsible for ensuring lawful use of SMS, email, portal messaging, fax, and other communication channels.

It must address patient preferences, recipient verification, consent, and confidentiality risks.

Abri is not an emergency response service.

7.3 Access and Correction

Patient access and correction requests remain subject to Applicable Law.

The Customer and responsible Custodians determine whether requests should be granted and are responsible for meeting applicable legal deadlines.

We will provide reasonable assistance and refer requests received directly by us as described in Schedule A where applicable.

7.4 Minors and Representatives

The Customer must determine lawful authority for representatives, substitute decision-makers, guardians, and other proxy users.

Access must be revoked or modified where the underlying authority changes.

8. Fees, Billing, and Renewal

8.1 Fees

Subscription fees, payment intervals, included usage, and applicable taxes are disclosed before purchase.

The Customer agrees to pay applicable subscription charges.

8.2 Renewal

Unless the subscription confirmation provides otherwise, paid subscriptions automatically renew monthly until cancelled.

8.3 Cancellation

The Customer may cancel through the available account cancellation functionality or by contacting support.

Cancellation normally takes effect at the end of the current paid period.

8.4 Refunds

Prepaid fees are ordinarily non-refundable unless required by law or expressly stated otherwise.

If we terminate a subscription for convenience or permanently discontinue contracted Services, we will refund unused prepaid subscription fees on a proportionate basis.

8.5 Price Changes

We will provide at least 30 days' notice of price increases.

Price changes will take effect no earlier than the next applicable renewal following that notice.

8.6 Failed Payments

We will ordinarily provide at least 15 days' notice and an opportunity to resolve overdue payment before restricting ordinary access.

Such restrictions remain subject to required patient record continuity and lawful export obligations.

We will not assert ownership of Patient Information or a lien over patient records because of unpaid fees.

9. Availability, Suspension, and Changes

9.1 Availability

We will use reasonable care and skill to operate the Services.

Availability may be affected by maintenance, outages, security incidents, network failures, or other technical events.

Specific service levels are binding only if expressly included in the subscription arrangement.

9.2 Suspension

We may suspend affected functionality where reasonably necessary to address:

Unlawful use.
Material contractual breach.
A serious security threat.
Unauthorized access.
A binding legal direction.
Material non-compliance with required legal prerequisites.
Unresolved payment default after applicable notice.

Suspension will be proportionate and limited to what is reasonably necessary.

9.3 Record Continuity During Suspension

We will take reasonable measures to preserve lawful Custodian access to records necessary for patient care, retention, patient rights, and authorized export.

Restricted or alternative secure access may be provided where ordinary access must be suspended.

9.4 Product Changes

We may update and improve Abri.

We will not materially reduce contracted core record-access or export functionality during a prepaid subscription term without providing a suitable alternative or a right to terminate and obtain a proportionate refund of unused prepaid fees.

9.5 Amendments

We will ordinarily give at least 30 days' notice of material changes to this Agreement.

Material commercial changes will apply prospectively at renewal unless an earlier change is legally required or separately accepted.

A material change requiring additional lawful authorization cannot be imposed solely through continued use.

10. Termination and Record Continuity

10.1 Termination by Customer

The Customer may cancel its subscription in accordance with Section 8.

The Customer may terminate for our material breach after giving 30 days' written notice and a reasonable opportunity to cure, unless immediate termination is legally required.

10.2 Termination by Provider

We may terminate for a material breach remaining uncured for 30 days after notice.

Earlier termination may occur where continuing the arrangement would be unlawful or present an immediate serious risk.

We may terminate for convenience on at least 90 days' notice.

10.3 Patient Information

Termination does not transfer legal custody or ownership of Patient Information to Scribeberry Ltd.

Patient Information must be handled according to Applicable Law and Schedule C.

10.4 Data Portability

The Customer and verified Custodians have rights to lawful data export and transition assistance as described in Schedule C.

One standard complete Clinic export will be provided without an additional export fee, subject to applicable Custodian rights and lawful authorization.

10.5 Departing Custodians

A physician's departure, a change in clinic administration, or termination of a subscription does not automatically authorize another person to delete, retain, or transfer that physician's records.

