Does PHIPA apply to my health or wellness app?

Health and wellness apps sit between two privacy regimes. The deciding question isn’t what data you collect, but whose behalf you collect it on.

Which law applies to my app?

Your model	Main privacy law	Why
Software sold to Ontario clinics or practitioners (booking, charting, virtual care, AI scribes)	PHIPA, through the custodian	You handle personal health information for a health information custodian as its agent or electronic service provider
A clinic’s own patient app	PHIPA	The clinic is the custodian
Direct-to-consumer wellness, fitness, sleep or nutrition app	PIPEDA	Commercial activity, no custodian
Consumer app that also connects users to regulated practitioners	Both, for different activities	Map each data flow
Users in Quebec, BC or Alberta	Those provinces’ laws may also apply	Provincial private sector and health statutes

What does PHIPA expect of a vendor?

Under s. 6 of O. Reg. 329/04, a vendor that supplies services enabling a custodian to collect, use, modify, disclose, retain or dispose of personal health information electronically, and that isn’t the custodian’s agent, must not use the information except as necessary to provide the services, must not disclose it, and must not let its employees or others acting for it access it unless they agree to the same restrictions. A health information network provider, which provides services to two or more custodians primarily so they can share personal health information with one another electronically, has extra duties, including breach notice to custodians, keeping an electronic record of accesses and transfers, providing a written threat and risk assessment, and entering into a written agreement with each custodian.

PHIPA also contains a section on “consumer electronic service providers” (apps that let individuals manage their own health records), added in 2020, but when we last checked, e-Laws showed it as not yet in force.

In practice, clinics will ask for a written agreement covering access, security, breach notice, location of data, AI training and return of records. See privacy for wellness clinics.

What does PIPEDA expect of a consumer wellness app?

Health information is sensitive, so the Privacy Commissioner’s consent guidelines generally call for express consent. Be particularly careful with:

• Ad pixels and SDKs that send health-related events to advertising platforms. See do I need a cookie banner.
• Selling or sharing data with partners, insurers or employers.
• AI features trained on users’ health data.
• Wearable integrations, which bring in each platform’s developer terms.

Does calling it “wellness” avoid health rules?

Not for privacy, and not for product rules either. What the app claims to do can bring in medical device rules or advertising limits. See what health claims a wellness business can make.

What should I do first?

1. Decide whether you’re working for custodians, for consumers, or both.
2. Map every data flow, including SDKs and AI vendors.
3. Prepare a PHIPA-ready vendor agreement if you sell to clinics, and a consumer privacy policy if you don’t.
4. Plan for breach response under both regimes. See when to report a privacy breach.

What to do next

We prepare clinic privacy and consent documents, privacy policies and SaaS agreements, at fixed fees on our fees page. See also can a clinic use an AI scribe.

This guide is general information about Ontario and Canadian law, not legal advice for your situation. To map which law applies to your app, book a free 15-minute consult.