Privacy Policy

A.I. VALI INC.

Effective Date: November 6, 2026

1. Introduction

A.I. VALI INC. (“A.I. Vali,” “we,” “us,” or “our”) is a Canadian medical technology company that provides artificial intelligence tools for medical image analysis and clinical reporting. This Privacy Policy explains how we collect, use, disclose, and protect personal information in connection with our website https://www.ai-vali.com and related marketing and commercial activities (collectively, the “Website”).

This Policy is designed to address our primary obligations under Canadian law (PIPEDA and substantially similar provincial laws), the EU General Data Protection Regulation (GDPR) where it applies, and relevant U.S. state privacy laws (including the California Consumer Privacy Act as amended by the CPRA). It is written in plain language so that individuals can understand our practices.

Important distinction: The Website is used solely for marketing, informational, and commercial outreach purposes. We do not collect, store, or process Protected Health Information (PHI) or patient data through the Website. Our AIDREA platform (and any related clinical or research products) is a separate system. When we handle PHI on behalf of healthcare provider customers through AIDREA, we act only as a Business Associate under HIPAA (U.S.) or an equivalent service provider / processor under applicable Canadian or EU law. Those activities are governed by our Business Associate Agreements (or data processing agreements) with customers, not by this Website Privacy Policy.

2. Who This Policy Applies To

This Policy applies to visitors to our Website, individuals who contact us through the Website or related marketing channels, prospective customers, and other commercial contacts. It does not apply to patient PHI processed through the AIDREA platform on behalf of our customers.

If you are a patient whose information has been submitted to AIDREA by your healthcare provider, please contact your provider directly to exercise rights under HIPAA or applicable health privacy laws. Your provider is the Covered Entity (or equivalent) responsible for those rights.

3. Information We Collect

3.1 Information You Provide

When you use the Website or contact us for marketing or commercial purposes, we may collect:

  • Contact information (name, email address, phone number, organization, job title, and mailing address)

  • Information you submit in forms, demo requests, partnership inquiries, or email correspondence

  • Professional or business information relevant to evaluating our products or services

3.2 Information Collected Automatically

When you visit the Website, we (or our service providers) may automatically collect:

  • Device and browser information (IP address, browser type and version, operating system, device identifiers)

  • Usage data (pages viewed, time spent, referring URLs, click paths, and approximate location derived from IP address)

3.3 Information We Do Not Collect on the Website

We do not intentionally collect sensitive health information, PHI, or patient data through the Website. Any such information should only be submitted through secure channels under a customer agreement for the AIDREA platform.

4. How We Use Information

We use personal information collected via the Website for the following purposes:

  • Responding to inquiries, demo requests, and partnership discussions

  • Marketing our products and services (including sending relevant updates, subject to applicable consent and anti-spam rules)

  • Improving the Website, analyzing usage trends, and ensuring security

  • Complying with legal obligations and enforcing our terms

5. Legal Bases for Processing

Canada (PIPEDA and similar laws): We rely on consent (express or implied, as appropriate), legitimate business purposes consistent with the reasonable expectations of the individual, and compliance with legal obligations.

European Economic Area / United Kingdom (GDPR / UK GDPR): Where the GDPR applies, we process personal data on the basis of consent, performance of a contract, legitimate interests (balanced against your rights), or legal obligation. You may withdraw consent at any time without affecting the lawfulness of prior processing.

United States: We process information in accordance with applicable federal and state laws. For California residents, see the additional rights described in Section 10.

6. Sharing of Information

We do not sell personal information. We may share information in the following limited circumstances:

  • With service providers who assist with Website hosting, analytics, email delivery, customer relationship management, or security, under contracts that require them to protect the information and use it only for the purposes we specify

  • When required by law, regulation, legal process, or governmental request

  • In connection with a merger, acquisition, financing, or sale of assets (with appropriate notice and protections)

7. International Transfers

A.I. Vali is headquartered in Toronto, Ontario, Canada. Personal information may be transferred to and processed in Canada and, where necessary, in the United States or other jurisdictions where our service providers operate. We use appropriate safeguards for cross-border transfers, including contractual protections (such as Standard Contractual Clauses where required under the GDPR).

8. Cookies and Similar Technologies

The Website may use cookies and similar technologies for essential functions, analytics, and (where applicable) marketing.

You can control cookies through your browser settings. Disabling certain cookies may affect Website functionality. Where required by law (including in the EU), we obtain consent before deploying non-essential cookies.

9. Security

We implement administrative, technical, and physical safeguards appropriate to the sensitivity of the information we handle, including access controls, encryption in transit, and secure hosting. No method of transmission or storage is completely secure.

10. Your Rights

10.1 Canada

Under PIPEDA and applicable provincial laws, you may request access to, or correction of, the personal information we hold about you, and you may withdraw consent (subject to legal or contractual restrictions). You may also file a complaint with the Office of the Privacy Commissioner of Canada.

10.2 European Economic Area and United Kingdom

If the GDPR applies to you, you have the right to:

  • Access, rectify, or erase your personal data

  • Restrict or object to certain processing

  • Data portability

  • Withdraw consent

  • Lodge a complaint with a supervisory authority

10.3 United States (including California)

Depending on your state of residence, you may have rights to know, access, delete, or correct personal information, and to opt out of certain sharing. California residents have additional rights under the CCPA/CPRA, including the right to know the categories of personal information collected and the right to opt out of the sale or sharing of personal information (we do not sell personal information). We will not discriminate against you for exercising these rights.

To exercise any of these rights, please contact us using the information in Section 14. We may need to verify your identity before fulfilling a request.

11. Protected Health Information and the AIDREA Platform

When we process Protected Health Information on behalf of healthcare provider customers through the AIDREA platform, we act solely as a Business Associate under the U.S. Health Insurance Portability and Accountability Act (HIPAA) and the HITECH Act, or as a service provider / processor under applicable Canadian or EU law. We do so only under a written Business Associate Agreement (or equivalent data processing agreement) with the customer.

We do not use or disclose PHI except as permitted by the applicable agreement and law. Individuals seeking to exercise HIPAA rights (access, amendment, accounting of disclosures, etc.) should contact the Covered Entity (their healthcare provider). We will cooperate with the Covered Entity as required by the BAA.

12. Retention

We retain personal information collected via the Website only for as long as necessary to fulfill the purposes described in this Policy, comply with regulatory and legal obligations, resolve disputes, and enforce our agreements.

13. Children’s Privacy

The Website is not directed to children under the age of 16 (or 13 in the United States). We do not knowingly collect personal information from children. If we become aware that we have collected information from a child without appropriate consent, we will take steps to delete it.

14. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact:

Privacy Contact

A.I. VALI INC.

3080 Yonge Street, Suite 4070, Toronto, Ontario, Canada

Email: info@aivali.org

You may also contact the Office of the Privacy Commissioner of Canada or your local data protection authority.

15. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be posted on the Website with a new effective date. We encourage you to review this Policy periodically. Material changes will be communicated as required by applicable law.