Applicable Custodian rights and legal requirements continue to govern.

10.6 Continuing Obligations

Confidentiality, data protection, record access, retention, export, liability, and other provisions intended to survive will remain effective to the extent necessary.

11. Warranties and Liability

11.1 Provider Commitments

We warrant that we will provide the Services with reasonable skill and care, substantially perform documented core functions, and comply with Applicable Law governing our activities.

We will fulfil our express confidentiality, data protection, security, and record-transition obligations.

11.2 Customer Commitments

The Customer warrants that its instructions and use of the Services are lawful and that it has the necessary authority to process the information it submits.

11.3 Limitations

No software system can be guaranteed to be continuously available or entirely free from defects.

Except for express commitments and rights that cannot lawfully be excluded, implied warranties are excluded to the extent permitted by law.

11.4 General Liability Cap

Subject to the exceptions below, each party's aggregate contractual liability arising from this Agreement is limited to the greater of:

CAD $10,000; or
The fees paid or payable for the affected subscription during the preceding 12 months.

11.5 Privacy and Security Liability Cap

For breach of confidentiality or data protection obligations, including unauthorized processing of Patient Information, each party's aggregate contractual liability is limited to the greater of:

CAD $100,000; or
Twice the annual fees paid or payable for the affected subscription.

11.6 Exceptions

Neither liability cap limits liability for:

Fraud.
Wilful misconduct.
Gross negligence.
Death or personal injury caused by negligence.
Unpaid agreed fees.
Liability that cannot lawfully be limited.

Reasonable documented investigation, legally required notification, record restoration, and migration costs resulting from a party's breach are treated as direct losses, subject to any applicable lawful cap.

Neither party is liable for indirect or consequential losses or lost profits to the extent permitted by Applicable Law.

These provisions do not limit statutory patient rights or regulatory authority.

11.7 Third-Party Claims

We will defend the Customer against qualifying third-party claims that software supplied by us infringes Canadian intellectual property rights, subject to the applicable liability provisions.

The Customer will defend us against qualifying third-party claims directly caused by its knowingly unlawful instructions or content, excluding claims attributable to our own breach or independent legal obligations.

The party seeking indemnification must give reasonably prompt notice and appropriate cooperation.

Neither party may enter into a settlement imposing admissions or non-monetary obligations on the other without consent.

11.8 No Transfer of Statutory Duties

Nothing in this Agreement excuses us from requirements imposed on information managers, service providers, or other persons under Applicable Law.

Nothing in this Agreement transfers a Custodian's non-delegable statutory duties to us.

12. General Provisions

12.1 Governing Law

This Agreement is governed by the laws of Alberta and applicable federal laws of Canada, subject to mandatory laws applying in other jurisdictions.

12.2 Disputes

The parties will first attempt to resolve ordinary contractual disputes through good-faith discussions.

The courts of Alberta have jurisdiction, subject to mandatory Applicable Law.

Nothing restricts legally required reporting, privacy complaints, or urgent protective proceedings.

12.3 Assignment

Neither party may assign this Agreement without the other's reasonable consent, except to a lawful successor acquiring substantially all of the relevant business and assuming the applicable obligations.

Any transfer of Patient Information must independently comply with Applicable Law.

12.4 Corporate Reorganization

Scribeberry Ltd. may reorganize its corporate structure or establish separate subsidiaries or affiliates.

Such changes do not automatically transfer contractual responsibility or authorize disclosure of Patient Information to another legal entity.

Any substitution of Provider or transfer of regulated information must satisfy applicable legal and contractual requirements.

12.5 Entire Agreement

This Agreement and the applicable subscription confirmation constitute the entire contractual agreement regarding the subscribed Abri Services, except for any expressly agreed supplementary terms.

12.6 Severability

If any provision is held unenforceable, the remaining provisions continue to apply to the extent permitted by law.

12.7 Waiver

A failure to enforce a provision does not constitute waiver of future enforcement.

12.8 Force Majeure

Neither party is liable for delays arising from events reasonably beyond its control, except where liability cannot lawfully be excluded.

Such events do not eliminate applicable duties to safeguard Patient Information or take reasonable continuity and incident-response measures.

