iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
There is no Canada-wide list of messaging apps approved for therapist–client communication. The appropriate channel depends on your province, professional regulator, practice or employer, the sensitivity and purpose of each message, and how the service is configured and governed. A familiar app name or an encryption claim is not enough.
For many practices, the practical starting point is an organization-approved client portal or secure messaging service, with secure email or a videoconferencing platform’s messaging feature considered only after its controls, data practices, records workflow and consent process have been assessed. This guide shows how to make that decision without treating any category as automatically compliant.
Why a consumer messaging app is not automatically suitable
Therapy messages can contain personal health information (PHI), appointment details, risk information and other sensitive context. Whether a channel is appropriate is an operational and professional decision, not a popularity contest between apps.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →The Information and Privacy Commissioner of Ontario (IPC), in its 2021 Privacy and Security Considerations for Virtual Health Care Visits, states: “Custodians should avoid using communication services where configuration, use or governance of those services would undermine the custodian’s duty to safeguard personal health information.” That warning applies to the service as actually configured: account permissions, device security, privacy settings, access logs, retention and the provider’s data practices all matter.
#1 Best Overall
- Unmatched Security: The MC02 isn't just a smartphone; it's your digital guardian. Unlike other smartphones that sell your data, ours protects your privacy. Enjoy an intentional mobile experience where your personal information stays yours—never tracked, sold, or compromised
- Your Digital Sanctuary: An ecosystem of secure communications, access essentials such as Email, Calendar, Contacts, Notes and Storage without advertising-based data infiltration. The built-in VPN allows you to protect your connectivity and privacy, even on public networks
- Intuitive Design: Experience the MC02's seamless blend of sleek design and user-friendly interface, complemented by an IPS display. Capture stunning moments with 64MP/24MP cameras, shoot in 4K video, all while enjoying ample storage with 128GB memory and a long-lasting battery
- Privacy at Your Fingertips: Regain control and true consent of your digital and mobile use, with real-time insights from the groundbreaking Data & Carbon Ledger. Empower yourself with real-time data to view the safety risk and environmental imprint of individual apps
- Apostrophy OS: The MC02 includes a 12-month Apostrophy Services subscription, designed to protect your digital sovereignty beyond a standard OS. Threema comes pre-installed—a Swiss messenger known for rigorous data protection—so you can communicate with added peace of mind from a smartphone that values your privacy as much as you do.
Ontario’s guidance is for health-information custodians under Ontario’s PHIPA. It is not a national therapist-app approval list. Outside Ontario, check the privacy law, regulator guidance and organizational policy that apply to your practice. The College of Physicians and Surgeons of Ontario (CPSO) rules discussed below apply to physicians, not automatically to counsellors, psychotherapists, social workers or other therapists.
The legal and professional checks to make first
Federal consent and reasonable-purpose principles
Under PIPEDA section 5(3), an organization may collect, use or disclose personal information only for purposes a reasonable person would consider appropriate in the circumstances. Section 6.1 requires consent to be meaningful: the individual must understand the nature, purpose and consequences of the information handling.
The Office of the Privacy Commissioner of Canada (OPC) describes consent as dependent on sensitivity and reasonable expectations. Consent does not replace safeguards, accountability or an appropriate purpose. Provincial privacy laws and profession-specific rules may impose additional requirements, so a PIPEDA analysis alone is not sufficient for every Canadian practice.
Recommended Free Tools
Ontario virtual-care guidance
For Ontario custodians, the IPC recommends organization-approved email, messaging and videoconferencing systems, with safeguards such as encryption, strong passwords, privacy-protective settings, audit logs, identity verification and access controls. It also advises documenting communications in the patient record and securely deleting unneeded copies.
The IPC says providers should explain limitations and risks in plain language. Its guidance identifies possible privacy breaches from physical or electronic eavesdropping, hacking and software exploits, technical failures and configuration errors. Patients should understand how virtual technology will handle their information, and the discussion and consent should be documented.
