Booking Forms and Privacy in Canada

This guide is about designing booking forms and the pages around them. It is general information, not legal advice. Clinics and other regulated professionals should also follow their own college's guidance.

Booking forms collect personal information by their nature: a name, an email address, a phone number, sometimes more. That makes them the part of a website where privacy law is most likely to apply in practice. This guide sets out which laws may apply in Canada, what a booking form should and should not ask for, and how to keep the messages that follow a booking discreet.

Which privacy law applies

For most private-sector businesses, the starting point is the Personal Information Protection and Electronic Documents Act (PIPEDA). The Office of the Privacy Commissioner of Canada lists provincial laws that may apply instead of PIPEDA because they have been deemed substantially similar¹:

Which one applies depends on where you operate and what kind of organization you are. The table is a map, not a ruling; your lawyer or professional association can confirm which law governs your business.

Collect only what the booking needs

Whatever law applies, the principle of limiting collection is a sound design rule. The federal privacy commissioner's guidance on PIPEDA's fourth principle tells organizations to collect only the personal information needed to fulfil a legitimate identified purpose, to limit the amount and type of information to what is needed and to make sure staff can explain why the information is needed².

For most bookings that means:

• Needed: name, one way to contact the customer, the service and the time.
• Often useful: a second contact method, a short note field with a clear prompt, a returning-customer checkbox.
• Usually not needed online: date of birth, home address (unless you travel to the customer), health history, government ID numbers, payment card details on your own form.

Every field on a booking form should pass one test: if a customer asked why you need it, could your staff answer in one sentence?

Health information and clinic bookings

Clinics and health practitioners face the strictest expectations. In Ontario, the Personal Health Information Protection Act is one of the provincial health information laws on the commissioner's list¹. The Information and Privacy Commissioner of Ontario's guidance on email, as summarized by a law firm, says custodians must tell patients about their email policy and obtain consent before sending unencrypted personal health information by email, that consent alone is not enough, and that the amount and type of health information in emails should be limited³.

For booking websites, that translates into a few practical choices:

• Keep clinical questions out of the public booking form unless your own privacy advice says otherwise. Intake can happen through a secure system the clinic already uses.
• Write reminders with the time, place and practice name only, without naming a treatment.
• Keep calendar events minimal, since calendars are often visible to several people.
• Use a booking system that stores data in a way your privacy advisers have approved.

Quebec: tracking technology and default settings

Quebec's private-sector privacy law, as amended by the legislation often called Law 25, adds specific rules that affect websites. Section 8.1 requires anyone who collects personal information using technology with functions that can identify, locate or profile the person to first inform them of the use of that technology and of the means available to activate those functions⁴. A law firm commentary reads the revised wording as implicitly requiring such technology to be deactivated by default⁵. Section 9.1 requires technological products or services with privacy settings to provide the highest level of confidentiality by default, and states that this does not apply to browser cookie settings⁴.

The same commentary notes that most of the Law 25 amendments took effect on September 22, 2023, and distinguishes essential cookies, which a site needs to function, from non-essential ones such as analytics and advertising cookies⁵. For a booking site that serves Quebec customers, the cautious approach is to run without non-essential tracking by default and to switch it on only after the visitor agrees.

What the privacy notice should say

A privacy notice for a booking website does not need to be long. It should say, in plain language:

1. The person or business accountable for the data, and how to reach them.
2. What the booking form collects and why each item is needed.
3. Who else handles the data, such as the booking platform, payment processor and email service.
4. How long booking records are kept.
5. Whether any tracking or analytics run, and how to turn them off.
6. How a customer can ask to see or correct their information.

Marketing consent stays separate

If you want to send newsletters or offers, ask with a separate, unticked checkbox and keep it optional. Marketing messages are governed by Canada's anti-spam rules as well as privacy law. Our guide on CASL and appointment reminders explains how booking messages and marketing messages differ.

Security basics for booking data

• Serve the whole site over HTTPS.
• Keep card details off your own forms by using your payment processor's hosted page.
• Limit admin access to the people who need it, and remove access when staff leave.
• Delete old booking records on a schedule you have decided and written down.
• Keep software and plugins updated.

What we build

When we plan a booking form, every field has a written reason, sensitive questions stay out of public forms, reminders stay discreet and the privacy notice is drafted from what the form actually collects. You review the notice, and if your business is regulated, your advisers review it too.