12.9 Electronic Communications

The Customer agrees to receive contractual and service communications electronically, except where another form is required by law.

12.10 Contact

Scribeberry Ltd.
Abri EMR
Alberta, Canada

Support, legal notices, and privacy enquiries: hello@scribeberry.com

Security incident reports: hello@scribeberry.com, marked "Urgent — Abri Security Incident"

Customer notices will be sent to the registered account contact or another designated contractual contact.

Schedule A — Alberta Information Manager Agreement

This Schedule forms an Information Manager Agreement ("IMA") under section 66 of Alberta's Health Information Act and section 7.2 of the Health Information Regulation.

It applies where a Participating Custodian is subject to the HIA and Scribeberry Ltd. provides information management services relating to that Custodian's health information.

The parties to this IMA are:

Information Manager: Scribeberry Ltd., the Provider identified in this Agreement.

Custodian: Each Alberta Custodian identified in the applicable Clinic and acceptance records who has personally accepted this Agreement or has been validly represented by the accepting individual.

Effective Date: The date of valid electronic acceptance on behalf of the Custodian.

The Provider offers this IMA as part of this consolidated Agreement. The Custodian's valid electronic acceptance, personally or through an authorized representative, executes this IMA.

Where the accepting individual lacks authority to bind a Custodian, that Custodian is not a party to this IMA merely because the Customer subscribes to Abri.

A1. Objectives and Principles

The objective of this IMA is to permit the Information Manager to provide secure electronic medical records and associated information management services to the Custodian.

The parties agree to be guided by the following principles:

Compliance with the HIA and Health Information Regulation.
Preservation of the Custodian's lawful custody and control.
Collection, use, and disclosure only for authorized purposes.
Appropriate safeguards for health information.
Confidentiality, integrity, and availability of health records.
Accountability and cooperation with lawful regulatory oversight.
Preservation of patient rights.
Responsible retention, return, and destruction of information.

The Information Manager acknowledges its obligations under the HIA, its regulations, and this IMA in relation to health information provided by the Custodian.

A2. Appointment and Services

The Custodian appoints Scribeberry Ltd. to provide information management and information technology services through Abri.

The authorized services include, as applicable to the subscribed features:

Hosting and storage of electronic medical records.
Retrieval, display, organization, and indexing of records.
Clinical documentation management.
Appointment and scheduling information management.
Patient administration and related workflows.
Forms and document management.
Authorized data transmission and integrations.
Backup and recovery.
Security and access management.
Technical maintenance and support.
Authorized record export and transition.
Other functionality expressly authorized within the Services.

The Information Manager acts on behalf of the Custodian for these services and does not acquire independent clinical custody or authority to use health information for unrelated purposes.

A3. Collection of Health Information

The Custodian authorizes the Information Manager to collect health information necessary to provide the contracted Services.

This may include:

Patient names and identifiers.
Contact and demographic information.
Medical histories and clinical notes.
Diagnoses, medications, allergies, and treatment information.
Laboratory and diagnostic information.
Referrals and correspondence.
Appointments and scheduling information.
Billing and administrative records containing health information.
Clinical documents and attachments.
Other health information lawfully submitted for the authorized Services.

Information may be collected from the Custodian, its authorized affiliates, patients using authorized patient-facing functions, or another person or Custodian where the relevant collection is lawfully authorized.

The Information Manager is not independently authorized to collect information from unrelated Custodians or other persons for unrelated purposes.

Collection from another Custodian must be within an authorized clinical workflow and subject to the applicable authority, permissions, and agreements.

A4. Authorized Uses

The Information Manager may use health information received from the Custodian only for purposes necessary to:

Provide the Services.
Store, retrieve, maintain, organize, and transmit authorized records.
Perform lawful Custodian instructions.
Provide necessary technical support.
Implement appropriate safeguards and monitoring.
Maintain backups and service continuity.
Perform authorized data restoration or migration.
Fulfil legally required obligations.

The Information Manager must not use the information for unrelated commercial purposes, targeted advertising, unrelated research, general AI model training, or other unauthorized purposes.

Any additional use requires a separate lawful basis and authorization where required.

