For small health and wellness practices in Canada
Never trained on client privacy? You're not the only one.
So you've been figuring it out as you go. Is your booking app OK for client notes? Is it fine to email intake forms? What would you show a client who asked how you look after their file?
The Practice Privacy Kit answers those for your practice, in writing. Then we set up the basics with you.
15 minutes on video. We'll tell you straight whether it's worth it for you.
- Your privacy risk assessment, dated and on file
- Your approved tools list: every app you use, checked
- Your policy pack, filled in for your practice
- Your setup, done with you
Want a quick read first? Take the free 3-minute security check.
You were trained to look after clients. The paperwork side came with no manual.
Your practice probably runs on a handful of apps. One for records, one for booking, one for email, maybe one that writes your notes. Each one holds client information. Nobody ever sat you down and showed you how to check them.
Using a good records system helps. It doesn't hand your responsibility to the vendor. Who can still log in, whether forms go out as email attachments, whether your laptop is encrypted: that part is on your side.
If someone asked today how you look after client information, you'd be answering from memory. The Kit puts the answer on paper.
What you walk away with.
Four things, made for your practice. Three go in your file. The fourth we do with you, live.
Your privacy risk assessment
Where your practice stands today, dated, so you can show when you checked.
- A review of 12 areas of your practice
- A scored report with every finding ranked, worst first, and what to do about it
- A call where we go through it with you
- A “next review due” date, because this is worth redoing every year
Your approved tools list
Every app you use for client work, checked, with a clear answer on each.
- Your records system, booking, billing, email, video, forms, file storage and any AI note-taker
- Where each one says it stores your data
- Whether 2-step login is on for everyone who uses it
- What its privacy terms say about who can see your data, AI training, and getting your data out
- Our recommendation for each: keep it, keep it with a change, or replace it
It’s the “is this app OK for client info?” question, answered for every app you actually use.
Your policy pack
Five documents, filled in with your practice’s name, tools and people. Not blank templates.
- Your privacy policy, naming the tools that hold client information
- Client consent wording for your intake forms
- A confidentiality agreement for staff and contractors, with a checklist for when someone joins or leaves
- A one-page device rules sheet for any laptop, phone or tablet used for client work
- A one-page breach plan: who to call, what to do first, and the reporting questions to check where you practise
Advisory, not legal advice. If you’d like a lawyer to read anything, you’ll be handing them a finished draft.
Your setup, done with you
An hour, live, where we set up the basics with you, most important first. No passwords handed over.
- 2-step login on your email and records system
- Encryption turned on for your laptop (FileVault on Mac, BitLocker or Device encryption on Windows)
- Your phone and iPad locked, with remote wipe turned on
- Guest Wi-Fi kept apart from the devices you use for client work
- Intake forms moved out of email attachments and into your records system
One session, most important first. Anything we don’t get to goes to the top of your report, with the steps written out.
Also included:help answering your insurer's security questions, 90 days of email questions, and your first month of the Practice Privacy Care Plan.
Four steps. You never hand us a password.
A free 15-minute call.
Tell us how your practice runs: where notes and bookings live, how forms go out, who else works with you. We’ll tell you if the Kit is a fit.
You show us, we look.
About an hour, live. You walk us through your setup and your apps. We also check what anyone can see from outside, like whether someone could send email pretending to be you.
Your Kit in 10 business days.
Your assessment, your approved tools list and your policy pack, filled in for your practice. Then a call where we go through all of it.
Your setup, done with you.
An hour, live, soon after your Kit arrives. We set up the basics with you, most important first.
About three hours of your time, spread over about three weeks.
What it's worth, and what it costs.
One price. Here's each piece and what it would cost on its own.
Total value: $2,699
Your price, solo practice:
$850
Not bad, for peace of mind.
Group practice or clinic? We'll quote it after the free call.
Prices in Canadian dollars. After the first month, the Care Plan is $199 a month if you want to keep it. Advisory, not legal advice, not a certification.
Our guarantee
We find 3 or it's free.
If your assessment doesn't turn up at least three real things worth fixing in your practice, you get your money back. You keep the report either way.
Worst case, you find out you're in good shape.
Not included: card payment security (PCI) and staff phishing training. Hands-on help beyond your one setup session is quoted separately.
This is for you if
- You run a small private practice, on your own or with an admin. Counsellor, psychologist, social worker, physio, chiro, massage therapist, acupuncturist, naturopath, dietitian, OT, or something close.
- Your client records live in Jane, Owl, Cliniko or a mix of apps, and you handle intake, notes and billing yourself.
- You’ve never had training on the privacy side, and you’d like to know you’re doing it right.
- You’d rather have the documents written for you than fill in a template at midnight.
This is not for you if
- You’re a hospital, a health authority or a large clinic with your own IT and privacy staff.
- You want someone to try to break into your systems. We look, write it down and set things up with you. We don’t attack anything.
- You’re after a certificate or a badge. No Canadian program certifies a practice’s privacy, so we don’t sell one.
Yellowbird is a small company working with practices across Canada. We already look after websites, hosting and email for small businesses. Our checklist follows the CyberSecure Canada baseline controls. We sign a confidentiality agreement before we start, and your Kit goes to you and nobody else.
Questions people ask.
I use Jane (or Owl, or Cliniko). Isn’t that enough?
It’s a good start. Those systems look after their side: hosting and storage. They can’t control how your practice uses them. Who still has a login, whether 2-step is on for everyone, whether forms get emailed around outside the system. That’s what the Kit checks, and the setup session fixes the most important of it with you.
How do I know if an app is OK for client information?
That’s what your approved tools list is for. We go through every app you use, look at where it says it keeps your data, check your settings, and read what its privacy terms say. Then we give you a recommendation for each one: keep it, keep it with a change, or replace it. You decide. The list shows you checked.
Are these just templates?
No. Your policy pack is filled in with your practice’s name, the apps you use, the people who work with you, and your steps. You can read it, sign off on it and use it.
Is the policy pack legal advice?
No. It’s written to be used day to day, and it’s advisory. If you want a lawyer to read any of it, you’ll be handing them a finished draft, which usually costs less than starting from nothing.
Do you log into my systems?
No. You never hand over a password. We work through your setup with you in a live session, plus what anyone can see from outside.
What if we don’t finish everything in the setup session?
We start with what matters most, usually 2-step login and device encryption. Whatever’s left goes to the top of your report with the steps written out. If you’d like us there for more, we’ll quote it first.
How much of my time does this take?
About three hours over about three weeks. A 15-minute call, a short form about your apps, an hour showing us your setup, a call to go through your Kit, and the hour-long setup session.
Is $850 worth it for a solo practice?
It’s about five or six sessions, once. You get your assessment, your tools list, five documents written for your practice, an hour of setup, help with your insurer’s questions, 90 days of email questions and a month of the Care Plan. And if we don’t find three things worth fixing, you get your money back.
I have a group practice. Can you do this for us?
Yes. More people means more logins and more devices, so we quote group practices and clinics after the free call, before anything starts.
Is this a certification?
No. There’s no Canadian program that certifies a practice’s privacy, so a badge wouldn’t mean anything. This is an advisory review. You get a dated record of what was checked, what was found and what you did about it.
What happens on the 15-minute call?
Fifteen minutes on video. If you took the security check, we go through your score. If not, we ask how your practice runs. Then we tell you straight whether the Kit is worth it for you. Nobody follows up to pressure you.
Find out where your practice stands. Then get it on paper.
Book a free 15-minute call. We'll ask how your practice runs and tell you whether the Kit is worth it for you. If it is, you'll have your Kit in 10 business days and your setup session soon after. If it isn't, we'll say so.