Doctors moving from the UK or Australia to Canada usually expect a single national rulebook for advertising. There isn't one. Medicine is regulated province by province, which means the ethical limits on how you promote your practice are set by your provincial college — and they do not all say the same thing. Layer on federal privacy law, provincial health-information law, and Canada's anti-spam legislation, and you have three separate compliance surfaces sitting on top of one clinic website.
The good news: once you understand which body owns which surface, the work is mostly one-time setup.
This is a practitioner's summary written by marketers, not legal advice. Regulations change, and enforcement varies. Confirm the current text with your regulator or your own counsel before you publish.
Surface one — your provincial college owns what you may claim
Physician advertising is governed by the college you are licensed with: the College of Physicians and Surgeons of Ontario, the CPSBC in British Columbia, the CPSA in Alberta, the Collège des médecins du Québec, and their counterparts in every other province and territory. Unlike Australia's single National Law, there is no shared text — so a marketing asset cleared by one college is not automatically fine in another.
Three themes run through nearly all of them:
- Factual and verifiable. Claims about training, credentials, technology and outcomes have to be substantiable on request. Superlatives — best, leading, top — are the fastest route to a complaint because they are, by definition, not verifiable.
- No exploitation of vulnerability. Marketing that leans on fear, urgency, or a patient's lack of medical knowledge is the category colleges enforce most aggressively, particularly around cosmetic and elective procedures.
- Title discipline. Describing yourself as a specialist, or using a designation you do not hold in that province, is treated as misleading advertising regardless of your training elsewhere. Royal College certification and provincial specialist recognition are not the same thing as a marketing adjective.
If your practice operates in more than one province — increasingly common with virtual care — you are subject to the rules of each province where the patient is located, not just where you sit. Build your website to the strictest applicable standard and you avoid maintaining parallel versions.
Quebec is genuinely different
Quebec is not a variation, it is a separate compliance project. The Charter of the French Language, as amended, requires French in commercial communications, and where another language appears, French must be markedly predominant. That applies to your website, your signage, your Google Business Profile description, your ad copy and your appointment confirmations. Machine-translating an English site is not a strategy; it reads as foreign to Québécois patients and it will not satisfy the requirement in spirit.
Quebec's Law 25 also imposes the country's most demanding private-sector privacy regime — consent requirements for tracking technologies, a designated privacy officer, breach reporting, and rights over automated processing. If you serve Quebec, start there and everything else in the country becomes easy.
Surface two — privacy law owns what you may collect
PIPEDA is the federal baseline for commercial collection of personal information, but for health information the operative law is usually provincial: PHIPA in Ontario, the Health Information Act in Alberta, and equivalents elsewhere. Alberta, British Columbia and Quebec also have substantially similar private-sector privacy statutes that displace PIPEDA for provincially regulated organizations.
For marketing purposes, the practical questions are narrow:
- What is your website collecting before consent — analytics identifiers, ad platform pixels, session replay, chat widgets?
- Where does that data go, and is any of it capable of revealing something about an individual's health? A booking form on a page titled with a condition can do exactly that.
- Who is your processor, what is in the contract, and where is the data stored?
Session-replay tools and heatmaps are the ones that catch practices out. They are enormously useful and they routinely capture form fields. If you run them, mask inputs at the source, not after the fact.
The fix is architectural, not cosmetic
A consent banner that fires after the pixels have already loaded is worse than no banner — it documents an intent you did not honour. Gate marketing and analytics tags behind consent, keep condition names out of URLs and query strings, and move conversion measurement server-side so you are sending an event, not a browsing history. Doing this once removes the majority of your ongoing exposure.
