Quebec Law 25 for clinics: privacy rules for websites and marketing

What Law 25 is and when its obligations started

The CAI describes Law 25 as legislation adopted in 2021 that amended the Act respecting the protection of personal information in the private sector. Its obligations started in three waves. The dates below come from the CAI's administrative version of the act (opens in a new tab) and its summary of changes (opens in a new tab).

CAI administrative version, document dated March 14, 2023; the CAI notes it has no official value and the legislation prevails.

Penalties. Under section 90.12, the CAI can impose administrative monetary penalties of up to $50,000 for an individual and, for others, up to $10,000,000 or 2% of worldwide turnover for the previous fiscal year, whichever is greater. Penal fines under section 91 reach $25,000,000 or 4% of worldwide turnover for organizations.

Which act covers a clinic's health information? The CAI says Quebec's Act respecting health and social services information (opens in a new tab) applies to people operating a private professional practice (cabinet privé de professionnels) or a specialized medical centre. The private-sector act, as amended by Law 25, continues to apply to their personal information that isn't health and social services information. For most clinics, patient health records follow the health act, while website visitors, cookies and marketing lists follow Law 25. Map each data flow with your privacy officer.

The person in charge of personal information

Section 3.1 makes the person with the highest authority in the business, typically the owner or director, the person in charge of protecting personal information by default. The CAI's guidance on the person in charge (opens in a new tab) says the role "peut cependant être déléguée par écrit, en tout ou en partie" (may be delegated in writing, in whole or in part), and that the delegator must give the delegate adequate resources.

For your website:

• Publish the person's title and contact details. A name isn't required; a title such as "Privacy officer" and a dedicated email address work.
• Publish your governance policies in clear terms (s. 3.2): retention and destruction, staff roles across the information lifecycle, and how you handle complaints. The person in charge must approve them.

Pick someone with authority to change practices, such as a clinic manager.

Cookies, tracking and consent on your website

Section 8.1 is the website rule clinics most often miss. If you collect personal information using technology with functions that can identify, locate or profile a person, you must tell them beforehand that you use it and how to activate those functions. The CAI's collection guidance (opens in a new tab) adds that these functions "ne pourront être activées par défaut": the visitor must switch them on.

The act defines profiling as collecting and using personal information to assess a person's characteristics, naming health, preferences, interests and behaviour. An ad pixel that builds audiences from visits to your "hearing aids" or "IVF consultation" page is profiling on a health subject.

Consent rules make it stricter. The CAI's consent guidance (opens in a new tab) says consent must be manifest, free, informed, given for specific purposes and requested for each purpose separately. Section 12 classes information as sensitive when it is medical, biometric or otherwise intimate, and requires express consent to use sensitive information for a new purpose.

Section 9.1's privacy-by-default rule expressly excludes cookie settings; cookies are governed by section 8.1 and the consent rules. For how pixels expose health data, see tracking pixels and health data.

Privacy policy and transparency requirements

At collection (s. 8). Tell people the purposes, the means of collection (a form, for example), their rights of access and correction, and their right to withdraw consent. Where applicable, also name third parties receiving the information and say whether it may be communicated outside Quebec.

Privacy policy (s. 8.2). If you collect personal information by technological means, which every clinic website does, publish a privacy policy "rédigée en termes simples et clairs" (in simple, clear terms) on your website, and publicize any change to it. The CAI says the policy should cover what you collect and why, third parties, protection measures, cookie use, and individuals' rights.

Marketing lists. Section 12 says commercial prospecting is not a compatible secondary purpose, so a booking-form email can't be reused for promotions without consent. Section 22 requires prospecting messages to identify you and mention the right to withdraw consent.

Vendors, transfers outside Quebec and impact assessments

Projects (s. 3.3). Before acquiring, developing or redesigning an information system or electronic service delivery that involves personal information, conduct a privacy impact assessment (évaluation des facteurs relatifs à la vie privée). Consult your person in charge from the start of the project. A new website with forms, a new CRM or a new chat widget fits that description. The assessment should be proportionate to the sensitivity, purpose, quantity, distribution and medium of the information.

