Guide · Online booking

Online booking for clinics,
what Ontario law expects.

Online booking takes phone tag off your front desk and lets patients book when you are closed. For a health practice in Ontario, though, the booking tool handles personal health information from the first click. This guide covers what the law asks of you, the data residency question, and how to compare tools, as of September 2026.

Published 2026-09-21 · Formory Group

The short answer.

If you are a regulated health professional in Ontario, an online appointment is personal health information and you are responsible for how your booking vendor protects it. Ontario's health privacy law does not require the data to stay in Ontario or Canada, but it does require reasonable safeguards, and you remain accountable for the vendor.

In practice that means choosing a tool built for clinics, getting its data location and security commitments in writing, and configuring it so reminders and forms do not expose more than they need to. Service businesses outside health care fall under a different law, but the same questions are worth asking.

Why a booking is health information.

Section 4 of the Personal Health Information Protection Act, 2004 (PHIPA) defines personal health information to include identifying information that relates to the providing of health care to someone, including identifying a person as their health care provider. A record that says a named person booked physiotherapy with a named physiotherapist on Tuesday fits that definition, even with no clinical notes attached.

PHIPA applies to health information custodians. Under section 3 these include a health care practitioner or a person who operates a group practice of practitioners. A health care practitioner includes a member of a college under the Regulated Health Professions Act who provides health care, a member of the Ontario College of Social Workers and Social Service Workers who provides health care, and any other person whose primary function is providing health care for payment.

Section 12 requires custodians to take reasonable steps to protect personal health information against theft, loss and unauthorized use or disclosure. If it is stolen, lost or used without authority, you must notify the individual at the first reasonable opportunity, and in prescribed circumstances notify the Information and Privacy Commissioner.

Whether the data must stay in Canada.

No, under PHIPA. The Information and Privacy Commissioner of Ontario's PHIPA FAQ says the Act does not require personal health information to be retained and stored in Ontario or Canada, and a custodian may outsource storage to a provider in another jurisdiction. The custodian stays accountable for that provider and must be satisfied that administrative, physical and technical safeguards are in place, for example through the contract.

For businesses outside health care, the federal law is PIPEDA, which applies to private-sector organizations collecting personal information in the course of commercial activity. The Privacy Commissioner of Canada's cross-border guidelines say PIPEDA does not prohibit transfers for processing, but organizations should tell people plainly that their information may be processed in another country and may be accessible to authorities there.

Canadian storage is still a reasonable preference. It is simpler to explain to patients, and a client or partner may ask for it. Just treat it as a choice you make, not a legal requirement someone sold you.

The main types of booking tools.

Clinic practice management software. Booking, charting, intake forms, billing and reminders in one system, built with health privacy in mind. Jane is one Canadian example: Jane Software Inc. is based in North Vancouver, according to its privacy notice, and its security page says clinics choose a regional data centre at signup, with Canada among the options, and can enforce two-step verification. Other systems exist; compare them on the questions below rather than on brand.

Scheduling apps bundled with office software. Microsoft Bookings is included with Microsoft 365 Business Basic, and Google Workspace Business Standard includes appointment booking pages. These are fine for consultations and service calls. For health care, check where the data is stored: Google Workspace's data region options are the United States, Europe or no preference.

Booking widgets from website builders and general scheduling services. Quick to set up and often built for salons, trades and consultants. For a clinic, look hard at intake forms: a general-purpose form that asks "reason for visit" is collecting health information in a tool that may not be designed for it.

Questions to ask any vendor.

Where is our data stored, and can we choose Canada? Is that written into the agreement or only on the marketing page? Who at the vendor can access our records, and is access logged? Does the vendor notify us of a breach, and how quickly? Can we require two-step verification for every staff login? Can we export all our data if we leave, and in what format? What happens to our data after we cancel?

Then look at your own configuration. Reminder emails and texts can say "your appointment on Tuesday at 2 p.m." without naming the treatment. Intake forms should ask only for what you need before the first visit. Staff accounts should be individual, not one shared front-desk login.

Putting booking on your website.

A Book button that opens the vendor's booking page in the same visual style is usually enough. It should be visible on a phone without scrolling, and it should say what can be booked online and what needs a call, such as first assessments for certain services or insurance-billed visits. Test the whole flow on a phone, not only on a desktop; our guide on why websites fail on a phone lists the usual problems.

Your privacy policy should name the booking provider's role and, if data may be processed outside Canada, say so. Our guide to privacy policies for small business websites covers what belongs there. If you want the booking link on your Google Business Profile as well, keep it pointing to the same page. We set this up as part of online booking work for physiotherapy and other clinics.

This is general information, not legal advice. For PHIPA questions, ask the Information and Privacy Commissioner of Ontario or your regulatory college.

Sources.

Before you ask.

Does PHIPA require patient data to be stored in Canada?

No. The IPC's PHIPA FAQ says the Act does not require personal health information to be stored in Ontario or Canada. The custodian remains accountable and must make sure the provider has appropriate safeguards.

Is an appointment booking personal health information?

For a health care provider, yes. PHIPA's definition includes information about the providing of health care to an individual, including identifying who their provider is.

Is Jane App Canadian?

Yes. Jane Software Inc. is based in North Vancouver, B.C., and clinics can choose a Canadian data centre when they sign up.

Can I use Microsoft Bookings or Google appointment pages for a clinic?

They can work, but check data location and access controls first. Google Workspace's data region options do not include Canada; Microsoft stores Exchange Online mailbox content in Canada for Canadian tenants.

Before you decide anything

Find out whether
you have a problem.

Most people asking about a rebuild do not need one. The free check opens your site, looks at how it behaves on a phone, whether it is secure and how old the page is, and tells you which of those apply to you.

Check my website free Read the full GTA report

Start with a
straight answer.

Describe the business and where it works. We come back with what we would change, what it would cost and how long it takes — or with a reason not to bother.

Start a project See our work

Online booking for clinics,what Ontario law expects.