Omi Scribe Cloud — United States Privacy Addendum

Version: 1.1

Effective: 14 May 2026

Provider: Omi Health B.V., Eindhoven, Netherlands

Contact: [email protected] · [email protected]

This addendum supplements the Omi Scribe Cloud — Privacy Notice at /legal/cloud-privacy and the Omi Scribe Cloud — Data Processing Addendum (DPA) for Customers established in, or processing personal information subject to the laws of, the United States.

Where this addendum conflicts with the Privacy Notice or DPA, this addendum controls for US personal information.

US HIPAA-regulated workflows additionally require a signed Business Associate Agreement (BAA); contact [email protected] to request the BAA template.

1. Hosting

US Customers using the cloud version are served from the cloud deployment in Azure Sweden Central (EU) under GDPR, with cross‑border safeguards including the EU‑US Data Privacy Framework and Microsoft's Online Services DPA (see §5). The cloud Service runs in any modern browser.

1.1 Local data residency options

For Customers requiring US‑resident processing of Customer Content, two options are available:

• Omi Scribe for Mac (on‑device, in beta) — Customer Content never leaves the clinician's device.
• Customer‑managed self‑hosted deployment in the Customer's own Azure / AWS / GCP tenant — the full Omi stack runs inside the Customer's tenant in the region of their choice. Omi Health operates no infrastructure on the Customer's side.

HIPAA‑regulated workflows additionally require a signed Business Associate Agreement (BAA) — see §2.

2. HIPAA

2.1 Business Associate Agreement

If the Service is used by a HIPAA Covered Entity or a Business Associate of a Covered Entity to process Protected Health Information (PHI), a written Business Associate Agreement between Omi Health and the Customer must be in effect before any PHI is submitted to the Service. Contact [email protected] to request the standard BAA template.

2.2 PHI restrictions

In the absence of a BAA:

• The Customer must not submit PHI to the Service
• Customer Content submitted by the Customer is treated as non‑PHI personal information

2.3 Breach notification

Where a Breach of Unsecured PHI (as defined by 45 CFR § 164.402) occurs, Omi Health will notify the Covered Entity Customer in accordance with the BAA and 45 CFR § 164.410 timelines. Omi Health will not notify HHS directly except as instructed by the Covered Entity or as required by law for incidents involving 500 or more individuals.

2.4 Subcontractors

Omi Health’s sub‑processors that may handle PHI (principally Microsoft Corporation for Azure infrastructure and Azure AI Foundry) have executed Business Associate Agreements with Omi Health.

3. State consumer privacy laws

The Service may be subject to one or more US state consumer privacy laws depending on Customer and end‑user residency, including:

• California: California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA)
• Virginia: Virginia Consumer Data Protection Act (VCDPA)
• Colorado: Colorado Privacy Act (CPA)
• Connecticut: Connecticut Data Privacy Act (CTDPA)
• Utah: Utah Consumer Privacy Act (UCPA)
• Texas: Texas Data Privacy and Security Act (TDPSA)
• Oregon, Montana, Iowa, Tennessee, Delaware, New Hampshire, New Jersey, and other states with comprehensive consumer privacy laws

Where these laws apply, Customer-resident data subjects have rights including (depending on state):

• Right to know / access
• Right to delete
• Right to correct
• Right to opt out of sale, sharing for cross‑context behavioural advertising, and certain profiling decisions
• Right to limit use of sensitive personal information
• Right to data portability

To exercise rights: [email protected]. Where Omi Health is a Processor for Customer Content, requests should be directed to the Customer (the Controller / Business) in the first instance.

3.1 No sale, no behavioural sharing

Omi Health does not sell personal information and does not share personal information for cross‑context behavioural advertising under CCPA/CPRA or analogous provisions of other state laws.

3.2 Sensitive personal information

Health information processed by the Service is sensitive personal information under several state laws. Omi Health processes such information only as necessary to provide the Service under the Customer’s documented instructions, consistent with applicable state law limitations on use of sensitive personal information.

3.3 Universal opt-out signals

Where state law requires honouring Universal Opt-Out Mechanisms (such as Global Privacy Control (GPC)) on consumer-facing surfaces, Omi Health will honour such signals on its public website. Within the Service itself, Customer-side consent and configuration governs.

4. Children

The Service is not directed to children. The Customer remains responsible for compliance with COPPA and equivalent state laws for any paediatric care setting.

5. International transfers (cloud version)

US Customers' Customer Content using the cloud version is stored and processed in Azure Sweden Central (EU). Transfers between the EU and the US (and any authorised remote support access from outside the EU) are governed by:

• The EU‑U.S. Data Privacy Framework (DPF), where applicable through Microsoft Corporation's certification, for the Azure platform underlying the Service.
• EU Standard Contractual Clauses between Omi Health (controller/processor as applicable) and any non‑EU recipient.
• Microsoft Corporation's commitments under the Microsoft Online Services Data Protection Addendum (https://aka.ms/DPA).
• Encryption in transit (TLS 1.2+) and at rest (Azure-managed plus application‑layer AES‑256‑GCM for clinical content fields), role‑based access controls, audit logging, network isolation, and tenant separation.

Customers requiring US‑resident processing should select the on‑device Mac option or customer‑managed self‑hosted in their own tenant (see §1.1).

6. Government access requests

Omi Health will not disclose Customer Content to government authorities except as required by valid legal process. Where legally permitted, Omi Health will:

• Notify the Customer before disclosure
• Challenge requests that appear overbroad or unlawful
• Provide the Customer with information about the request

Omi Health publishes aggregate statistics of government access requests on a yearly basis where transparency reporting is supported by counsel.

7. Supervisory authorities and complaints

US privacy rights are enforced state-by-state by State Attorneys General and (for HIPAA) by the HHS Office for Civil Rights (OCR) at https://www.hhs.gov/ocr. The Federal Trade Commission has unfair-and-deceptive-practice jurisdiction for some matters.

US data subjects may submit complaints to their state attorney general or, for HIPAA matters, to HHS OCR. For California residents: California Attorney General’s Office at https://oag.ca.gov.

8. Sub‑processors

The list of sub‑processors at /legal/sub-processors applies. The cloud Service is hosted in Azure Sweden Central (EU); the sub‑processor list reflects this single deployment.

9. Liability and order of precedence

In the event of conflict between this addendum, a BAA, and the Privacy Notice or DPA, the order of precedence is:

1. Executed BAA (for PHI processing)

2. This US Privacy Addendum (for non-PHI US personal information)

3. The DPA

4. The Privacy Notice

10. Contact

• General privacy enquiries: [email protected]
• BAA execution and US contracting: [email protected]
• Security incidents: [email protected]

Omi Health B.V. — Eindhoven, Netherlands