Outside Quebec (s. 17). Before communicating personal information outside Quebec, assess the privacy impact, considering the sensitivity, the purpose, the protection measures (including contractual ones) and the legal regime where the information would go. The transfer may proceed if the information would receive adequate protection, and it must be governed by a written agreement.

"Outside Quebec" includes Ontario, not only the United States. Ask every vendor which province or country stores the data, backups included. Medfy stores Canadian patient information (forms, chat, CRM) in a separate, encrypted Canadian database and never sends patient data to ad platforms; ask for the hosting location, as you would of any vendor, for your assessment. Data residency has the full vendor question list. If you also handle information crossing provincial borders, the federal PIPEDA can apply as well.

Confidentiality incidents: register and reporting

Section 3.6 defines a confidentiality incident as unauthorized access to, use of or communication of personal information, or its loss or any other breach of its protection.

When you have reason to believe one occurred:

1. Reduce the risk of harm and prevent recurrence (s. 3.5).
2. Assess the risk of serious injury (s. 3.7), considering the sensitivity of the information, the anticipated consequences of its use and the likelihood it will be used for harmful purposes. Consult your person in charge.
3. If the risk is serious, notify the CAI "avec diligence" (promptly) using its form, and notify the affected people. The CAI's incident guidance (opens in a new tab) lists what the notice should contain.
4. Record every incident in your register (s. 3.8), serious or not. The CAI says entries are kept for at least five years after you became aware of the incident, and the register must be provided to the CAI on request.

A Law 25 checklist for clinic websites

Copy this list and work through it with your person in charge.

• Title and contact details of the person in charge published on the website
• Governance policies summarized on the website (retention, roles, complaints)
• Plain-language privacy policy covering cookies, third parties and transfers outside Quebec
• Notice at every form: purpose, means, rights, right to withdraw consent
• Analytics and advertising tools that identify or profile are off until the visitor opts in
• No ad pixels on forms, booking pages or condition-specific pages
• Separate, express consent for marketing messages
• Privacy impact assessment on file for the website, forms, CRM and chat
• Assessment and written agreement for each vendor storing data outside Quebec
• Confidentiality incident register, kept at least five years
• French-language content checked separately under Bill 96

Medfy does not build French-language or bilingual websites. A Quebec clinic would need its French content from another source.

To see which trackers your current site loads and where, run a free marketing audit; it flags privacy risks such as pixels on patient forms. For the other provinces' rules, start at healthcare marketing in Canada.

This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.

Frequently asked questions

Does Quebec's Law 25 apply to private clinics?

Yes, to part of what they hold. Law 25 amended Quebec's private-sector privacy act, which covers a clinic's website visitors, cookies, newsletter lists and other non-health personal information. According to the CAI, health and social services information held by private professional practices falls under Quebec's separate Act respecting health and social services information. Most clinics follow both, so map each data flow with your person in charge or counsel.

Do Quebec clinic websites need a cookie consent banner?

In practice, yes, if the site uses analytics or advertising tools that can identify, locate or profile visitors. Section 8.1 requires telling visitors beforehand and leaving those functions off until they activate them, so a consent panel with tracking off by default is the usual answer. A notice saying "by using this site you accept cookies" doesn't meet that. Disclose all cookies, including necessary ones, in your privacy policy.

Who should be a clinic's person in charge of personal information?

By default it is the person with the highest authority, usually the owner or director. That person may delegate the role in writing, in whole or in part, to someone able to do it effectively, such as a clinic manager with real decision-making power, and must give them adequate resources. Publish the role's title and contact details on your website; the CAI says it doesn't need to be notified.

What counts as a confidentiality incident under Law 25?

Any unauthorized access to, use of or communication of personal information, or its loss or any other breach of its protection. A misdirected email, a stolen laptop or a public file link all count. Every incident goes in your register, kept at least five years. You notify the CAI and affected people only when the incident presents a risk of serious injury, judged by sensitivity, consequences and likelihood of misuse.