Last verified: October 23, 2026, against Canada's Anti-Spam Legislation and its regulations on Justice Laws and ISED's fightspam guidance. General information, not legal advice. Provincial rules vary; confirm with your privacy officer or counsel.
CASL, Canada's Anti-Spam Legislation, decides which clinic emails and texts need the patient's permission first. Reminders, recalls, newsletters, promotions and review requests can each land differently. This page sorts them, using the Act's own tests, so you can set up your email and texting tools correctly.
CASL draws about 2,400 searches a month in Canada (Google Ads Keyword Planner data via DataForSEO, Canada, 12-month average to Sep 2026) and 6,600 in the US (Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026), where businesses with Canadian customers look it up.
A note up front: Medfy does not send email or SMS marketing. Clinics use their own email and texting tools, and this guide is about configuring those.
What CASL covers: commercial electronic messages
CASL regulates commercial electronic messages (CEMs). Under section 1(2) (opens in a new tab), a message is commercial if, having regard to its content, its links and its contact information, it would be reasonable to conclude that one of its purposes is to encourage participation in a commercial activity. Offering or advertising a service counts, and so does promoting a person's public image as someone who offers it. Section 1(3) adds that a message asking for consent to send CEMs is itself a CEM.
"Electronic address" covers email, instant messaging, telephone accounts and similar accounts. ISED's texting guidance says the law "is technology neutral."
Section 6 (opens in a new tab) then sets three conditions for every CEM:
- Consent, express or implied.
- Identification of the sender and anyone the message is sent on behalf of, with contact details.
- An unsubscribe mechanism.
"Commercial activity" in CASL applies "whether or not" there is an expectation of profit, so a clinic billing a public plan shouldn't assume its messages fall outside the Act.
Appointment reminders vs promotions
The single most useful distinction for a clinic is between messages about care the patient already booked and messages that try to sell something new.
Section 6(6) lists CEMs that don't need consent, as long as the message does solely that. They include messages that:
- provide a quote or estimate the person requested;
- "facilitates, completes or confirms a commercial transaction" the person previously agreed to;
- provide warranty, recall, or safety or security information;
- give factual information about an ongoing subscription, membership, account or similar relationship.
These messages still need identification and an unsubscribe. Separately, regulation SOR/2013-221 (opens in a new tab) takes messages sent in response to a request, inquiry or complaint, or to satisfy a legal obligation, outside section 6 altogether.
Decision table for common clinic messages (general guidance, not legal advice):
| Message | Likely treatment under CASL | Consent needed? | ID and unsubscribe? |
|---|---|---|---|
| Appointment reminder or confirmation, nothing else | Confirms a transaction the patient agreed to (s. 6(6)) | No | Yes, if treated as a CEM |
| Reply to a patient's email or web enquiry | Response to a request or inquiry (SOR/2013-221) | No | Not required by s. 6 |
| Recall ("you're due for your cleaning") | Encourages a new visit, so treat as a CEM | Yes: implied within 2 years of the last paid visit, otherwise express | Yes |
| Newsletter with clinic news and services | CEM | Yes | Yes |
| Promotion of a new service or offer | CEM | Yes | Yes |
| Review request | Promotes the clinic's public image, so treat as a CEM | Yes | Yes |
The trap is mixing. A reminder that adds "Ask us about teeth whitening, 20% off this month" is no longer solely a reminder. It becomes a promotion that needs consent.
Illustrative example (reminder, consent-exempt): "Maple Grove Physiotherapy: reminder of your appointment Tue Mar 3 at 10:15. Reply C to confirm. 416-555-0100. Reply STOP to opt out."
Illustrative example (now a promotion): "Reminder: Tue Mar 3 at 10:15. P.S. New: custom orthotics, book this week and save $50!"
Two more rules overlay CASL. Ontario's PHIPA section 33 (opens in a new tab) requires express consent to use personal health information for marketing, which is stricter than CASL's implied consent. And review requests have platform rules too: Google's content policy (opens in a new tab) bans incentives and selectively soliciting positive reviews. See asking for reviews before you automate one.
