Healthcare marketing rules in Canada: what Ontario clinics can say

Short answer: Three rulebooks apply to an Ontario clinic’s marketing, and anti-spam law is only one of them. Ontario’s health privacy act (PHIPA) treats the bare fact that someone is your patient as personal health information, so using a patient list for marketing needs express consent. Your college separately limits what an ad may say: testimonials and superlatives are out, and for dentists so are giveaways. This is general information, not legal advice.

Ontario is our worked example. Other provinces have their own health privacy acts and colleges, and Quebec differs again (see AI marketing in Quebec), so check the rules where you practise.

Why a clinic answers to three rulebooks, not one

The first is the anti-spam law, which decides whether you may send a commercial message to a given person. Our guide to message consent and appointment reminders covers it.

The second is health privacy law. In Ontario that is the Personal Health Information Protection Act, 2004 (PHIPA). It decides what you may do with information about your patients, message or no message.

The third is your regulatory college: the rules under the Medicine Act for doctors, the Royal College of Dental Surgeons of Ontario (RCDSO) for dentists. Physiotherapists, chiropractors, optometrists and others have their own college and advertising rules, so check yours.

A campaign can pass one and fail another. In our view the privacy rulebook is the one clinics forget.

What PHIPA means by marketing, and why your patient list counts

PHIPA (Personal Health Information Protection Act, 2004) applies to health information custodians. Section 3(1) says that includes a health care practitioner and a person who operates a group practice of health care practitioners. If you run a clinic, that is you.

Section 33 is the rule that matters for advertising. It says a custodian shall not collect, use or disclose personal health information about an individual “for the purpose of marketing anything” or for market research unless the individual “expressly consents”, subject to any prescribed requirements.

Here is the part that catches people. Section 4(1)(b) says personal health information includes identifying information relating to the providing of health care to the individual, “including the identification of a person as a provider of health care to the individual”. In our reading, the bare fact that someone is your patient is personal health information. No diagnosis is needed. A name and email address on your patient list already says “this person sees us”.

Compare fundraising: section 32(1) allows implied consent, but only for the individual’s name and prescribed contact information. Marketing under section 33 has no implied-consent route.

On the stakes, section 72 sets offences for wilfully collecting, using or disclosing personal health information in contravention of the Act: fines up to C$200,000 (and/or up to one year of imprisonment) for an individual, up to C$1,000,000 for an organisation. “Wilfully” matters: in our reading, this offence is aimed at contravention done on purpose, not at an honest slip.

Can you put patient emails into a Facebook or Google audience?

Not without express marketing consent first.

Uploading patient emails or phone numbers to a Meta or Google customer list uses the fact that each person is your patient for marketing. Under section 33, in our reading, that needs express consent before the upload. The platform hashing the list does not change that, in our view. The same goes for handing a patient list to an agency.

The workable alternative is ads that target by interest or location. They use no patient information, so they are the safer route to new patients. The ad content still has to meet your college’s rules, covered next. Our guide to Facebook and Instagram ads in Canada explains how that targeting works.

What Ontario doctors can and cannot say in an ad

For physicians, the rules sit in O. Reg. 114/94 under the Medicine Act, 1991, Part IV, Advertising. Here is what it says in plain terms.

Section 6(1) lets a member communicate factual, accurate and verifiable information that a reasonable person would consider material in the choice of a physician. That is the permission.

Section 6(2) says that information must not be false, misleading or deceptive, must not contain a testimonial or any comparative or superlative statements, and must not refer to a specific drug, appliance or equipment. Section 6(3) adds that it must be readily comprehensible, dignified and in good taste.

Put those together and most standard ad copy is off the table. “Ontario’s best family doctor” is a superlative. “Patients love Dr. Singh” is a testimonial. “We now offer the new X laser” names equipment. What is left is plain and factual: who you are, what you treat, where you are, how to book.

The dental college’s list, and why “state of the art” is on it

The RCDSO publishes a one-page guide, Advertising with Integrity. It tells dentists what not to include:

• Superiority terms, with “state of the art” as one of its own examples.
• Testimonials or unverifiable claims.
• Statements that appeal to the public’s fear or favourable results.
• Incentive programs such as giveaways, contests, draws, free products or services.
• Comparisons with other dentists or services.

It is an easy phrase to miss in your own copy, so search your website and ads for it first.

The same guide covers fees. They may be advertised if clearly stated. Unless specified otherwise, the advertised fee is the maximum, inclusive of all services and laboratory costs, and it applies to all patients regardless of awareness of the ad or insurance coverage.

On titles, use ones reflecting your registration category, skip continuing education, memberships, positions in professional organisations and degrees not required for registration, and state clearly whether you are a general practitioner or a specialist.

Reviews, testimonials and the Google review problem

Both rulebooks treat testimonials as off limits, so what about Google reviews? Our reading has three parts.

First, patients writing reviews on Google on their own is not the clinic’s advertisement. Second, republishing those reviews on your website or in an ad is, in our reading, the clinic using a testimonial. Screenshot a five-star review into an ad and you have made it yours.

Third, be careful when you reply. A reply that confirms someone is a patient (“Thanks for visiting last week”) discloses personal health information, by the section 4(1)(b) point above. Thank them for the feedback, invite them to contact the clinic directly, and stop there. Offering a reward for a review sits close to the RCDSO’s incentive rule for dentists, and we would not do it.

