For Founders Law

Health, wellness and beauty

Clinic privacy and consent

Records, consent and privacy for personal health information. For clinics, practitioners and wellness brands.

What it is

Clinic privacy and consent work covers how your clinic or practice collects, uses and shares clients’ personal and health information. We prepare your privacy policy and your client intake and consent forms, and review them against PHIPA where it applies.

Ontario’s PHIPA governs how health information custodians, such as many clinics and practitioners, collect, use and share personal health information. Clear intake and consent forms help clients understand how their information is handled from the first visit.

You likely need this if

  • You’re opening a clinic or practice, or adding practitioners
  • You collect health histories or treatment notes
  • You use booking, charting or virtual care software
  • You run a wellness business and aren’t sure whether PHIPA applies

What the starting price includes

  • Privacy policy
  • Client intake and consent forms
  • Review against PHIPA where it applies

What can change the price

  • Number of locations or practitioners

We tell you before doing anything outside the agreed scope, and agree the fee first.

Read first What privacy rules apply to a wellness clinic? It depends on who provides the care. If your clinic is run by or for regulated health professionals, Ontario's Personal Health Information Protection Act (PHIPA) usually applies, with rules on consent, a public statement of your information practices, patient access and breach notice. A wellness business that isn't a health information custodian, such as many coaching, fitness or spa businesses, is generally covered by the federal PIPEDA instead. Many businesses need to work through both. Read the guide

Terms you’ll hear

Personal health informationPHIPAHealth information custodianPIPEDA

Often needed with it

Questions founders ask

Does PHIPA apply to my business?

It applies to health information custodians, which include many regulated health professionals and the clinics they operate. A wellness business that isn’t a custodian is generally covered by PIPEDA for its commercial activity instead.

Is a privacy policy the same as a consent form?

No. The privacy policy explains your practices to the public. Intake and consent forms record what each client agreed to when they started with you.

General information, not legal advice.

How it works

  1. A free 15-minute call. What you’re building and what you need.
  2. A written scope and fixed fee. Before any work starts.
  3. A short, tailored intake. A few focused questions for your matter, so we start with what we need.
  4. Drafting or review. Most work is back within three business days.
Send us a note All fees