Principle 01
Accountability
PIPEDA requires a designated person responsible for compliance. Delam ships a named privacy officer contact and documented responsibility chain.
Canada · PIPEDA medspa software
For Canadian clinics that need federal-privacy-grade records and consent without assembling the stack yourself. PIPEDA medspa software that's already compliant on day one, with Canadian data residency, audit trails, and breach notification workflow.
Section 01 · What PIPEDA requires
The 10 principles, plain language.
PIPEDA is Canada's federal private-sector privacy law. Every Canadian aesthetic clinic handling personal health information has to satisfy all ten fair-information principles. The strictest provincial rule then layers on top, Quebec Law 25 in QC, PHIPA in ON, PIPA in BC and AB. Delam is PIPEDA medspa software aligned to that bar.
Source: Office of the Privacy Commissioner of Canada, PIPEDA fair information principles, 2024.
Principle 02
Identifying Purposes
Every data-collection surface in Delam's PIPEDA medspa software states the purpose before the patient consents, captured and versioned on the record.
Principle 03
Consent
Express or implied consent is captured at booking and at each new purpose. Patients can withdraw in one tap, with downstream automations halting in under 60 seconds.
Principle 04
Limiting Collection
PIPEDA medspa software only collects what's needed for the stated purpose. Intake forms default to minimum required fields; optional fields are flagged clearly.
Principle 05
Limiting Use, Disclosure, Retention
Data is used only for the disclosed purpose. Retention defaults to seven years and is configurable; secure destruction runs on schedule with an audit entry.
Principle 06
Accuracy
Patients can correct their profile, address, medical history, and preferences from the branded app. Corrections propagate across the record with a timestamp.
Principle 07
Safeguards
AES-256 encryption at rest, TLS 1.3 in transit, role-based access, MFA for staff, and audit logging on every PHI read or write.
Principle 08
Openness
Clinics publish a plain-language privacy notice generated from Delam's template. Data-flow inventory is maintained and available on request.
Principle 09
Individual Access
Patients can request their full record; clinics export in CSV or JSON within thirty days. Every access request is logged to the audit trail.
Principle 10
Challenging Compliance
Complaint workflow built in. Delam routes patient privacy complaints to the designated officer with SLA tracking and audit entries.
Section 02 · How Delam delivers PIPEDA
PIPEDA medspa software, not bolted on.
Every PIPEDA control in Delam is a first-class primitive, not a checkbox on a settings page. Consent is attached to every booking and photo. Audit logs write on every PHI touch. Breach workflow fires a 72-hour clock automatically.
Canadian data residency
All clinic and patient data lives in AWS Canada (Central), the ca-central-1 region. Backups and file storage stay inside Canadian borders.
Encryption at rest and in transit
AES-256 at rest, TLS 1.3 in transit, with field-level encryption for direct identifiers. Keys are rotated on Delam-managed schedules.
Audit logging on every PHI touchpoint
Every PHI read, write, export, and delete writes to an immutable ledger with staff ID, action, purpose, IP, and timestamp. Retained seven years.
Patient access and correction
Patients can request their record from the branded app. Clinics export in CSV or JSON and record the request in the PIPEDA medspa software audit trail.
Designated privacy contact
Delam's named privacy officer is documented in your clinic's privacy notice, with an escalation path for regulator inquiries and patient complaints.
72-hour breach notification
Breach workflow triggers a 72-hour internal clock, prewritten patient notice, regulator escalation, and a breach register retained two years.
Section 03 · Deep-dive
The PIPEDA edges that catch people out.
Cross-border transfers
Some features, for example AI transcription, may route data to vendors hosted outside Canada. PIPEDA requires a documented privacy impact assessment before any cross-border flow. Delam completes the PIA, evaluates the foreign legal regime, applies standard contractual clauses, strips direct identifiers before AI inference, and discloses the transfer in the clinic's privacy notice. Quebec Law 25 layers the stricter rule on top, so clinics with any Quebec residents get the stricter default.