Physician-specific CPSO obligations
CPSO’s Protecting Personal Health Information policy says: “Physicians must use encrypted e-communication when communicating PHI to patients, where possible.” If an Ontario physician uses unencrypted communication, the policy calls for considering whether it is reasonable in context, obtaining and documenting express consent, and explaining how the communication will be used and processed, what information will be sent, and its limitations and risks.
Do not present that express-consent rule as a universal requirement for every Canadian therapist. A non-physician practitioner should locate the applicable regulator’s current policy and obtain advice from the organization’s privacy lead or counsel when the situation is unclear.
Rank #2
- PRIVACY-FIRST ENCRYPTION: Engineered for privacy-conscious users, this ring securely stores and exchanges personal information with built-in encryption, ensuring your data remains protected during every mobile interaction.
- TOUCH-TO-LAUNCH CONVENIENCE: The ultra-sensitive built-in NFC chip instantly unlocks apps, shares mobile content, and locks/unlocks your smartphone with a simple touch, streamlining your daily digital workflow.
- BATTERY-FREE & MAINTENANCE-FREE: Operating entirely without electricity, this smart ring never needs charging and is always ready for use, offering uninterrupted, hassle-free performance for power users.
- WATERPROOF DAILY WEAR: Designed for continuous everyday wear, the ring features depth waterproof construction, protecting it from water damage during handwashing, showers, or outdoor activities.
- READY TO USE — SIZE 13: Delivered in a standard Size 13, this ring is optimized for a secure, comfortable fit for daily wear, making it the perfect accessory for instant, tether-free mobile control.
Consent implementation aid from the Mental Health Commission of Canada
The Mental Health Commission of Canada’s 2018 toolkit provides an adaptable consent discussion covering text or instant messaging, email, video conferencing, websites or portals and social media. It encourages practitioners to consider jurisdictional legislation and regulation. It is a practical conversation aid, not current law and not a substitute for local requirements.
What to use instead of WhatsApp or ordinary texting
These are categories to evaluate, not automatic compliance endorsements. The same category can contain services with very different controls, terms and data handling.
| Communication category | Where it can fit | Questions to answer before use |
|---|---|---|
| Organization-vetted secure messaging or client portal | Structured, asynchronous contact, appointment administration, documents and selected clinical follow-up when the practice has approved the service. | Is the account controlled by the practice? Are encryption, role-based access, identity checks, audit logs, retention and deletion available? Can messages be entered into the clinical record? What do the terms permit the provider to collect, use or disclose? |
| Secure email service | Lower-volume correspondence when the service, accounts and devices are managed and the patient understands the risks. | Is encryption enabled in the actual workflow? Are accounts protected by strong passwords and multifactor controls where available? Can staff prevent forwarding or misdirected recipients? How are copies retained, archived and deleted? |
| Videoconferencing platform with secure messaging | Messages connected to scheduled virtual visits, if the platform’s messaging, permissions and records controls have been reviewed. | Does chat persist after the visit? Who can access it? Are logs available? Does the service use information for purposes unrelated to care? Can the practice export and retain the necessary record without keeping unnecessary copies? |
| Ordinary SMS or consumer chat | Only after a documented, context-specific assessment and informed consent where required; limit content and avoid treating convenience as security. | Can the recipient’s identity be verified? What happens on a shared or lost device? How are backups, notifications, screenshots, retention and deletion handled? Is the service’s governance compatible with the practitioner’s duties? |
“End-to-end encrypted” is a technical description, not a complete privacy assessment. You still need to examine account recovery, device exposure, notification previews, backups, administrative access, auditability, retention and the provider’s terms.
A decision framework for selecting a channel
1. Classify the communication
Separate routine logistics from information that could affect care or reveal sensitive health details.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Low-sensitivity logistics: confirming an appointment time, sending a clinic address or asking a client to call the office.
- Moderate-sensitivity administration: forms, invoices, attendance questions or referral coordination.
- High-sensitivity clinical content: symptoms, diagnoses, treatment changes, safety concerns, trauma details or information about another person.
- Urgent or crisis content: messages that require a response within a defined time or emergency intervention.
