PIPEDA for Canadian clinics: consent, websites and marketing data

When PIPEDA applies to a clinic, and when provincial law does

The OPC's PIPEDA in brief (opens in a new tab) says the Act applies to private-sector organizations that handle personal information in the course of commercial activity, defined as conduct "of a commercial character." It lists "medical records" among its examples of personal information. A privately run clinic that charges for services is engaged in commercial activity.

Provinces can take over. Where a province has a law the federal government has declared "substantially similar," organizations covered by it are generally exempt from PIPEDA for activity inside that province. The OPC's list of provincial laws that may apply instead of PIPEDA (opens in a new tab) currently names:

As listed by the OPC, page dated 2020-05-11, checked October 23, 2026.

What this means in practice:

• Ontario, New Brunswick, Newfoundland and Labrador, Nova Scotia: the provincial act governs patient health information held by custodians. PIPEDA still governs other personal information in commercial activity, such as a general newsletter list. See PHIPA in Ontario.
• Alberta, British Columbia, Quebec: the provincial private-sector law generally applies instead of PIPEDA inside the province (Alberta and Quebec also have health-specific laws).
• Other provinces and territories: the OPC's summary of privacy laws (opens in a new tab) says their health privacy laws have not been declared substantially similar, and "PIPEDA may still apply."
• Everywhere: PIPEDA still applies to personal information that crosses provincial or national borders, including in Alberta, BC and Quebec.

Coming from US guidance? HIPAA vs Canadian law lines the regimes up side by side.

Federal reform. Bill C-27, the Digital Charter Implementation Act, 2022, was tabled by the government (opens in a new tab) to replace PIPEDA's privacy rules with a new Consumer Privacy Protection Act. As of the Justice Laws consolidation (opens in a new tab) current to September 30, 2026, PIPEDA remains the law in force. Check Parliament's LEGISinfo for any newer bill before planning around reform.

The fair information principles, applied to marketing

PIPEDA's Schedule 1 sets out 10 fair information principles (opens in a new tab). Here is what each one means for a clinic's marketing.

Consent for website forms, chat and analytics

The OPC's meaningful consent guidelines (opens in a new tab) say organizations must generally get express consent when information is sensitive, when a use falls outside a person's reasonable expectations, or when it creates a meaningful risk of significant harm. "Certain categories of information (such as health or financial) will generally be considered sensitive." The OPC also says a line buried in a privacy policy is not enough, and recommends just-in-time notices at the point of collection.

For a clinic website, that works out to three rules:

1. Forms. Put a short notice beside the submit button: what you collect, why, who receives it. Ask for a separate, unchecked opt-in if you also want to send marketing.
2. Chat. Tell visitors before they type that messages are stored and who can read them. Ask them not to share health details beyond what a callback needs.
3. Analytics and ad tracking. The OPC's guidelines on online behavioural advertising (opens in a new tab) accept opt-out consent only under conditions, including that collection is limited "to the extent practicable" to non-sensitive information. Health information is listed as generally sensitive, which calls for opt-in.

Quebec goes further, requiring identification and profiling functions to be off by default. Ontario custodians face PHIPA's rule that marketing with health information needs express consent.

Service providers, cross-border transfers and accountability

Your web host, form tool, CRM and email platform are service providers. Under PIPEDA they don't carry your accountability for you. The OPC's cross-border guidelines (opens in a new tab) say PIPEDA "does not prohibit" transferring personal information to another jurisdiction for processing, but "the transferring organization is accountable for the information."

The OPC names contracts as "the primary means" of protecting transferred data, while warning that "no contract can override the criminal, national security or any other laws" of the other country. It also says people should be told, ideally at collection, that their information may be processed abroad and "may be accessible to law enforcement and national security authorities of that jurisdiction."

For a clinic, that means: a written agreement with every vendor that holds personal information, a clear statement in your privacy policy about where data is processed, and a way to audit what the vendor does. Canadian hosting and data residency covers provincial residency rules and the vendor questions.

