Healthcare marketing in Canada: privacy law, data and channels

Which privacy law applies to your clinic

Three questions settle most cases: which province the clinic operates in, whether the information is health information or ordinary personal information, and whether it leaves the province. The Office of the Privacy Commissioner of Canada's summary of privacy laws (opens in a new tab) uses the same factors: the type of organization, where it is based, the information involved and whether it crosses borders.

Most clinics end up with two laws at once. One governs patient health information. Another governs everything else your marketing touches, such as a newsletter list or website visitor data.

Simplified from the OPC's list of provincial laws that may apply instead of PIPEDA (opens in a new tab), the Quebec and Alberta sources below, and the statutes. Edge cases (a clinic owned by a non-custodian, a hospital-based practice) need counsel.

One rule cuts across every row: the OPC notes that PIPEDA still applies to personal information that crosses provincial or national borders, even in Alberta, BC and Quebec.

Want to see how your current site measures up before you change anything? Get your free marketing audit. It reads public information only and flags privacy risks such as ad pixels on patient forms.

Federal: PIPEDA and the Privacy Commissioner

PIPEDA applies to private-sector organizations that collect, use or disclose personal information in commercial activity. PIPEDA in brief (opens in a new tab) says organizations covered by a substantially similar provincial law are generally exempt for activity inside that province. For an Ontario clinic, that means PHIPA covers patient health information while PIPEDA still covers ordinary personal information in commercial activity.

Three PIPEDA points matter most for marketing:

• Health information is sensitive. The OPC's meaningful consent guidelines (opens in a new tab) say health information "will generally be considered sensitive," and sensitive information generally calls for express consent.
• Breaches get reported. A breach that creates a real risk of significant harm must be reported to the OPC and the affected people notified, and the OPC's breach guidance (opens in a new tab) says records of every breach must be kept for two years.
• You stay accountable for vendors. Handing data to a service provider doesn't hand off responsibility.

Read PIPEDA for clinics for consent on web forms and analytics, cross-border vendors, breach records and a website checklist.

Provincial health privacy laws: Ontario, Alberta, Quebec and others

Ontario. The Personal Health Information Protection Act, 2004 (opens in a new tab) covers health information custodians, which include "a health care practitioner or a person who operates a group practice of health care practitioners." Section 33 bars using personal health information for marketing "unless the individual expressly consents." Breaches must be reported to the patient at the first reasonable opportunity, and to the Information and Privacy Commissioner of Ontario in the circumstances set out in O. Reg. 329/04 (opens in a new tab). See PHIPA in Ontario for agents, electronic service providers and breach reporting.

Alberta. The Health Information Act (opens in a new tab) applies to custodians; the Government of Alberta (opens in a new tab) gives physicians, chiropractors and registered nurses as examples. Custodians must notify the Commissioner, the Minister and the patient of a loss or unauthorized access when there is a risk of harm (section 60.1), and must prepare a privacy impact assessment before introducing a new information system (section 64). Organizations that aren't custodians fall under Alberta's PIPA (opens in a new tab). Alberta's Health Information Act explains how the two split a clinic's website.

Quebec. The Commission d'accès à l'information says the Act respecting health and social services information (opens in a new tab) covers people operating a private professional practice (cabinet privé de professionnels) or a specialized medical centre. The private-sector act still governs personal information that isn't health information.

New Brunswick, Newfoundland and Labrador, Nova Scotia. Each has a health information act the OPC lists as substantially similar to PIPEDA for health information.

If you mostly read US material, HIPAA and Canadian law lines up HIPAA against each of these, and HIPAA basics explains the US rules your American vendors are describing.

Email and text marketing: CASL

Canada's Anti-Spam Legislation (opens in a new tab) covers commercial electronic messages: email, text and messages to social or instant-messaging accounts whose purpose includes encouraging someone to buy a service. Section 6 requires three things: consent, identification of the sender, and a working unsubscribe.

