Data Agreement (BAA / Information Manager)
The agreement covering health information Medibrio handles for the clinic: a HIPAA Business Associate Agreement in the United States, an information manager / HINP agreement in Canada.
Version 2026.1
Permitted uses
Medibrio uses and discloses health information only to provide the service to the clinic, for proper management of its own operations, or as required by law. No other use is permitted, and information is never sold or used for marketing.
Safeguards and subcontractors
We apply administrative, physical and technical safeguards appropriate to the sensitivity of the information, and we bind every subcontractor that may handle health information (hosting, telecom, AI processing) to the same obligations in writing.
Incident reporting
Any use or disclosure not permitted by this agreement, and any security incident affecting health information, is reported to the clinic without unreasonable delay and in any case within the period required by applicable law, with the details needed for the clinic to notify individuals and regulators.
Individual rights
We give the clinic the tools and assistance it needs to provide access, correction, an accounting of disclosures, and restrictions requested by a patient, within the timelines set by law.
Return or destruction
On termination, the clinic may export all health information. Remaining copies are destroyed or, where destruction is not feasible, protections continue to apply for as long as the information is retained.
Signature
Acceptance of this agreement by the clinic administrator, recorded with date, time and address, has the same effect as a signed copy. A countersigned PDF is available on request at info@medibrio.com.