The more sensitive or consequential the message, the stronger the case for a controlled portal or another service specifically approved for the practice. Do not use asynchronous chat as a substitute for an emergency pathway.
2. Check the service’s safeguards and configuration
- Encryption in transit and, where offered, at rest; confirm what is actually enabled for your plan and workflow.
- Strong, unique passwords and administrative controls; restrict access to the smallest group that needs it.
- Privacy-protective settings, including notification previews and participant visibility.
- Identity verification before disclosing information or adding a participant.
- Audit logs showing access and message activity.
- Device protections such as screen locks, operating-system updates and remote-wipe capability under your organization’s policy.
- Controls for account recovery, staff departures and lost devices.
Document the settings you selected. A service can be well designed yet unsafe if staff share accounts, leave notifications visible or permit unrestricted forwarding.
3. Review governance and data use
Read the service’s privacy terms, security documentation and administrator controls. Determine what registration requires, what information is collected, where it may be processed, who can access it, how long it is retained and whether it is used or disclosed for purposes unrelated to care. The Ontario IPC cautions against services whose configuration, use or governance undermines the duty to safeguard PHI.
Ask the provider how it handles subpoenas or other legal demands, account termination, backups and deletion. If the answers are unclear, escalate the decision rather than assuming that a paid plan solves the problem.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall4. Design the records workflow
Decide who reviews incoming messages, how quickly, and where clinically relevant content is recorded. Define what is copied into the patient record and what is securely deleted when no longer needed. A portal that keeps a complete, searchable record may simplify documentation; a consumer chat that scatters copies across phones and backups may make it harder to control access and retention.
5. Confirm patient fit and alternatives
Some clients share devices, have limited data access, use accessibility tools or cannot safely receive notifications. Offer a reasonable alternative, such as a phone call, in-person contact or another approved channel. Explain that the client may withdraw consent and how to do so. Record the alternative chosen and any communication limits.
How to obtain and document informed consent
Consent should be a conversation the client can understand, not a buried checkbox. Adapt the following sequence to your regulator and organization’s requirements.
- Name the channel and purpose. Say whether you are proposing a portal message, email, video-platform chat or another method, and what it will be used for.
- Describe the information. State whether messages will contain scheduling details only or may include clinical information, documents or follow-up instructions.
- Explain material limitations and risks. In plain language, cover possible eavesdropping, hacking, software exploits, technical failures, configuration errors, lost or shared devices, notification previews and misdirected recipients.
- Explain processing and access. Tell the client who may access messages, how the practice records them, how long copies are retained under policy and whether the service provider processes information.
- Set response expectations. Give office hours, expected response time and a clear statement that the channel is not monitored continuously and is not for emergencies.
- Offer alternatives. Explain how to use another approved channel or request a phone or in-person conversation.
- Confirm understanding and choice. Invite questions, verify the destination address or phone number and obtain the required consent. For physician practices in Ontario, follow CPSO’s express-consent requirements when unencrypted communication is used.
- Document the decision. Record the channel, purpose, information types, risks discussed, alternatives offered, consent date, any restrictions and the withdrawal process.
A concise script might be: “We can use this portal for appointment information and messages you choose to send. Messages may be stored in our practice system and accessed by authorized staff. No electronic service is risk-free; risks include unauthorized access, technical failure and notifications being seen by someone with access to your device. We do not monitor it continuously or use it for emergencies. You may choose phone or in-person contact and can withdraw consent at any time. What questions do you have?”
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Operational rules that prevent common failures
Verify identity every time it matters
Before sharing a report, changing an appointment for a family member or adding a participant, verify the recipient using a process your organization approves. Do not rely solely on a display name, profile photo or saved contact.
Minimize message content
Send only what the stated purpose requires. A scheduling message should not include a diagnosis. If a clinical issue needs a detailed assessment, move the conversation to a suitable visit or documented clinical channel.
Rank #4
- Fits for most devices: Can be used to cover most webcam for laptops, macbook pro, smartphones and tablets. Does not interfere with the webcam usage or indicator lights.