A5. Authorized Disclosures

The Information Manager may disclose health information only:

To the Custodian or its appropriately authorized affiliates.
To Authorized Users within their lawful permissions.
To patients or representatives through functions expressly authorized by the Custodian.
To other healthcare providers or recipients pursuant to a lawful Custodian instruction.
To contracted Subprocessors where necessary for the Services and subject to required safeguards and agreements.
Where disclosure is required or otherwise permitted by Applicable Law.

The Information Manager may not independently disclose health information for unrelated purposes.

Disclosures through optional integrations must be lawfully authorized.

The Custodian is responsible for determining the lawful basis for clinical disclosures it directs.

A6. Access Requests

The Custodian retains responsibility for decisions on requests for access to health information under Part 2 of the HIA.

The Information Manager will not independently determine whether an individual's statutory access request should be granted or refused unless legally required or separately authorized.

If the Information Manager receives a request directly, it will:

Record the request as appropriate.
Refer it to the designated Custodian or authorized privacy contact without undue delay.
Avoid disclosing the requested information without lawful authority.
Provide reasonable technical assistance necessary for the Custodian to respond within applicable deadlines.

The Information Manager will cooperate with lawful access instructions.

A7. Correction and Amendment Requests

The Custodian retains responsibility for deciding requests to correct or amend health information under Part 2 of the HIA.

The Information Manager will refer requests it receives directly to the relevant Custodian or designated privacy contact without undue delay.

It will provide reasonable technical assistance to carry out lawful corrections or amendments.

Where required, appropriate audit history and record integrity must be preserved.

A8. Expressed Wishes Concerning Disclosure

The Custodian is responsible for considering and responding to expressed wishes of individuals concerning disclosure of their health information as required by the HIA.

The Information Manager will not independently adjudicate such wishes unless legally required or specifically authorized.

Where the Information Manager receives an expressed wish directly, it will refer the matter to the Custodian without undue delay.

The Information Manager will implement lawful instructions concerning applicable access or disclosure restrictions within the functionality and procedures available under the Services.

The Custodian must ensure that restrictions requiring operational action beyond available technical controls are managed through appropriate clinic procedures.

A9. Protection and Management of Health Information

The Information Manager will protect and manage health information in accordance with the HIA, Health Information Regulation, this IMA, and Schedule B.

It will maintain reasonable safeguards against unauthorized access, use, disclosure, alteration, loss, and destruction.

Its personnel and Subprocessors must be subject to appropriate confidentiality and security obligations.

Health information remains under the lawful custody or control of the Custodian.

The Information Manager must not assert ownership or independent control over patient records.

A10. Subcontracting and Subprocessors

The Information Manager may engage Subprocessors necessary to provide the authorized Services, subject to contractual safeguards appropriate to the information and risks.

Subprocessor arrangements must limit processing to authorized purposes and impose appropriate confidentiality, security, incident reporting, and return or destruction obligations.

The Information Manager remains accountable for its performance under this IMA.

The Information Manager will make relevant Subprocessor and processing-location information reasonably available to the Custodian and provide required notice of material changes.

No Subprocessor may receive broader rights to use Patient Information than those lawfully granted to the Information Manager.

A11. Processing Outside Alberta

The parties acknowledge that Canadian cloud infrastructure and service providers may operate in provinces outside Alberta.

Before health information is stored, used, or disclosed by a person in a jurisdiction outside Alberta, the parties must ensure compliance with the written-agreement and safeguarding requirements of section 8(4) of the Health Information Regulation, where applicable.

For processing covered by this IMA:

The Custodian retains custody or control of the health information.
The Information Manager must use contractual and technical measures addressing risks associated with the relevant processing location.
Appropriate security safeguards must be implemented and maintained.
The Custodian must be able to reasonably monitor compliance with the applicable contractual safeguards.
Contractual and legal remedies remain available for non-compliance.
The Information Manager must ensure that required downstream written arrangements are in place, and cooperate in obtaining any agreement that Applicable Law requires the Custodian to execute directly.

The Information Manager will not intentionally introduce a new materially different processing arrangement inconsistent with these requirements.

This IMA does not, by itself, substitute for a separate direct agreement with another person where such an agreement is specifically required by law.