• Implied consent expires. Under section 10(10) (opens in a new tab), an existing business relationship covers two years after a purchase and six months after an inquiry. ISED's guide to getting consent (opens in a new tab) says the same.
• Some messages skip consent. Messages that solely confirm a transaction or give a requested quote don't need consent, but still need identification and unsubscribe.
• Unsubscribes are fast. Requests must be honoured within 10 business days.
• Penalties are large. Section 20(4) (opens in a new tab) sets the maximum at $1,000,000 for an individual and $10,000,000 for any other person. ISED notes the CRTC, the Competition Bureau and the OPC share enforcement (opens in a new tab).

Medfy does not send email or SMS marketing. CASL for clinics has a decision table for reminders, recalls, newsletters, promotions and review requests so you can set up your own tools correctly.

Quebec: Law 25 and Bill 96 for clinic websites

Quebec has two separate laws that both land on a clinic's website.

Law 25 (privacy). It amended Quebec's private-sector privacy act in stages. Per the CAI's administrative version of the act (opens in a new tab), from September 22, 2022 a business must publish the title and contact details of its person in charge of personal information on its website, and report confidentiality incidents that present a risk of serious injury. From September 22, 2023 it must publish a plain-language privacy policy, keep identification, location and profiling functions off until the person turns them on, and assess privacy before communicating personal information outside Quebec. The CAI's summary of changes (opens in a new tab) cites administrative penalties of up to $10 million or 2% of worldwide turnover. See Quebec Law 25.

Bill 96 (French language). It was assented to on June 1, 2022 and amended the Charter of the French Language, according to the OQLF (opens in a new tab). The OQLF's business aide-mémoire (opens in a new tab) says commercial documentation must be at least in French on any medium, "y compris les sites Web et les réseaux sociaux" (including websites and social media). Another language may appear if French is at least equivalent. See Bill 96 and clinic websites.

Medfy does not build French-language or bilingual websites. A Quebec clinic would need its French content from another source.

Where patient data lives: data residency and hosting

Where your website is served from and where patient information is stored are two different questions. A brochure page can sit on a server anywhere. The contact form, chat transcripts and patient inbox are what privacy laws care about.

Canada's private-sector law doesn't ban storing personal information abroad. The OPC's cross-border guidelines (opens in a new tab) say PIPEDA "does not prohibit" transfers for processing, but the transferring organization stays accountable and should tell people their information may be accessible to foreign authorities. Provinces add their own duties: Alberta PIPA section 13.1 requires notice when a service provider outside Canada is used, Quebec's act requires a privacy assessment before communicating information outside Quebec, and Alberta's HIA section 60 requires safeguards for health information stored outside Alberta.

Here is how Medfy handles it, stated plainly. Canadian practices' patient information (forms, chat, CRM) is stored in a separate, encrypted database in Canada, encrypted in transit and at rest, and ad platforms never receive patient data. Medfy's patient-data page also notes that some features, such as AI chat answers, process patient messages through an AI provider that may be outside your region. Read how Medfy handles patient data for the full detail, and Canadian hosting and data residency for the questions to put to any vendor.

Reviews and listings in Canada: Google and RateMDs

Canadian patients check two places: your Google Business Profile and, for physicians and many other practitioners, RateMDs.

Google. Google's Maps content policy (opens in a new tab) bans paid or incentivized reviews and says businesses may not "selectively solicit positive reviews from customers." Its Business Profile guidelines (opens in a new tab) let public-facing practitioners have their own profiles, with a separate profile for the clinic location.

RateMDs. In PIPEDA Findings #2020-002 (opens in a new tab), the OPC found that reviews of a health professional are that professional's personal information, but that the public benefit of reviews outweighed the professional's lack of consent. It called a paid feature that let subscribers hide reviews a "pay-for-takedown" practice and a "no go zone"; RateMDs replaced it.

Whatever the platform, a public reply must not confirm that someone is your patient. Under PHIPA, identifying a person as a provider of health care to an individual is itself personal health information. RateMDs for Canadian clinics covers claiming, flagging and privacy-safe replies.

Channels that work for Canadian clinics

Canadian clinics use the same channels as US practices. The differences are vocabulary, consent and who sets the advertising rules.

