Short answer
Dental appointment request forms collect personal information, and once linked to a request for care that information may be treated as personal health information. Which law applies depends on your province: PIPEDA, a substantially similar provincial private sector law, or a provincial health information law such as Ontario’s PHIPA or Alberta’s Health Information Act, which lists dentists among its custodians. In every case, collect only what you need to call the patient back, send it securely, keep it briefly and explain all of this in a privacy notice.
Which law applies
Canada has a federal private sector privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), and several provincial laws that apply instead in certain situations. The Office of the Privacy Commissioner of Canada lists the provincial laws deemed substantially similar to PIPEDA.1
| Province | Law | Type |
|---|---|---|
| Alberta | Personal Information Protection Act | General private sector |
| British Columbia | Personal Information Protection Act | General private sector |
| Quebec | Act respecting the protection of personal information in the private sector | General private sector |
| New Brunswick | Personal Health Information Privacy and Access Act | Health information |
| Newfoundland and Labrador | Personal Health Information Act | Health information |
| Nova Scotia | Personal Health Information Act | Health information |
| Ontario | Personal Health Information Protection Act | Health information |
The OPC notes that PIPEDA still applies in Alberta, British Columbia and Quebec to transactions involving personal information transferred across borders, and to federally regulated businesses.1 Provinces can also have health information laws that apply to dentists even though they are not on the OPC’s list. In Alberta, for example, the Office of the Information and Privacy Commissioner of Alberta lists dentists, dental hygienists and denturists among the custodians under the Health Information Act.4 Other provinces and territories may have similar laws. Your privacy advisor or regulator can confirm which law covers your practice.
Collect less
The simplest privacy safeguard is not to collect information in the first place. The Information and Privacy Commissioner of Ontario has made the point that custodians may not collect, use or disclose personal health information if other information will serve the purpose, or more than is reasonably necessary.3 An appointment request form rarely needs more than this:
- Name.
- Phone number or email, and the preferred way to be contacted.
- New or existing patient.
- Preferred location, days and times.
Leave out date of birth, health card numbers, insurance policy numbers, medical history and symptoms. If you keep a free-text note field, add a short line asking patients not to include health details, and keep the field optional.
Send it securely
The website should use HTTPS on every page, not only the form. Requests should go to an address on your practice’s own domain, using authenticated mail, or into a secure inbox provided by your practice software.
Email deserves care. In 2016, the Information and Privacy Commissioner of Ontario issued guidance on communicating personal health information by email. According to a summary by law firm BLG, it expects custodians to use encrypted email where feasible, to give patients notice of their email policy and obtain consent before sending unencrypted personal health information, and to limit the amount and type of health information included in email.2 Even if your form only collects contact details, the reply your team sends can include more. Train staff to move clinical conversations to the phone or a secure channel.
Keep it briefly
Decide how long website requests are kept, and delete them on schedule. A request that turned into an appointment belongs in your practice records, under your normal retention rules. A request that did not lead anywhere does not need to sit in an inbox for years. Write the retention period into your privacy notice and follow it.
Write a clear privacy notice
Your website privacy notice should say, in plain language:
- Who is responsible for the information and how to contact them about privacy.
- What the website collects through forms, server logs and any cookies.
- Why each item is collected.
- Who can see it, including service providers such as your host or email provider.
- Where it is stored, if you know, and how long it is kept.
- How patients can access or correct their information or withdraw consent.
Link the notice from the form itself, next to the submit button, and from the footer of every page.
Third-party tools
Every script on your website can see something about your visitors. Analytics, chat widgets, booking tools, maps and social embeds may collect data and send it elsewhere. On pages with forms, keep third-party scripts to a minimum. If you use analytics, configure it to collect as little as possible and describe it in your cookie and privacy notices.
Common mistakes
- A form that asks patients to “describe your symptoms” in detail.
- Requests sent as plain email to a staff member’s personal email account.
- A confirmation email that repeats everything the patient typed.
- No privacy notice, or a generic one copied from another business.
- Form submissions stored in the website database indefinitely.
- Marketing tags that load on the form page.
Our appointment request forms service builds forms that avoid each of these. This guide is general information, not legal advice. Confirm your obligations with your privacy advisor or regulator.
Sample wording for a form privacy section
A form needs a short privacy explanation next to it, with a link to the full notice. This example is a starting point to review with your privacy advisor:
“We use the information in this form only to contact you about your appointment request. Please do not include health information. Your request is sent securely to our front desk and is deleted from our inbox within 90 days if it does not lead to an appointment. If you become a patient, your information is kept with your patient record. For more detail, or to ask about your information, see our privacy notice or contact our privacy officer at [address].”
Adjust the retention period, the contact and the description of where requests go to match what your practice actually does. A privacy notice that describes a process you do not follow is worse than a short, accurate one.
Frequently asked questions
Is a name and phone number health information?
On its own, a name and phone number is personal information. Once it is linked to a request for dental care at your practice, it may be treated as personal health information under laws such as Ontario’s PHIPA. Ask your privacy advisor how your law treats it, and protect it accordingly.
Can we use a free online form service?
Check where the service stores data, who can access it, whether it uses submissions for its own purposes and whether you can delete records. Some free services store data outside Canada or keep it indefinitely. A form that sends directly to your practice is often simpler to manage.
Do we need a privacy notice on the website?
Yes. Patients should be able to read, before they submit anything, what you collect, why, who sees it, how long you keep it and how to contact you about privacy.
Sources
- Office of the Privacy Commissioner of Canada: Provincial laws that may apply instead of PIPEDA Regulator
- BLG: IPC releases guidance on communicating PHI by email (15 September 2016) Secondary source (law firm summary of IPC Ontario guidance)
- Information and Privacy Commissioner of Ontario: Privacy and Personal Health Information in Ontario (presentation, 2016) Regulator
- Office of the Information and Privacy Commissioner of Alberta: Health Information Act (HIA) overview Regulator
Checked on 29 October 2026. Rules change, so confirm the current version with the regulator before you publish.
