Clinic websites & patient apps, built to pass.

Yes — and the same applies in every Canadian province under its own statute: PHIPA in Ontario, HIA in Alberta and the territories, PIPA in BC, HIPA in Saskatchewan, PHIA in Manitoba and the Atlantic provinces, and Law 25 in Quebec. The moment a patient enters their name, date of birth, health card, or reason for visit on your site, you become a health-information custodian / trustee under whichever law governs your province. Ontario's IPC has published breach findings involving clinics whose booking forms sent PHI over plain email — the same enforcement happens through the privacy commissioners in BC, AB, QC, and Atlantic Canada. Most small-clinic sites on Wix, Squarespace, or shared WordPress fail at least three basic controls. We build replacements that pass — end-to-end.

Under HIPAA, appointment requests, intake forms, and contact forms that ask about symptoms all count. If the infrastructure isn't covered by a Business Associate Agreement, you're already non-compliant. Every package we ship includes a signed BAA / DPA as part of the deliverable.

Yes — every province has its own health-information law and they all impose the same custodian / trustee duty when a clinic collects patient data: Alberta — Health Information Act (HIA) + PIPA; British Columbia — PIPA + PIPEDA fallback; Saskatchewan — Health Information Protection Act (HIPA); Manitoba — Personal Health Information Act (PHIA); Quebec — Law 25 (the strictest Canadian regime — explicit consent, data residency in Canada, mandatory breach notification, right to erasure); New Brunswick — PHIPAA; Nova Scotia, Newfoundland & Labrador, PEI — PHIA / HIA; Yukon & Northwest Territories — HIPMA / HIA. The technical controls in every package — TLS in transit, encryption at rest, role-based access, audit logs, signed BAA / DPA, breach-notification readiness, vendor offboarding — clear all of these. We pick a hosting region that matches your provincial requirements (Quebec data stays in QC / Canada, Atlantic and BC data stays in Canada, etc.) and the paperwork is named to the right statute.

If your site is purely a marketing page (hours, location, services) and does not collect any patient info at all, the Display-only package is fine. The moment you have a booking form, intake form, or contact form asking about symptoms, you need the Clinic CMS package — which is what most clinics end up on. If you also need a patient portal with sign-in and messaging, you're looking at the Patient Portal app.

Design, hand-coded build (fast and accessible), PHIPA-safe booking and intake forms, secure contact flow, PHIPA / HIPAA-compliant hosting, BAA / DPA paperwork, encryption in transit and at rest, role-based access, audit log, and handover of everything (your GitHub, your DNS, your domain). No per-seat tax on your team. From $1,998+.

We build them as full applications — secure sign-in, document upload, messaging, booking, EMR integration (Jane, OSCAR, Accuro, athenahealth, Epic via FHIR where supported), reminders. Scoped per project, priced from $4,998+. Most qualify for SR&ED (up to 35% back) and IRAP (up to 80% of labour).

Clinic marketing site: 2–6 weeks. Patient portal / custom app: 6–12 weeks. Migration from a non-compliant Wix / Squarespace / shared WordPress site: typically 3–4 weeks. Weekly demos, Friday deploys, no month-long silences.

Yes. Your GitHub, your database, your BAA, your domain. If you ever stop working with us, the next compliance-aware dev team picks it up the same afternoon. No lock-in.

Most clinic builds qualify for DMAP (up to $15K for digital adoption), SR&ED (refundable tax credit on technical R&D), and IRAP (covers up to 80% of labour for innovative work). We document the project so your accountant can claim every dollar available.