Privacy Policy

1. Who We Are

One9 AI Inc. is a federally incorporated Canadian company (incorporated July 11, 2026 under the Canada Business Corporations Act), headquartered in Calgary, Alberta, Canada.

We provide AI-powered communication tools for appointment-based businesses, including our Sara AI Receptionist and Virtual Waiting Room products. Our services are designed for Canadian businesses.

2. Applicable Privacy Laws

One9 AI Inc. is committed to handling personal information in accordance with applicable Canadian privacy legislation, including:

• PIPEDA — Personal Information Protection and Electronic Documents Act (federal)
• Alberta PIPA — Personal Information Protection Act (Alberta)

Healthcare clients that are custodians of health information under the Alberta Health Information Act (HIA) are responsible for determining their own obligations under that legislation. Where One9 AI acts as an information manager for a clinic custodian, the parties will enter into an appropriate information-manager agreement as required by HIA. Clinic clients are responsible for determining whether a Privacy Impact Assessment or regulatory submission is required for their use of One9 AI services.

One9 AI is a Canadian company. Our services are not represented as HIPAA-compliant for United States healthcare organizations. Our primary database is hosted in Canada. Some third-party service providers used to deliver our services may process information outside Canada where necessary for service delivery. We take reasonable steps to select providers with appropriate safeguards.

3. What Information We Collect

3.1 Information collected through Sara AI Receptionist

When a patient or caller contacts a clinic using our Sara AI Receptionist service, Sara may collect the following information on behalf of the clinic:

• Caller's name
• Reason for the call or visit
• Preferred doctor or service requested
• Preferred appointment date and time
• Callback phone number
• Whether the caller is a new or existing patient
• Date of birth, health card number, or another patient identifier, only where specifically required and authorized by the clinic for patient identification or intake
• Call transcript — a text-based record of the conversation generated by speech-to-text technology
• Call audio recording: Vapi, the voice platform powering Sara, may record calls and store recordings, transcripts and related call history on its infrastructure according to One9 AI's account configuration. Retention periods may vary based on the applicable configuration and service plan. Clinics with specific recording or retention requirements should contact One9 AI.
• Urgency classification (Routine / Follow-up / High Priority / Immediate) assigned by Sara based on information stated by the caller

Callers are informed at the beginning of the call that they are interacting with an AI virtual receptionist and that the call may be recorded and transcribed. Recording and transcription are subject to the clinic's instructions and applicable consent requirements.

This information is collected on behalf of the clinic and is subject to the clinic's custody and control. One9 AI processes it solely to deliver and support the contracted service.

3.2 Information collected through the Virtual Waiting Room

When a patient checks in using our Virtual Waiting Room product, we may collect:

• Patient name
• Phone number
• Reason for visit or service requested
• New or existing patient status

3.3 Information collected through our website

When you visit one9ai.com, we may collect:

• Name and email address (if you submit a contact or demo request form — voluntary)
• Phone number (if provided voluntarily)
• Aggregated or pseudonymous website usage information collected through Google Analytics, such as pages visited, device type and general geographic location

4. How We Use Information

One9 AI uses collected information only for the following purposes:

• To operate and deliver the Sara AI Receptionist and Virtual Waiting Room services to clinics
• To generate call summaries and populate the One9 AI staff dashboard
• To send SMS notifications to patients on behalf of clinics (only when initiated by clinic staff)
• To respond to demo requests and business inquiries submitted through our website
• To monitor system performance and resolve technical issues
• To comply with applicable Canadian law

We do not use patient or clinic information for marketing, advertising, or profiling, or for any purpose beyond delivering and supporting the contracted service.

One9 AI does not use clinic or patient information to train its own general-purpose artificial intelligence models. Third-party artificial intelligence and speech providers process information according to their applicable service terms, contractual arrangements and the account configurations selected by One9 AI. One9 AI reviews available privacy and data-use controls and takes reasonable steps to configure its services consistently with its privacy obligations.

5. Data Custody and Control

6. Where Your Data Is Stored and Processed

One9 AI uses the following infrastructure to store and process information:

• Primary database storage: Supabase (PostgreSQL) — Canada Central region, Montreal, Quebec (ca-central-1). Patient and clinic records are stored here.
• Backend application processing: Railway — US West. Application logic runs here; patient records are stored in the Canadian database referenced above.
• Dashboard and website hosting: Netlify — CDN delivery; no patient records stored at the CDN layer.
• Voice, telephony, AI, and transcription processing: Vapi, Anthropic (Claude), Deepgram, and Twilio. These providers may process call audio, transcripts, and related information outside Canada as part of delivering their respective services.

Information processed outside Canada by third-party providers may be subject to the laws of the jurisdiction in which that processing occurs, including laws that may allow access by foreign authorities. We take reasonable steps to select providers with appropriate security safeguards and data-handling practices.