Explicit consent model
PIPEDA recognizes both express and implied consent. For health information the standard is higher, express, informed, and specific. Delam's PIPEDA medspa software defaults to express consent at booking, at check-in, and at any new purpose (marketing, before/after photos, AI-assisted call handling). Every consent event writes a timestamped record with IP, device fingerprint, purpose, and consent version. Revocation is one tap with downstream automations halting inside sixty seconds.
Minor-data handling
Quebec Law 25 sets the strictest Canadian rule for minors. For patients under 14, Delam's PIPEDA medspa software never collects data directly from the minor unless parental or guardian consent exists, or the collection is clearly in the child's best interest. Guardian contact is linked to the minor's record, and retention is tighter by default. Age verification is required before processing any new enrolment.
Retention and disposal
PIPEDA requires that personal information only be retained as long as needed for the stated purpose. Delam's retention defaults to seven years, matching CPSO Policy 4-12, with a 16-year configuration available for Ontario pediatric records and Law 25 deletion-on-request flows. Secure destruction runs on schedule and writes an audit entry. Patients can request deletion any time, subject to the clinical retention minimum.
7 yr
Audit-trail retention
Matches CPSO Policy 4-12 minimums
100%
PHI in Canadian region
ca-central-1 residency, AWS Canada (Central)
72 h
Breach notification SLA
PIPEDA Breach of Security Safeguards Regs
Section 04 · FAQ
PIPEDA, asked and answered.
The questions Canadian clinic owners ask us when they're comparing PIPEDA medspa software vendors.
- Does Delam's data stay in Canada?
- Yes. Delam stores all clinic and patient data in AWS Canada (Central), the ca-central-1 region. Backups, file storage, and the PIPEDA medspa software audit trail live inside Canadian borders. Anonymized data routed to cross-border AI services only runs after a documented privacy impact assessment, with identifiers stripped and standard contractual clauses in place.
- What happens if there's a breach?
- PIPEDA's Breach of Security Safeguards Regulations require notifying affected individuals and the Office of the Privacy Commissioner of Canada for any breach with real risk of significant harm. Delam ships the notification workflow built in: a 72-hour internal escalation clock, a prewritten patient notice template, and a breach register with retention of two years. Quebec Law 25 follows the same 72-hour outer bound, so the strictest rule wins.
- Can patients request their records?
- Yes. PIPEDA Principle 9 and Principle 10 grant patients the right to access and correct their personal information. Delam exposes a patient access workflow in the branded app and a clinic-side handler in the dashboard, so staff can export a patient's full record in CSV or JSON within thirty days. Every access request is logged to the PIPEDA medspa software audit trail.
- Does Delam meet Quebec's stricter rules?
- Yes. Quebec Law 25 (P-39.1) is stricter than PIPEDA on consent, automated-decision transparency, and breach notification. The strictest rule wins, so Delam's PIPEDA medspa software stack also satisfies Law 25 by default. Quebec-specific surfaces, automated-decision disclosures on AI calls, bilingual fr-CA consent templates, cross-border PIA, ship with the platform.
- Is PIPEDA enough for HIPAA audits?
- PIPEDA and HIPAA overlap on encryption, access control, audit logging, and breach notification but differ on specific controls. Delam's PIPEDA medspa software is live today. HIPAA attestation and SOC 2 Type II are targeted Q2 2026 for the US enterprise rollout, with Business Associate Agreements available on request. Canadian clinics can be PIPEDA compliant with Delam today without waiting on HIPAA.
― Related
- Quebec Law 25 medspa
P-39.1 automated-decision disclosure, 72-hour breach notification, bilingual consent.
- Bilingual medspa software
en-CA and fr-CA across every surface, patient app to AI front desk.
- Medspa EMR
PHI-grade records, consent at booking, before/after tracking with revocation.
- Canada hub
PIPEDA, Law 25, PHIPA, R-22.1, bilingual, Interac, CAD payouts.
Ready when you are
Preview your PIPEDA medspa software in 24 hours.
PIPEDA live from day one. Canadian data residency, audit trails, breach workflow, patient access, and consent lifecycle, all first-class primitives. Preview your branded app in 24 hours.
PIPEDAca-central-1Audit 7yrBreach 72h
Last updated