Express vs implied consent for patients
Express consent means the person said yes. ISED's consent guide (opens in a new tab) describes it as someone who "has agreed (verbally or in writing)" to receive your messages, and says it doesn't expire unless withdrawn. Under SOR/2012-36 (opens in a new tab) section 4, the request must be sought separately for each kind of act CASL covers (sending messages is one), identify who is asking, give contact details, and state that consent can be withdrawn.
Implied consent arises in set situations under section 10(9) and (10) (opens in a new tab). The one clinics rely on is an existing business relationship:
| Basis | How long it lasts |
|---|---|
| Purchase of a service (a paid visit) | 2 years from the purchase |
| Written contract still in force or recently expired | 2 years after it ends |
| Inquiry or application (a web enquiry, a call about fees) | 6 months from the inquiry |
ISED puts it plainly: implied consent "may be valid for up to 2 years—or just 6 months in the case of inquiries or applications."
What that means in practice:
- A patient seen last spring can receive your newsletter on implied consent. A patient last seen three years ago can't, unless they gave express consent.
- Someone who filled in your contact form but never booked can be emailed about services for six months.
- The best move is to convert implied consent into express consent while it lasts: an unchecked opt-in box on intake forms and in your booking confirmation.
Section 13 puts the burden of proving consent on the sender, so record how and when each person consented.
Identification and unsubscribe requirements
Every CEM, including consent-exempt ones under section 6(6), must carry:
- Your identity: the clinic's name (and business name if different) and the name of anyone you're sending on behalf of. Under SOR/2012-36 section 2, include a mailing address and one of a phone number, email address or web address. If space doesn't allow, these can be on a web page linked from the message.
- Clear presentation: section 3 of the same regulation says identification and unsubscribe must be set out "clearly and prominently."
- A working unsubscribe: free, using the same channel or another practical electronic means, pointing to an address or web page that stays valid for at least 60 days (s. 11(1)–(2)).
- Prompt action: unsubscribe requests must take effect "without delay," and no later than 10 business days (s. 11(3)).
Record-keeping and enforcement
CASL doesn't specify a records format, but section 13 means you need proof. ISED tells businesses relying on existing relationships to "maintain complete records." Keep, for each contact:
- how consent was obtained (form, verbal, in-clinic) and the wording shown;
- the date of their last paid visit or inquiry, so implied consent can expire on time;
- every unsubscribe and the date it took effect.
Who enforces. ISED says the Office of the Privacy Commissioner "shares the responsibility for enforcing CASL with the CRTC and Competition Bureau." Complaints from the public go through the Spam Reporting Centre (opens in a new tab).
Penalties. Section 20(4) (opens in a new tab) sets the maximum administrative monetary penalty per violation at $1,000,000 for an individual and $10,000,000 for any other person.
For how CASL interacts with federal privacy law, see PIPEDA. US-based teams should note that the US rules work differently; HIPAA email marketing in the US covers that side. Dental clinics running recall programs will find more in dental marketing in Canada, and the full provincial picture is at healthcare marketing in Canada.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Frequently asked questions
Do appointment reminders need consent under CASL?
Generally not, if the message is solely a reminder or confirmation of an appointment the patient booked. CASL exempts messages that solely facilitate, complete or confirm a transaction the person agreed to, though they still need your clinic's identification and an unsubscribe option. Add a promotion and the exemption is gone. Keep reminders factual, and keep health details out of texts that others may see.
Can a clinic email existing patients about a new service?
Usually, if you have their consent. A paid visit within the last two years gives implied consent under CASL's existing business relationship rule; older or lapsed patients need express consent. Each email must identify your clinic and include a working unsubscribe. In Ontario, PHIPA separately requires express consent to use personal health information for marketing, so a dedicated opt-in on intake forms is the safer basis.
Does CASL apply to text messages?
Yes. CASL covers commercial electronic messages sent to any electronic address, including telephone accounts, and ISED says consent is required for commercial texts. Each commercial text must name your clinic, give contact information or a link to it, and offer an opt-out such as replying STOP, which must take effect within 10 business days. Purely transactional reminders are exempt from consent but not from identification.
How long does implied consent last under CASL?
Two years from a patient's last purchase, such as a paid visit, and six months from an inquiry or application, such as a web enquiry that didn't lead to a booking. Express consent has no expiry unless the person withdraws it. Track the date each implied consent started, remove contacts when it lapses, and ask for express consent while implied consent is still valid.