- Durable and extremely thin: Ultra thin design 0.7mm, ensuring the screen can be closed completely and no problem will happen. Can sustain through wear and tear and remain strongly adhesive.
- Easy to install and use: Just clean the surface, tear off the back tape, attach it around camera lens and hold it in place for 10 seconds for better adhesive. It can be opened or closed with one simple finger movement.
- Protect your privacy security: Cover your webcam when not in use and prevent web hackers from spying on your life. Focus on providing security and peace of mind to individuals, families, companies, groups, organizations and governments.
- Note before use: Please put our funny panda webcam cover on the front cameras of tablets, laptops, and mobile phones to get perfect privacy protect experience.
Control devices and notifications
Use individual accounts, screen locks and current software. Turn off lock-screen previews where appropriate, and teach clients how shared devices and cloud backups can expose messages. Establish a process for lost phones, compromised accounts and staff departures.
Set boundaries and triage
Publish the hours during which messages are reviewed, the expected response time and the route for urgent concerns. Staff should know when to stop messaging and call the client or emergency services according to the practice’s clinical policy.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Retain and delete deliberately
Keep the portion needed for the clinical or administrative record under the applicable retention policy. Securely delete transient copies and exports that are no longer needed. Do not promise a client that a message has disappeared if provider backups, screenshots or the recipient’s device may retain it.
Review the arrangement
Reassess the service when its terms, ownership, features or configuration change; when staff roles change; or when a privacy incident occurs. Periodically test account recovery, access removal, audit logs and the process for handling a client’s withdrawal of consent.
Common scenarios and the safer response
| Scenario | Safer approach |
|---|---|
| A client texts, “Can you move tomorrow’s appointment?” | Reply with the minimum scheduling information through the approved channel. Do not add clinical details merely because the client used SMS. |
| A client sends symptoms or medication information in ordinary chat | Acknowledge receipt without conducting a full assessment in the chat. Explain the approved channel and response time, then document clinically relevant content according to policy. |
| A family member asks for information from the client’s account | Verify authorization and identity before disclosing anything. If authorization is unclear, use the practice’s consent and substitute-decision-maker process. |
| A client wants to use a preferred consumer app | Explain the practice’s approved options and the risks and limitations of the requested app. Offer an alternative; do not treat client preference alone as authorization to bypass organizational controls. |
| A client withdraws consent | Stop using the channel, confirm the replacement method, update the record and notify staff who might otherwise continue messaging. |
Questions to ask a provider or practice administrator
- Which features are included in the exact service tier and region we will use?
- Is encryption enabled by default, and can administrators enforce it?
- How are users authenticated and recipients verified?
- Are access logs available, and can unauthorized access be investigated?
- Where are messages, attachments, backups and metadata processed and retained?
- Can the practice export required records and securely delete unnecessary copies?
- What happens when an account is closed, a device is lost or a staff member leaves?
- Does the provider use information for advertising, analytics or other purposes unrelated to care?
- What incident-notification and support processes are available?
- Can the workflow support accessibility needs and a client’s withdrawal of consent?
What “secure” should mean in a procurement decision
Use “secure” as a checklist outcome, not a marketing label. A defensible decision file should identify the purpose, information type, recipients, safeguards, provider terms, retention plan, consent language, alternatives and the person who approved the configuration.
If the practice cannot answer who can access a message, how it will be recorded, what the provider does with the data or how consent can be withdrawn, pause deployment. Convenience is not a substitute for accountability.
Bottom line for Canadian therapists
Choose an approved workflow, not merely an app. A client portal or secure messaging service may be the best fit when it provides controlled accounts, suitable safeguards, auditability and a workable records process. Secure email or videoconferencing chat may fit narrower purposes after the same review. Ordinary texting and consumer chat require a particularly careful, context-specific assessment and should never be assumed appropriate because they are familiar or encrypted.
Before sending the first message, check the law and regulator rules for your province and profession, obtain meaningful consent, explain risks and alternatives, document the decision, set response boundaries and revisit the arrangement when the service or practice changes.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
