Klarify procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Where the UK GDPR applies, Klarify has appointed a representative in the United Kingdom in accordance with Article 27 of the UK GDPR. The UK representative may be contacted regarding Klarify’s processing of personal data subject to UK GDPR. UK Representative: Klarify Health Inc. takes the protection of personal data seriously, and has appointed DataRep as their Data Protection Representative in the UK so that you can contact them directly in your home country. If you want to raise a question to Klarify Health Inc., or otherwise exercise your rights in respect of your personal data, you may do so by: sending an email to DataRep at datarequest@datarep.com, quoting <Klarify Health Inc.> in the subject line, contacting us on our online webform at www.datarep.com/data-request, or mailing your inquiry to: DataRep, 107-111 Fleet Street, London, EC4A 2AB, United Kingdom (please ensure request is addressed to ‘DataRep’ and not Klarify Health Inc.)” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ If you have concerns about cross-border processing, you can select European processing in your account settings or contact us at info@klarify.ca to discuss alternative options.” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ The personal information we collect is stored and/or processed in Canada, the United States, or where we or our partners, affiliates, and third-party providers maintain facilities. The countries to which we store, process, or transfer your personal information may not have the same data protection laws as the country in which you initially provided the information. If we transfer your personal information to third parties in other countries: (i) we will perform those transfers in accordance with the requirements of applicable law; and (ii) we will protect the transferred personal information in accordance with this privacy policy. When therapy sessions are recorded using Klarify:” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ By default, your data is processed in North America. You can change your processing region in your account settings. Audio files are temporarily sent to AssemblyAI for transcription. By default, this happens in the United States (Oregon). If you select European processing, the data processing shall be done in a data centre located within the European Union. Processing takes 1-15 minutes, and audio files are immediately and permanently deleted after transcription is complete. No audio recordings are retained or stored outside Canada. AI processing (for notes, mindmaps, summaries, and the AI assistant) runs through AWS Bedrock. By default, this may occur in Canada or the US. If you select European processing, it occurs in the EU. Processing is transient and any data sent is deleted immediately after inference. Permanent Canadian Storage: All transcripts, clinical notes, treatment plans, and other data remain permanently stored in Canada (AWS Montreal region)” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “If you select European processing in your account settings, both transcription and AI processing occur in the EU instead. Processing lasts 1-15 minutes, after which files are permanently deleted from external systems. All transcripts, notes, and other health information remain permanently stored in Canada. You hereby agree and acknowledge that your use and access to the Services is subject to the usage terms set forth in the applicable Third-Party Services’ end user license agreements, terms of use, privacy policies and/or any other applicable policies of such Third-Party Services. You are strongly advised to read the terms, privacy policies and other legal documentation of any Third-Party Services that you visit or are integrated into the Services. You further agree and acknowledge Klarify has no control over, and assumes no responsibility for, the content, services, policies and/or practices of Third-Party Services. 2.6 Service Providers and Cross-Border Processing. Klarify may transfer personal information to service providers located outside Quebec or outside Canada solely for the purposes of delivering the Services. Before any such transfer, Klarify conducts an assessment required by applicable law and ensures that contractual measures provide a level of protection equivalent to that required under applicable Canadian and provincial privacy legislation. When Klarify acts as a service provider on behalf of a Practitioner, Klarify processes personal information only for the purposes of providing the Services and follows the instructions of the Practitioner. ” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Where UK GDPR applies, individuals have additional rights including:” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Other session data (transcripts, clinical notes, treatment plans) is retained until the therapist deletes it or closes their account.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ After 14 days, all audio files are permanently and automatically deleted from our systems” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Recordings are retained temporarily to allow therapists to regenerate notes if needed or investigate technical issues” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Audio recordings are excluded from backup systems to ensure complete deletion” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ While you may request that we delete your contact details at any time, we cannot recall any email we have already sent. If you have any further enquiries about how to withdraw your consent, please feel free to enquire using the details provided in the Contact Us section of this privacy policy.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ When therapists use Klarify to record therapy sessions:” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ We keep your personal information only for as long as we need to. This time period may depend on what we are using your information for, in accordance with this privacy policy. For example, if you have provided us with personal information as part of creating an account with us, we may retain this information for the duration your account exists on our system. If your personal information is no longer required for this purpose or you provide us with your express consent to delete your personal information, we will delete it or make it anonymous by removing all details that identify you, subject to any data retention requirements by law. However, if necessary, we may retain your personal information for our compliance with a legal, accounting, or reporting obligation or for archiving purposes in the public interest, scientific, or historical research purposes or statistical purposes.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Limiting use, disclosure and retention. We will not use or disclose personal information for purposes other than those for which the information was collected, except with your consent or as required by law. We will retain personal information only for as long as is necessary to fulfill the purposes for collecting such information and compliance with any legal requirements.