Earn reviews and leave them where they are: our local SEO guide covers how they feed the map pack.

Before-and-after photos are a grey area. In what we read, neither the physician regulation nor the RCDSO guide names them. They sit close to “favourable results” and testimonials, and in our reading a photo of an identifiable patient is patient information too, so using it in marketing needs express consent under section 33. Ask your college first.

What you can still send to existing patients

The rules are not a gag order. Section 8(1) of the physicians’ regulation says a member shall not contact or attempt to contact any person known to need medical services to solicit professional patronage. Section 8(2) then says this does not stop a member reminding a person of an appointment they made, or communicating with regular patients about health maintenance procedures that are due, health issues, preventive medicine and recent developments in medicine, or a possible benefit from a change in therapy.

Section 8(3) defines a regular patient as someone who uses the member’s services regularly and with reasonable frequency and has not asked for their records to be transferred to another physician.

For anything promotional, our opinion is that the safe default is one consent form at intake with a separate, unticked marketing box, worded to name the channels. Keep it apart from treatment consent so a patient can say yes to care and no to marketing. That box also makes future patient lists usable, because you will hold the express consent section 33 asks for.

A hypothetical: a Mississauga dental practice plans a spring campaign

This is a hypothetical. A two-dentist practice in Mississauga wants a spring whitening campaign. The first draft has four ideas: a “free whitening draw”, “state of the art” in the ad copy, five-star Google reviews reposted in the ad, and a Meta custom audience built from the patient list.

Each one hits a rule from above. The draw is an incentive program. “State of the art” is on the RCDSO list. The reposted reviews are, in our reading, testimonials. The custom audience uses patient status for marketing without express consent.

Here is what changes. The draw is dropped. The copy becomes plain and factual: what whitening involves, who it suits, how to book. Any price is stated clearly, and the practice treats it as the RCDSO does: the maximum fee, covering all services and laboratory costs, for every patient. The reviews stay on Google. The audience comes from interest and location targeting, with no patient data. And the practice adds an unticked marketing consent box to intake, so future campaigns can use the lists of patients who said yes.

Who is on the hook when an agency writes the ad

You are. The RCDSO article The dos and don’ts of advertising (28 July 2025) says dentists are responsible for all advertisements involving them and their clinic(s). If you retained a third party to create ads, it suggests sharing the RCDSO practice advisory with them. It also says to ask staff to seek your approval before they post about you or the clinic.

In our view, an agency’s draft becomes yours the day you approve it, so approval is the control. Give your agency your college’s list in writing before the first draft, and sign off in writing before anything goes live. It is the first thing to ask of any agency running your digital advertising, ours included.

Where to start

You do not need a compliance department. Work through this list:

• Add a marketing consent box to intake, separate from treatment consent, unticked and naming the channels.
• Audit your current ad and website copy against your college’s list: superlatives, testimonials, giveaways, comparisons, named equipment.
• Make no patient list uploads to ad platforms or agencies without express consent on file.
• Review your replies to Google reviews so none of them confirms the person is a patient.
• Require written sign-off from a named person before an agency or a staff member posts anything about the clinic.

Our guide to marketing automation for small business in Canada shows how to automate what you are allowed to send, and a free AI marketing audit shows where your setup sits.

Frequently asked questions

Does PHIPA let a clinic use patient emails for marketing? Only with express consent. Section 33 of PHIPA says a health information custodian shall not use personal health information for the purpose of marketing anything unless the individual expressly consents. Implied consent does not cover marketing. This is general information, not legal advice, so check your own setup with a lawyer who knows health privacy.

Can a clinic upload its patient list to Facebook or Google ads? In our reading, not without express marketing consent. Being someone’s patient is itself personal health information under PHIPA, and a customer list uses that fact to target ads. The platform hashing the list does not change that, in our view. Get a separate, unticked marketing consent at intake first. This is general information, not legal advice.

Can doctors in Ontario use patient testimonials in advertising? For physicians, no. The advertising rules under the Medicine Act say information must not contain a testimonial or any comparative or superlative statements. The RCDSO’s guide also lists testimonials as something dentists should leave out. Other professions have their own colleges, so check yours. This is general information, not legal advice.

Can a dental office in Ontario run a giveaway or contest? The RCDSO’s Advertising with Integrity guide lists incentive programs such as giveaways, contests, draws, and free products or services as things not to include in dental advertising. A free whitening draw is therefore a problem. Other professions have their own colleges and rules, so check yours. This is general information, not legal advice.

What can an Ontario doctor send to regular patients without it counting as soliciting? Under the physicians’ advertising regulation, a doctor may remind a person of an appointment they made, and may contact regular patients about health maintenance procedures that are due, health issues, preventive medicine, recent developments in medicine, or a possible benefit from a change in therapy. A regular patient uses the doctor’s services regularly and has not asked for records to move.

Who is responsible if a marketing agency writes a clinic’s ad? The clinic. The RCDSO says dentists are responsible for all advertisements involving them and their clinics, and suggests sharing its practice advisory with any third party you retain to create ads. In our view, an agency’s draft becomes yours the day you approve it. This is general information, not legal advice.

---

Want your clinic’s marketing checked against the rules before it goes live? Get a free marketing audit. No jargon, no pressure.