7. Third-Party Service Providers

One9 AI uses third-party providers to operate and support its services. One9 AI seeks to limit the information made available to each provider to information reasonably necessary for that provider's function. Providers process information under their applicable service terms, privacy terms, data-processing terms and account configurations. One9 AI takes reasonable steps to assess providers and available safeguards before using them to process personal information.

We do not sell, rent, trade, or disclose personal information to any third party for marketing or commercial purposes.

8. Data Security

One9 AI maintains reasonable administrative, technical, and physical safeguards to protect information processed through our services, including:

• Secure, cryptographically signed JWT-based authentication for dashboard access
• Encrypted database connections (SSL/TLS)
• Access to clinic and patient data restricted to authorized One9 AI personnel
• Daily automated database backups (Supabase Pro plan)
• Continuous uptime monitoring

No method of electronic transmission or storage is 100% secure. One9 AI maintains an incident-response process and will notify clinic clients, affected individuals, and regulators when required by applicable law. Where a security incident involves clinic-controlled information, One9 AI will communicate with the affected clinic according to the service agreement or applicable information-manager agreement.

9. Data Retention

Call records, summaries, and patient information collected through the Sara AI Receptionist are retained for the duration of the clinic's active service agreement. Upon termination, One9 AI will return or securely delete clinic data within the timeframe specified in the applicable service agreement, subject to legal requirements and ordinary backup-deletion cycles.

Call audio recordings, transcripts and related call history stored by Vapi are subject to One9 AI's account configuration and the applicable Vapi service plan. Retention periods may vary. Clinics with specific retention requirements should contact One9 AI to discuss configuration options.

Website inquiry data (demo requests, contact forms) is retained for business communication purposes. Providing this information is voluntary. We use it only to respond to your inquiry and will delete it upon request, subject to applicable legal and record-retention obligations.

10. Your Privacy Rights

Under PIPEDA and Alberta PIPA, individuals may have the right to:

• Know what personal information we hold about them
• Request access to their personal information
• Request correction of inaccurate information
• Withdraw consent to the collection or use of their information
• Request deletion or de-identification of their personal information

Deletion and withdrawal requests are subject to applicable legal, contractual, and record-retention obligations. We will respond to privacy requests within the timeframe required by applicable law.

To submit a request, please contact us at samra@one9ai.com.

Note: For patient information collected on behalf of a clinic, the clinic is the custodian of that information under applicable law. Requests relating to patient data should be directed to the relevant clinic in the first instance.

11. Processing Outside Canada

Some trusted service providers used by One9 AI may process information outside Canada in order to provide telephony, AI processing, speech recognition, and hosting services. This includes:

• Vapi — AI voice agent platform and call recording storage
• Anthropic (Claude) — AI language processing
• Deepgram — speech-to-text transcription
• Twilio — telephony and SMS delivery
• Railway — backend application hosting (US West)

Information transferred to or processed in other jurisdictions may be subject to the laws of those jurisdictions, including laws that permit access by foreign courts, law enforcement, or regulatory authorities. We take reasonable steps to select providers with appropriate security and privacy practices.

12. Use of Artificial Intelligence

Our Sara AI Receptionist uses artificial intelligence and speech technologies to communicate with callers, transcribe conversations, generate structured call summaries, and classify the urgency of incoming calls.

• AI may transcribe, summarize, and classify calls. These outputs are generated automatically and may contain errors or inaccuracies.
• Authorized clinic personnel should review AI-generated summaries and classifications before relying on them for operational or clinical decisions.
• Sara does not provide medical advice, clinical diagnoses, or treatment recommendations of any kind. All clinical decisions remain the exclusive responsibility of the clinic and its qualified staff.
• Sara is not an emergency service. Callers experiencing or reporting a medical emergency should call 911 or proceed to the nearest emergency department.
• Callers interacting with Sara are communicating with an AI virtual receptionist. Sara is designed to identify itself as a virtual assistant during calls.

13. Cookies and Analytics

Our website (one9ai.com) uses Google Analytics to understand how visitors interact with the site. This may include aggregated or pseudonymous website usage information such as pages visited, time on site, and general geographic location (city level only). Google Analytics is provided by Google LLC and is subject to Google's own privacy policy and terms.

We do not use cookies to track individuals across third-party websites or to serve targeted advertising. You may disable cookies in your browser settings or opt out of Google Analytics data collection at tools.google.com/dlpage/gaoptout.

14. Changes to This Policy

One9 AI Inc. may update this Privacy Policy from time to time as our services evolve or as required by law. The effective date at the top of this page will reflect the most recent update.

For material changes, we will notify active clinic clients directly by email at least 14 days before the change takes effect.

15. Contact Us

For any privacy questions, concerns, or requests, please contact:

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada at www.priv.gc.ca or the Office of the Information and Privacy Commissioner of Alberta at www.oipc.ab.ca.