Praxis Privacy Policy

DRAFT for legal review. Not yet in force. Prepared 2026-08-31 for Meerkat Labs Inc. This draft describes what the system actually does as of the date above, including practices that are still in development. Bracketed items need Jean's confirmation. A lawyer licensed in British Columbia must review before this policy is published. Practices marked "development phase" must be resolved before any production use with patient information.

Version: 0.1-draft Effective date: [not yet effective]

1. Scope

This policy explains what information Praxis collects, how it is used, where it is processed, who can see it, and how long it is kept. It applies to everyone who signs in to Praxis, including clinicians using the assistant and reviewers using the governance console.

Praxis is provided by Meerkat Labs Inc. ("Meerkat"), a British Columbia company. Meerkat is subject to the Personal Information Protection Act (British Columbia) and, where applicable, the Personal Information Protection and Electronic Documents Act (Canada). When Praxis is used inside a health institution, that institution's obligations under its own health information legislation and its agreement with Meerkat also apply. Where this policy and an institutional agreement differ, the institutional agreement governs.

2. What we collect

Account information. Sign-in is handled by Clerk, a third-party identity provider. Clerk provides Meerkat with an account identifier, your email address, your name if you supplied one, and the sign-in method used. Praxis stores the account identifier and uses it to associate your activity with your account. Praxis does not store your password; Clerk holds credentials.

Conversation content. The questions you type or dictate, the answers Praxis generates, and the intermediate steps Praxis takes to produce and verify those answers, including which sources it retrieved and which tools it called.

Uploaded content. Documents, images, and photographs you upload, the text extracted from them, and derived data such as embeddings used for retrieval. File names are sanitized on upload; the original name is not stored verbatim.

Voice input. If you use voice input, your audio is transcribed. The transcript, with timing and confidence information, is stored as part of the conversation. Audio retention is a setting; the default is to discard audio immediately after transcription. [Confirm the current default and whether any institution has changed it.]

Verification and governance records. For every answer, Praxis records the claims it identified, the evidence each claim was checked against, the results of each verification step, the model used at each step and its version, and any human review of a flag, including the reviewer's identity, the authority under which they acted, their ruling, and their written reason.

Technical and usage information. Request timestamps, error records, service health data, and similar operational information. Praxis does not use advertising trackers or third-party analytics.

3. Patient information

Praxis is designed on the principle that patient information should not enter it unless your institution has authorized that use, and that if it does enter, it stays within an environment your institution controls.

Refuse rather than redact. Uploads and messages pass through a screen for patient identifiers. When the screen detects identifiers it is designed to catch, the upload is refused and its contents are purged rather than masked. This design is deliberate: a missed identifier under a mask would enter the knowledge base labelled as screened. The screen has declared limits, which are recorded with each screening result so that a stored result can be read against the screen that produced it. Personal names in dictated speech are a known limit of the current version.

Egress controls. Before Praxis sends any content outside its own processing environment, for example a literature search query, the content is length-bounded and scanned. Search queries sent to external literature and web search providers are limited so that upload contents cannot be carried out in a query. The scan results are recorded in the governance record.

Institutional boundary. Praxis's databases, storage, document processing, and retrieval run in Amazon Web Services infrastructure in the Canada (Central) region, operated by Meerkat. Amazon's artificial-intelligence service opt-out policy is enabled on this account, so content processed by AWS document and speech services is not used to improve those services.

4. How we use information

To generate answers and verify them. To retrieve documents you have uploaded when they are relevant to your question. To keep the governance record described in section 6. To operate, secure, and troubleshoot the service. To improve Praxis's verification, including by studying flags that human reviewers determined were wrong, in each case using the governance record and not by training models on your conversations. [Confirm: Meerkat does not currently fine-tune or train any model on user content. State it plainly if true.]

We do not sell information. We do not use information for advertising. We do not use your content to train models offered to anyone else.

5. Where information is processed and who processes it

Praxis relies on the following service providers. Each processes information only as needed to provide its part of the service.

5.1 Development-phase disclosure on model processing location

As of the date of this draft, two verification steps run on cross-region model inference profiles that may route requests to Amazon regions in the United States: the Layer 2 claim adjudication model and the Layer 3 completeness review model. Answer text and retrieved evidence, but not uploaded files themselves, are included in those requests. This is a documented development-phase exception recorded in Meerkat's governance record, and it is not the intended configuration for production use with patient information. Meerkat's stated requirement for production is that these steps run within Canada or under an arrangement your institution has approved in writing. [This section must be updated or removed when the configuration changes. Do not publish it without confirming it is still accurate.]

Amazon Bedrock's data handling terms apply to model requests. Under Amazon's published terms, the model provider does not receive request content by default, and Amazon may retain content for abuse prevention unless a stricter retention mode is configured. [Confirm the account's configured retention mode with counsel before publication.]

6. The governance record and who can see it

The governance record is append-only. Entries cannot be edited or deleted; corrections are new entries that reference what they supersede. It exists so that institutions can audit Praxis's behaviour and so that verification errors can be found and characterized.

Who can see your conversations and uploads:

• You.
• Authorized governance reviewers. A reviewer sees Praxis's answers, the claims it identified, the evidence it retrieved, and the verification results, which necessarily include your question and the retrieved passages. Reviewer access requires a recorded grant that names the reviewer, who issued it, its scope, and its expiry. Every review action records which grant it was performed under.
• Meerkat staff responsible for operating the service, for troubleshooting and security purposes, under access controls that are themselves logged.
• Your institution, to the extent its agreement with Meerkat provides, for audit and quality purposes.

Praxis does not give one clinician access to another clinician's conversations.

7. Retention

When information is deleted, copies may persist for a limited time in backups before being overwritten. [Confirm backup retention.]

8. Security

Praxis runs inside a private network in Canada with encryption in transit and at rest. Access to production databases is restricted to controlled, logged pathways. Reviewer and clinician sign-ins are verified against separate identity configurations so that a clinician credential cannot be used to access governance functions and vice versa. Secrets are held in a managed secrets service. The governance record's append-only property is enforced by the database itself, not by application code alone.

No system is perfectly secure. If Meerkat becomes aware of a breach affecting your information, we will notify your institution and, where required by law, you and the relevant authorities.

9. Your rights

Under British Columbia and Canadian privacy law you may ask what personal information Meerkat holds about you, ask for corrections, and ask questions about how it is used. Requests can be sent to the contact in section 12. Where your information was collected on behalf of your institution, we may direct your request to the institution or handle it jointly with them.

Because the governance record is append-only and exists for audit, a correction to it is recorded as a new entry rather than a change to an existing one. Deletion requests are honoured where the law and the institutional agreement allow; audit records required by law or by the institution are retained.

10. Children

Praxis is for healthcare professionals and is not directed at minors. Meerkat does not knowingly collect information from anyone under the age of majority.

11. Changes to this policy

Meerkat will post changes here with a new version number and effective date, and will notify institutions of material changes before they take effect. Because this policy describes the system as built, it will change as the system changes; the version history is kept in Meerkat's repository and can be provided to your institution on request.

12. Contact

Meerkat Labs Inc. [registered address] [privacy contact email] [Designate a privacy officer, as required under PIPA. Name or role.]