How a Med Spa Should Respond to a Negative Google Review (PHIPA and Quebec Privacy Limits)

Key point to remember. A med spa is usually not a health information custodian under Ontario's PHIPA. The nurse, physician or other regulated practitioner working inside it almost always is. That practitioner cannot disclose a client's personal health information to a non custodian, and that includes the spa that employs them. So the marketing coordinator writing your review replies is handling information they have no lawful route to. The safe reply never confirms the person was a client, never names a treatment, and never corrects the facts of a visit in public.

Why this matters right now

Most published guidance on review replies is written for dental and medical offices, where the clinic itself is the custodian and the rules are comparatively clear. Medical aesthetics sits in a gap. The business is a commercial enterprise, often owned by someone who is not a regulated health professional, while the services delivered inside it are performed by nurses and physicians who carry their own professional obligations.

That split is not theoretical. It changes who is legally allowed to touch the information that a review reply would expose, and almost nobody in the industry has drawn the line correctly.

On a batch of dental and medical aesthetics listings in Ontario and Quebec that we read in September 2026, 69 percent of one and two star reviews had no owner reply at all. The pressure to answer is real. The pressure to answer badly is what this article is about.

What the rule actually says

The Information and Privacy Commissioner of Ontario publishes the authoritative plain language guide to PHIPA. Two passages decide the question.

First, on who counts as a custodian. The IPC lists examples of custodians, then states plainly:

"A health care practitioner, who provides health care, but who contracts with, is employed by or volunteers for an organization that is not defined as a custodian under PHIPA, would fall within the definition of a custodian under PHIPA and must comply with all requirements for custodians."

The IPC then gives its own examples of exactly this situation, and one of them is a spa:

"a registered massage therapist providing health care services to clients of a spa"

Second, and this is the passage that decides who may write the reply:

"A custodian cannot disclose personal health information to a non-custodian, including the non-custodian for whom the individual is working, unless the individual whose personal health information is at issue has given express consent or the disclosure is permitted or required by PHIPA or another law."

Read those together. The practitioner inside your spa is a custodian. Your spa, as a business entity, generally is not. The practitioner is therefore barred from handing client health information to the business itself without express consent. A review reply drafted by your front desk or your agency, describing what happened during a treatment, is that disclosure made in public.

The IPC is equally clear that the obligation does not stop at regulated professionals:

"It is an offence under PHIPA for any organization to wilfully collect, use or disclose any personal health information including health numbers in a manner that contravenes PHIPA."

And on penalties, for an organization rather than an individual:

"who is not a natural person for example, an organization or institution can be liable for a fine of up to $250,000"

In Quebec, the same split, tighter wording

A Quebec med spa where a physician performs injectables faces an even more explicit rule. Article 20 of the Code de déontologie des médecins (M-9, r. 17), read on legisquebec.gouv.qc.ca on September 22, 2026, requires the physician to:

"s'abstenir de tenir ou de participer, incluant dans des réseaux sociaux, à des conversations indiscrètes au sujet d'un patient ou des services qui lui sont rendus ou de révéler qu'une personne a fait appel à ses services"

Two things there are unusual and worth reading twice. The article names social networks explicitly, so a Google or Facebook reply is squarely inside it. And the prohibited act includes simply revealing that a person used the physician's services. Not the diagnosis. Not the treatment. The mere fact of the relationship.

The same article, at paragraph 3, extends the obligation outward to everyone the physician works with:

"prendre les moyens raisonnables à l'égard des personnes qui collaborent avec lui pour que soit préservé le secret professionnel"

That is the clause a Quebec clinic owner should photocopy and hand to their marketing agency.

The method, four steps

1. Decide who is allowed to write the reply, once

Not per review. Once, in writing. If any part of your service is delivered by a regulated practitioner, the person who drafts replies about those services needs a defined relationship to the custodian, and the practitioner needs to approve any reply that touches on care. In practice this means a named approver with a sixty second review, not a committee.

2. Reply to the experience, never to the record

A reviewer may have written anything, true or false. Your reply may only contain what you would say to a stranger in the waiting room. Service hours. Booking policy. How complaints are handled. Who to call. Nothing that confirms attendance, treatment, outcome, or payment.

