Is Virtual Physiotherapy Private and Secure? PHIPA Explained

Virtual physiotherapy can be private and secure when it's delivered the right way — over encrypted, healthcare-grade video, with proper consent, identity checks, and access controls, and under the same privacy laws that govern any Ontario clinic. Your session is a confidential health-care appointment, not an ordinary video call.

Here's how that protection actually works, in plain language.

What privacy laws apply to virtual physiotherapy in Ontario?

Two main laws protect your information:

• PHIPA (Ontario's Personal Health Information Protection Act) governs how regulated health providers collect, use, store, and share your personal health information. It applies to virtual care exactly as it applies to in-clinic care.
• PIPEDA (Canada's federal private-sector privacy law) sets baseline standards for how personal information is handled by organizations.

On top of these laws, physiotherapists are registered with and accountable to the College of Physiotherapists of Ontario (CPO), which sets professional standards for confidentiality and record-keeping. Your privacy isn't a feature we added — it's a legal and professional obligation.

How is the video session kept secure?

A confidential session depends on more than a good password. The key safeguards include:

• Encrypted, healthcare-grade video. Sessions run on platforms designed for clinical use, with encryption in transit — not a consumer chat app repurposed for health care.
• Private, one-to-one connections. Sessions are not recorded by default, and your clinician connects with you directly.
• Secure records. Your clinical notes are stored in protected systems with restricted access, the same as any regulated Ontario clinic keeps.

How do you confirm it's really me?

Before care begins, and at the start of sessions, your clinician verifies your identity. This protects your health information from being disclosed to the wrong person and confirms we're providing care to the right individual. It's a simple step, and a standard part of responsible virtual care.

Do I have to consent to virtual care?

Yes — and that consent is documented. Before your first session, you'll be informed about how virtual care works, its benefits and limitations, and how your information is protected, and you'll provide consent to receive care this way. Consent to virtual care is meaningful: you're agreeing to the format understanding both what it offers and where it has limits, and you can ask questions or withdraw at any time.

Who can see my information?

Access is limited to those directly involved in your care, on a need-to-know basis. That's the principle behind our safeguards:

• Access controls restrict who can open your record.
• Confidentiality obligations bind everyone on the clinical team under PHIPA and CPO standards.
• Breach reporting. If a privacy breach ever occurred, we are required to respond and, where the law requires, to notify affected individuals and the Information and Privacy Commissioner of Ontario. Being transparent about this is part of taking privacy seriously.

You can also learn how insurance information is handled when you use WSIB or auto coverage, extended health benefits, or explore our approach to insurance.

What can I do on my end to keep sessions private?

Privacy is a shared effort. A few simple steps help:

• Take your session in a private space where you won't be overheard.
• Use a secure, trusted internet connection rather than shared public Wi-Fi when possible.
• Keep your device updated and protected with a passcode.
• Use headphones for an added layer of privacy.

Your clinician can suggest more if your situation calls for it.

Do I need to be in Ontario for a session?

Yes. Because our physiotherapists are registered to practise in Ontario, you must be an Ontario resident and physically located in Ontario at the time of your session. This isn't a technicality — health regulation is tied to where you are when you receive care, and staying within Ontario keeps your treatment properly licensed and covered. If you're travelling out of province, we'll simply reschedule for when you're back home.

The honest bottom line

No system, virtual or in-person, can promise that privacy is absolutely risk-free — that would be overclaiming, and we won't. What we can say is that virtual physiotherapy, done properly, is held to the same privacy laws and professional standards as any Ontario clinic, and is built with real safeguards to protect your information. For most people, it's a safe, confidential way to get the care they need.

Have questions about privacy before you begin? Get started and we'll walk you through it.