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ third-party service providers for the purpose of enabling them to provide their services, including (without limitation) IT service providers, data storage, hosting and server providers, analytics, error loggers, maintenance or problem-solving providers, professional advisors, and payment systems operators” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Important Note on Data Privacy: We do not sell or share sensitive health information with third parties for advertising purposes . We may use basic contact information (such as email and name) for targeted advertising purposes, but we never share or use sensitive health data or case notes for such purposes. We use the following third-party services to provide Klarify: Data Storage and Processing: Amazon Web Services (AWS Canada) - All personal and health information is permanently stored in Canada (Montreal region)” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ an entity that buys, or to which we transfer all or substantially all of our assets and business” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Amazon Web Services (Bedrock) - Powers AI features including note generation, mindmaps, and the AI assistant. By default, processing may occur in Canada or the US. If you select European processing, it occurs in the EU. No data is stored outside Canada.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Klarify engages certain service providers as sub-processors who may process personal data on Klarify’s behalf. These sub-processors are bound by data processing agreements and appropriate safeguards. Depending on your selected processing region, sub-processors may process data in different locations. A current list of sub-processors, including their processing locations, is available on request by contacting info@klarify.ca .” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Our email interactions with our customers are compliant with Canadian Anti-Spam Legislation. The Company does not send unsolicited email to persons with whom we have no relationship. We will not sell personal information, such as email addresses, to unrelated third-parties. On occasion, your personal information may be provided to our third-party partners to administer the products and services you request from us. When you leave our website by linking to another website, you are subject to the privacy and security policies of the new website. We encourage you to read the privacy policies of all websites you visit, especially if you share any personal information with them. Please refer to our Cookie Policy for more information.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We may disclose personal information to: a parent, subsidiary or affiliate of our company” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Important: None of these third-party services have access to your session content or health information except as explicitly stated above. AssemblyAI processes audio only temporarily and is contractually prohibited from retaining or using audio for AI training. All other health data remains exclusively in Canada. For a complete list of sub-processors and their data access levels, please see our Data Processing Agreement available by contacting info@klarify.ca . Google API Services User Data Policy Compliance: Klarify Health Inc.’s use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. For more information, please visit the Google API Services User Data Policy at https://developers.google.com/terms/api-services-user-data-policy .” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ While Klarify Health Inc. endeavors to keep, store and handle customer data within locations in Canada, it may use agents or service providers located in the United States (U.S.), the European Union (EU), or United Kingdom (UK) to collect, use, retain and process personal information as part of providing services to you. Users may select their preferred processing region in their account settings, which determines where temporary processing occurs. While we use all reasonable efforts to ensure that personal information receives the same level of security in any other jurisdiction as it would in Canada, please be aware that privacy protections under U.S. laws may not have the same adequacy. Where the UK GDPR applies, transfers to the United States are carried out using the UK Addendum to the Standard Contractual Clauses or the International Data Transfer Agreement (IDTA) together with appropriate safeguards. No health information is permanently stored outside Canada.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “Each Third-Party Service provider is not a party to these Terms and is not responsible for the provision or support of the Services. Data Storage and Core Infrastructure: Amazon Web Services (AWS Canada) - All personal and health information is permanently stored in Canada (Montreal region) Temporary Processing: AssemblyAI (USA/EU) - Audio transcription services only. Audio is temporarily processed in the United States by default, or in the European Union if you select European processing in your account settings. Processing is transient and deleted immediately after inference. No audio is retained outside Canada. Amazon Web Services (Bedrock Canada, USA/EU) - AI inference may be processed in Canada, the US, or the EU depending on your account settings. By default, processing occurs in Canada or the US. If you select European processing, inference occurs in the EU. All storage of personal information remains in Canada and no copies of personal information are retained outside Canada following completion of the inference operation. Other Services: Clerk (USA) - User authentication (login credentials only, no health data) Stripe (USA) - Payment processing (billing information only, no health data) Google Workspace, Datadog, and other services for analytics, communication, and business operations Important Notice: By default, your therapy session audio files are temporarily transferred to the United States for transcription purposes, and AI processing may occur in Canada or the United States. ” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ courts, tribunals, regulatory authorities, and law enforcement officers, as required by law, in connection with any actual or prospective legal proceedings, or in order to establish, exercise, or defend our legal rights” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ 3.1 Free Subscription If you have been authorized to access the free version of the Service, Klarify hereby grants you a non-transferrable, limited subscription to access and use free portions of Service (the “Free Subscription”). The Free Subscription may limit your access to some aspects of the Service. 3.2 Paid Subscription If you choose one of the options for a paid subscription on the Platform (a “Paid Subscription”), Klarify will charge you a monthly fee at the start of each calendar month or at the start of each year for annual subscriptions (“Fees”), wherein such recurring Fee amount will be dependent on your choice of Paid Subscription tier. Each Paid Subscription tier offers differing levels of extra features and/or additional access to such extra features (collectively “Paid Content”), as further detailed on Klarify’s Website or as presented to you via other means such as by email. Paid Subscriptions are billed in advance on a monthly recurring basis, depending on the type of Subscription you select when purchasing a Paid Subscription. At the end of each billing cycle, your Paid Subscription will automatically renew on the same terms unless you cancel your Subscription prior to renewal. You may cancel your Paid Subscription by contacting Klarify at info@klarify.ca. Klarify may, in its sole discretion, increase and/or adjust the Fees, which become effective at the end of the then-current billing cycle. ” | Captured 2026-09-25Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.