A12. Monitoring and Audit

The Custodian may reasonably monitor compliance with this IMA.

The Information Manager will provide appropriate information, records, or independent assurance reasonably necessary to demonstrate compliance, subject to confidentiality and the security of other customers.

The Custodian may request a proportionate audit or compliance review where reasonably necessary, including following a material incident or identified compliance concern.

The parties will coordinate the scope, confidentiality, timing, and method of such a review.

A review may be supported through relevant independent audit reports, security evidence, documentation, and other proportionate measures.

Where a direct inspection is legally required and cannot reasonably be satisfied through alternative evidence, the parties will cooperate in arranging an appropriate inspection subject to necessary protections.

The Information Manager will address substantiated material deficiencies within a reasonable period appropriate to the risk and legal requirements.

A13. Security Incidents

The Information Manager must notify the Custodian without undue delay upon becoming aware of a suspected or confirmed incident materially affecting the confidentiality, integrity, or availability of the Custodian's health information.

The Information Manager will provide information reasonably available about the incident, its effects, containment, and remediation.

It will cooperate with the Custodian in meeting applicable reporting, notification, and investigation obligations.

The Custodian retains responsibility for statutory notifications assigned to the Custodian, while the Information Manager retains its own statutory duties.

A14. Return, Retention, and Destruction

Upon termination of the relevant Services or IMA, the Information Manager will protect, return, retain, or securely destroy health information in accordance with the Custodian's lawful instructions, Schedule C, and Applicable Law.

Records must not be destroyed contrary to mandatory retention obligations or lawful Custodian instructions.

Copies no longer required must be securely destroyed in accordance with applicable retention, backup, and legal requirements.

The Information Manager will provide reasonable confirmation of completed destruction when requested.

Where return or destruction is legally or technically infeasible, applicable safeguards and restrictions on further use will continue.

A15. Term and Termination

This IMA takes effect upon valid electronic acceptance and continues for the period during which the Information Manager provides services involving health information for the relevant Custodian.

Either party may terminate the IMA for material breach after written notice and a reasonable opportunity to cure, ordinarily 30 days, unless immediate termination is legally required.

The Custodian may terminate the IMA where required to fulfil its statutory responsibilities.

Termination does not eliminate continuing obligations regarding confidentiality, patient rights, retention, return, destruction, incident cooperation, or mandatory legal duties.

The Information Manager must cooperate in an orderly transition consistent with Schedule C.

Where the Customer's commercial subscription ends but the Information Manager continues to hold health information on behalf of a Custodian, the protections and obligations of this IMA continue to apply for as long as that information is held.

A16. Regulatory Compliance

The parties acknowledge that the HIA and its regulations apply notwithstanding inconsistent contractual provisions.

Nothing in this IMA excuses the Information Manager from compliance with its statutory obligations.

Nothing in this IMA relieves the Custodian of obligations that cannot lawfully be delegated.

A17. Electronic Execution

The Information Manager offers this IMA as part of the consolidated Abri EMR Agreement.

The electronic acceptance recorded for a legally identified Custodian, or an individual with valid authority to execute this IMA on that Custodian's behalf, constitutes acceptance and execution by that Custodian.

No additional signature is required unless Applicable Law or a specific lawful requirement provides otherwise.

The identity and representative capacity of the accepting person, the applicable Custodian, the accepted version, and the effective date are determined by the acceptance and associated Clinic records.

Schedule B — Security and Data Processing Terms

This Schedule describes the Provider's contractual security and data-processing commitments.

It applies to Customer Data processed through Abri.

B1. Roles

The Customer and legally responsible Custodians determine the purposes and lawful authority for processing Patient Information.

The Provider acts as a service provider and, where applicable, an information manager or other legally recognized processor in performing the contracted Services.

The Provider may separately process limited account, billing, contact, and operational information for legitimate service administration and its own legal obligations.

B2. Processing Activities

Authorized activities include:

Receipt and storage of information submitted through Abri.
Display, search, indexing, and retrieval.
Maintenance and organization of medical records.
Authorized clinical and administrative workflows.
Secure transmission and integrations.
Backup, recovery, and technical maintenance.
Authorized support and troubleshooting.
Security logging and monitoring.
Return, export, and lawful destruction.