• Website and search. Write service pages in the words Canadians use: "clinic," "physiotherapy," "family doctor." A page per service gives Google and AI assistants something specific to cite.
• Google Business Profile. Usually the first thing a patient sees. Keep hours, categories and services current.
• Google Ads. Google's personalized advertising policy (opens in a new tab) treats health as a sensitive interest category, so advertiser-curated audiences such as Customer Match can't be used to promote it. Search ads on service keywords remain the workhorse.
• Meta ads. Meta's personal attributes policy (opens in a new tab) rejects copy like "Do you have diabetes?" while allowing "New diabetes treatment available."
• Email and text to existing patients. Effective and inexpensive, within CASL's consent windows.

Advertising standards set by your college

In Canada, your regulatory college decides much of what an ad may say, and the rules differ by profession and province. Check your own college's current document before you write copy:

• Ontario physicians: the CPSO's Advertising policy (opens in a new tab) (approved December 2020) bans testimonials and comparisons with other physicians.
• Ontario dentists: the RCDSO's Advertising Guidelines (opens in a new tab) prohibit testimonials, superiority claims and incentive programs, including free products or services.
• Ontario physiotherapists: the College of Physiotherapists of Ontario's Advertising and Marketing Standard (opens in a new tab) took effect May 1, 2025.
• Dentists elsewhere: the Canadian Dental Association keeps a list of provincial dental regulators (opens in a new tab).

For profession-specific detail, see dental marketing in Canada (college standards, recalls under CASL, the Canadian Dental Care Plan) and physiotherapy marketing (Canadian search terms, insurance-driven messaging, Ontario and Alberta standards).

Medfy is software for independent practices in the US and Canada: a rebuilt website with a page per service and HIPAA-compliant forms, weekly articles, AI visibility tracking, and optional Google and Meta ads management. The base plan is $349 per month (USD), billed monthly; Medfy pricing lists the add-ons.

This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.

Frequently asked questions

Does HIPAA apply to Canadian clinics?

Generally no. HIPAA governs US health plans, clearinghouses and providers that conduct certain electronic transactions. Canadian clinics follow PIPEDA and provincial laws such as PHIPA in Ontario, the Health Information Act in Alberta and Quebec's health information act. HIPAA can still matter when a US vendor holds your data or you bill US insurers electronically, so ask counsel about cross-border arrangements before relying on a US tool's "HIPAA-compliant" label.

Is PIPEDA or PHIPA the law for my Ontario clinic?

Usually both, for different information. PHIPA governs personal health information held by health information custodians, including practitioners and group practices. PIPEDA governs other personal information your clinic handles in commercial activity, such as a general newsletter list, and applies when information crosses provincial or national borders. Your privacy officer or counsel can confirm which law covers each data flow, from intake forms to marketing lists.

Does patient data have to be stored in Canada?

Not as a blanket federal rule. The Privacy Commissioner of Canada says PIPEDA does not prohibit transferring personal information abroad for processing, but your clinic stays accountable and should tell patients their information may be accessible to foreign authorities. Provinces add duties, such as Alberta's notice rule and Quebec's privacy assessment before information leaves the province. Check your provincial health law and any contracts before choosing a vendor.

Can a Canadian clinic email patients without consent under CASL?

Sometimes. CASL allows implied consent for two years after a purchase and six months after an inquiry, and messages that solely confirm a transaction don't need consent at all. Promotions to patients outside those windows need express consent. Every commercial message still needs your clinic's identification and an unsubscribe that works within 10 business days. Provincial health privacy laws may separately require express consent to use health information for marketing.

Does a Quebec clinic's website have to be in French?

Yes, in practice. The OQLF says commercial documentation must be at least in French on any medium, including websites and social media, and that another language may appear only if French is at least equivalent and as accessible. Consumers also have the right to be served in French. A bilingual site can comply. Medfy does not build French-language websites, so a Quebec clinic would need another source for its French content.

Is RateMDs or Google more important for Canadian doctors?

Google usually reaches more patients because a Business Profile appears in Maps and local search for every kind of clinic. RateMDs matters more for individual physicians, since patients search it by name and Canadian search demand for it is high. Claim both, keep details accurate and reply without confirming anyone is a patient. Medfy's free audit scores your Google listing; it does not manage RateMDs or reviews.