3. Move the specifics to a private channel, and say so in one line

The public reply's job is to be seen by the next reader, not to resolve the dispute. One sentence offering a direct line does both.

4. Log the reply and the approval

If a complaint ever reaches the IPC or a Quebec order, the question will be whether you took reasonable steps. A dated log of who drafted, who approved and what was published is what a reasonable step looks like.

Templates you can copy

When the reviewer describes a treatment and an outcome:

Thank you for taking the time to write. We are not able to discuss anyone's visit in a public forum, including whether someone has been to us, so I will not comment on the details here. What I can tell you is that concerns about a service are reviewed by our clinical lead within two business days. Please call us at [number] and ask for [name]. We will take it from there.

When the reviewer is angry about cost or scheduling, with no clinical detail:

You are right that our pricing should be clear before anyone books, and I am sorry it was not this time. Our current policy is that every quote is confirmed in writing before a first appointment. If that did not happen for you, I would like to know where it broke down. [name] at [number] or [email].

When the review appears to be about a different business, or you have no record:

We take every review seriously, and we are not able to confirm or deny whether anyone has been a client here. If you believe this concerns our clinic, please call [number] and we will look into it properly.

Notice what none of them do. None confirms the person was a client. None names a treatment. None corrects a factual claim about a visit.

What you should never do

• Confirm that the reviewer was a client. In Quebec this alone may breach article 20, paragraph 2. It is the single most common mistake in this industry.
• Correct the record in public. "You actually came in for a consultation on the 14th and signed the consent form" is a disclosure of personal health information, and it is worse because it is accurate.
• Let an agency publish clinical replies without a named approver. The obligation to take reasonable steps with collaborators sits with the practitioner, and it does not transfer with an invoice.
• Use a tool that auto publishes replies. Speed is not the constraint here. Review is.
• Ignore the review entirely. In our September 2026 read of these listings, the median owner response rate was 8.5 percent, and a third of establishments had never replied to anything. Silence is not a privacy strategy, it is an absence of one.

When to hand this off

If your clinic has a backlog of unanswered negative reviews and no written rule about who may write replies, that is a two part job: clear the backlog safely, then put a standing process behind it. We do exactly that for dental and medical aesthetics clinics in Ontario and Quebec, in English and in French, with every reply approved before it is published. You can read how the service works on our Google review response page.

Before any of that, we will read your listing and send you a one page summary of what your reviewers actually say, the complaints that recur and the things they praise, in their own words. It is free and it is yours whether we work together or not.

Questions we get

Is a med spa a health information custodian under PHIPA? Usually not, as a business entity. But the regulated practitioners working inside it are custodians in their own right, and their obligations apply to everything said about their clients, including online.

Can I reply if the reviewer already said publicly that they were a client? The reviewer waived nothing on your behalf. Their disclosure is theirs. Your confirmation is a separate act by a different party, and in Quebec it is the act article 20 names.

What if the review is defamatory? That is a legal question, not a privacy one, and the two run on different tracks. Answer publicly in the neutral way described above, then take the defamation question to counsel. Do not use the reply to argue the facts.

Does PIPEDA apply instead if we are not a custodian? For a commercial business handling personal information in the course of commercial activity, federal privacy law is the backstop. The practical answer does not change: do not publish information about an identifiable client without their express consent.

How fast should we reply? Within a few business days is enough. Nothing in any of these rules rewards speed, and every mistake in this article is a speed mistake.

---

Darly Robert Cham, CCRP, CCRC, CCRA. Multi role clinical research background spanning Clinical Research Coordinator, Clinical Data Manager and clinical research operations at Hôpital Maisonneuve-Rosemont. Founder of IntelliAIScale, Mississauga, Ontario.

Sources, all read on September 22, 2026: Information and Privacy Commissioner of Ontario, Frequently Asked Questions: Personal Health Information Protection Act, sections on what a custodian is, health care practitioners working for non custodians, offences and penalties. Code de déontologie des médecins du Québec, M-9, r. 17, article 20, paragraphs 2 and 3, legisquebec.gouv.qc.ca. IntelliAIScale internal measurement, 38 dental and medical aesthetics listings in Ontario and Quebec, 3,044 reviews read, September 2026.