B3. Technical and Organizational Safeguards

The Provider will maintain safeguards appropriate to the risks and sensitivity of the information, including:

Encryption of Patient Information in transit and at rest.
Individual user authentication and role-based access controls.
Appropriate protection of privileged accounts.
Logical separation of customer environments and information.
Logging of material access and security-relevant events.
Restricted administrative and support access.
Secure management of credentials, secrets, and encryption keys.
Vulnerability management and security maintenance.
Secure backups and appropriate recovery arrangements.
Security monitoring and incident response procedures.
Personnel confidentiality obligations and appropriate training.
Reasonable business continuity and disaster recovery procedures.

The Provider will review and update safeguards in response to evolving risks, material changes, and legal requirements.

B4. Confidentiality and Personnel

Access to Patient Information by Provider personnel will be restricted to legitimate, authorized operational purposes.

Personnel must be subject to appropriate confidentiality and security obligations.

Access must be revoked when no longer required.

B5. Data Residency and Location

The Provider will maintain primary storage and persistent backups of production Patient Information in Canada.

Relevant processing locations and Subprocessors will be documented and made reasonably available to Customers for regulatory assessments.

A Customer's activation of an optional integration, communication channel, or external service may involve information flows beyond the core storage environment.

Such flows remain subject to lawful authorization and applicable safeguards.

B6. Subprocessor Requirements

The Provider will require Subprocessors handling Patient Information to:

Process information only for authorized purposes.
Protect information using appropriate safeguards.
Maintain confidentiality.
Restrict personnel access.
Report relevant security incidents to the Provider.
Cooperate with lawful investigation and remediation.
Return or securely destroy information as required.
Comply with applicable contractual and legal restrictions.

The Provider will maintain oversight proportionate to the sensitivity of information and the services performed.

B7. Security Incident Management

Upon becoming aware of a suspected or confirmed material security incident affecting Customer Data, the Provider will take reasonable steps to investigate, contain, assess, and remediate the incident.

Affected Customers or Custodians will be notified without undue delay and within any mandatory legal or contractual deadline.

Notification will be updated as material information becomes available.

The Provider will reasonably cooperate with affected Customers concerning legally required notifications and regulatory responses.

B8. Backup and Recovery

The Provider will maintain backup and recovery measures appropriate to an electronic medical records platform.

Backups will be protected using appropriate access controls and security safeguards.

Backup and restoration processes will be reviewed and tested on a risk-appropriate basis.

No specific recovery time or recovery point objective is guaranteed unless expressly agreed in a service-level commitment.

B9. Audit and Compliance Support

The Provider will maintain reasonable records of relevant security controls and processing arrangements.

Appropriate information necessary for Customer compliance assessments will be provided upon reasonable request.

Disclosure of security information may be subject to reasonable confidentiality and access restrictions.

B10. Prohibited Processing

The Provider will not use Patient Information for:

Targeted advertising.
Sale to third parties.
Unrelated commercial profiling.
Unrelated research.
Training general-purpose AI models without separate specific lawful authorization.

B11. Retention and Deletion

Customer Data will be handled according to Schedule C and Applicable Law.

Operational logs, backups, and other protected copies will be retained only for appropriate operational, contractual, or legal purposes.

B12. Changes

Material changes to security safeguards, processing purposes, relevant Subprocessors, or processing locations will be managed in accordance with this Agreement and Applicable Law.

The Provider will not rely solely on a unilateral update to authorize processing that legally requires further consent, agreement, or assessment.

Schedule C — Record Retention and Exit Policy

This Schedule governs retention, access, export, transition, and disposition of Patient Information.

C1. Custodian Responsibility

Each Custodian remains responsible for meeting the medical-record retention and patient access requirements applicable to its practice.

Subscription cancellation does not eliminate these obligations.

C2. Records During Subscription

During an active subscription, Patient Information will ordinarily remain available according to the subscribed Services and applicable permissions, subject to lawful deletion instructions, security restrictions, and Applicable Law.

The Provider will not ordinarily delete production Patient Information merely because it is old or inactive.