Medfy's position, stated as fact rather than as a legal classification: patient information from forms, chat and the CRM for Canadian practices is stored in a separate, encrypted Canadian database, and ad platforms never receive patient data. Read how Medfy handles patient data for encryption, access controls and audit logs.

Breaches of security safeguards: reporting and records

PIPEDA's breach rules are in sections 10.1 to 10.3 (opens in a new tab), explained in the OPC's breach guidance (opens in a new tab).

• The test. Report when it is reasonable to believe a breach creates a "real risk of significant harm." Significant harm "includes bodily harm, humiliation, damage to reputation or relationships," financial loss and identity theft. Weigh the sensitivity of the information and the probability it will be misused. Health information scores high on sensitivity.
• Report to the OPC as soon as feasible after you determine the breach occurred.
• Notify affected people directly and conspicuously, as soon as feasible, with enough information to understand the breach and protect themselves.
• Notify other organizations that could reduce the harm, such as a payment processor.
• Keep records of every breach, whether or not it meets the test. The OPC says records must be kept for two years and given to the OPC on request.

Knowingly contravening these duties is an offence. The OPC does not issue fines itself but can refer matters to the Attorney General of Canada.

A PIPEDA checklist for your clinic's website

Copy this list into your own compliance notes.

• A named privacy officer, with contact details in your privacy policy
• A plain-language privacy policy linked from every page and every form
• A short notice at each form explaining purpose and recipients
• Separate, unchecked opt-in for marketing emails (CASL for clinic emails covers the anti-spam rules)
• No ad pixels or session recording on forms, booking pages or condition pages
• A cookie notice with a working opt-out; opt-in where tracking could reveal health interests
• Written agreements with every vendor that stores form, chat or contact data
• Your privacy policy says where data is stored and processed
• A breach response plan and a breach log kept for at least two years
• A retention schedule for enquiries that never became patients

Want an outside read on your site first? A free marketing audit checks public pages and flags privacy risks such as pixels on patient forms. For how PIPEDA fits with provincial laws, CASL and Quebec's rules, start at healthcare marketing in Canada.

This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.

Frequently asked questions

Does PIPEDA apply to private medical clinics?

Often, at least in part. PIPEDA covers private organizations handling personal information in commercial activity, and a fee-charging clinic qualifies. But in Ontario, New Brunswick, Newfoundland and Labrador and Nova Scotia, a provincial health act governs patient health information, and Alberta, BC and Quebec have their own private-sector laws. PIPEDA still applies to information crossing provincial or national borders. Your privacy officer or counsel can map which law covers what.

Do I need consent to use Google Analytics on a Canadian clinic website?

You need meaningful consent for collecting personal information, and analytics identifiers can qualify. The OPC accepts opt-out consent for tracking only under conditions, including limiting collection to non-sensitive information, and treats health information as sensitive. A clear notice and opt-out may suit aggregate site analytics, but tracking that could reveal health interests calls for opt-in. Quebec requires such functions to stay off until activated.

When does a clinic have to report a privacy breach under PIPEDA?

When it is reasonable to believe the breach creates a real risk of significant harm, such as humiliation, damage to reputation or identity theft. Report to the Privacy Commissioner and notify affected people as soon as feasible, and notify organizations that could reduce the harm. Keep a record of every breach for two years, reportable or not. Ontario custodians report health information breaches under PHIPA to the IPC instead.

Is there a PIPEDA certification?

No. There is no PIPEDA certification, and no badge proves a clinic or vendor complies. PIPEDA sets obligations, such as accountability, consent, safeguards and breach reporting, that your clinic meets through its own policies, contracts and practices. Treat any vendor's "PIPEDA certified" claim as marketing and ask for specifics instead: where data is stored, who can access it, how breaches are reported and what happens on deletion.