C3. Data Export

The Customer and verified Custodians may request lawful exports of Patient Information.

Exports will be supplied in reasonably accessible, structured, and commonly used electronic formats appropriate to the information and supported export functionality.

Where available, supported structured clinical information may be exported using appropriate healthcare interoperability formats, with associated documents supplied in suitable electronic formats.

The exact available export formats depend on the types of records and functionality supported.

C4. Standard Export Fee

One standard complete Clinic export will be provided without an additional export fee at termination or transition, subject to lawful Custodian access and disclosure rights.

Where multiple Custodians have separate legal entitlements, the scope of each export must respect those entitlements.

Additional bespoke conversion, customization, or migration services may be separately quoted.

The Provider will not use payment disputes to obstruct a standard export that must be provided under this Agreement or Applicable Law.

C5. Transition Period

Upon ordinary subscription termination, the Provider will make reasonable arrangements for secure export and transition.

Unless a shorter period is legally required or necessary to address a serious security threat, the Provider will make at least 30 days of secure transition access available for export or lawful record transfer following the effective termination date.

Access during transition may be restricted to read-only or export functionality.

Additional long-term hosting or archival services may require a separate paid arrangement.

C6. Custodian Departures

Where a Custodian leaves a Clinic, the Provider will respect applicable legal rights concerning access, retention, and transfer of records.

A Clinic administrator cannot automatically delete or withhold a departing Custodian's records solely because that Custodian has left the practice.

The Provider may require reasonable evidence of identity and legal authority before releasing information.

C7. Conflicting Instructions

Where there is a dispute concerning lawful custody or control, the Provider may temporarily refrain from acting on disputed instructions while seeking clarification or sufficient evidence of authority.

The Provider will not unnecessarily restrict undisputed lawful access required for patient care or statutory obligations.

C8. Record Retention Following Termination

Patient Information will not be automatically destroyed merely because a commercial subscription terminates.

The Customer and relevant Custodians must arrange continuing lawful retention and access.

Where no lawful transition or disposition instructions have been received, the Provider will take reasonable steps to protect the information, notify the responsible parties, and seek appropriate instructions.

The Provider is not required to provide indefinite free hosting following termination.

Any continuing archive or storage service may be subject to a separate arrangement and reasonable disclosed fees.

C9. Secure Destruction

Following lawful authorization and completion of any required transition, information no longer required may be securely destroyed.

Destruction must respect statutory retention periods, legal holds, and other Applicable Law.

Protected copies within backups may remain until they are removed through applicable secure backup-retention processes.

Such copies must remain protected and must not be used for unrelated purposes.

C10. Confirmation

Upon reasonable request, the Provider will provide confirmation of completed return or destruction activities where applicable and available.

C11. Continuing Protections

All confidentiality, security, lawful-processing, and Custodian protections continue for Patient Information retained following termination.

Part II — Final Acceptance and Acknowledgement

By electronically accepting this Agreement, the accepting individual confirms and agrees that:

They have read and agree to the Abri EMR Terms of Service, including all applicable schedules.
They are authorized to accept the Agreement on behalf of the Customer.
Where they purport to represent one or more Custodians, they possess valid authority to do so.
They understand that the Customer and responsible Custodians remain responsible for applicable privacy, health-information, professional, and regulatory compliance obligations.
They confirm that all legally required pre-implementation steps for the intended production use have been completed.
Where Alberta's HIA applies, they confirm that the responsible Custodian has prepared and submitted any required PIA before implementation and has entered into a legally valid IMA.
They understand that the Alberta IMA in Schedule A is executed by this acceptance only for Custodians who personally accept or are validly represented.
They understand that activation of Abri does not constitute regulatory approval or independent verification of their legal compliance.
They consent to electronic execution, communications, and retention of appropriate contractual acceptance records.

Agreement Effective Date: The date and time of valid electronic acceptance.

Provider: Scribeberry Ltd.

Customer: The person or legal entity identified in the subscription records.

Participating Alberta Custodians: Those identified by the applicable records and validly bound through personal acceptance or authorized representation.

Electronic Signature: The authenticated, affirmative acceptance action associated with this Agreement and its recorded version.

End of Agreement.