For small health and wellness practices
Your clients trust you with their most private information. Could you prove it's safe?
You have probably never checked. The shared password on the front-desk laptop. The contractor who left last spring and can still log in to your booking system. The intake form sitting in your inbox as a plain email attachment. You would not know until a client, an insurer, or a lawyer asks, and by then you are answering from memory and hoping.
15 minutes on video. We'll tell you straight whether it's worth it for you.
12 questions, about 3 minutes, no sign-up.
The Practice Privacy Checkup finds those gaps, then we fix the worst three with you. You get a scored report and a plan inside a week. We never log in and you never give us a password. We find 3 or it's free.
- A scored report and a 30/60/90-day plan you'll actually read
- A Fix-It Session where we close your top 3 gaps together
- We find 3 or it's free
The worst time to check is after someone asks.
Most small practices have never actually checked. There's been no reason to. Then there is. A client asks who can see their file. A form goes to the wrong person. A lawyer or an insurer asks what you've got in place. And you're answering from memory.
It's almost never a hacker. It's the shared login on the front-desk computer. The intake form sent as an email attachment. The contractor who left last spring and can still get into your booking system. The backup nobody's tested. Any one of those can come back to bite you.
What applies to you depends on your province and your profession:
Regulated by a college. If your profession has a college, it has rules about client records and privacy. Which professions have one depends on your province.
An association, or no regulator at all. Plenty of practitioners don't have a college. Depending on where you are, that can be counsellors, massage therapists, naturopaths or acupuncturists. Some have an association with its own standards. Either way, privacy law still applies to you.
Every private practice. If you run a private practice in Canada, a privacy law covers the client information you keep. Which one depends on your province, and sometimes your profession. They all expect reasonable safeguards, and health information sets the bar higher. None of them hands you a checklist. It's on you.
Whatever rules you're under, the question's the same. If someone asked today, could you show them how you protect client information? The Checkup gives you that answer, on paper.
Find out where you stand in 15 minutes.
Free, on video. We'll tell you straight whether the Checkup is worth it for you.
The 15-minute call. Free. No sales pitch.
Fifteen minutes on video. If you've done the security check, we go through your score. If not, we ask how your practice runs. Then we tell you whether the Checkup's worth it. If it isn't, we'll say so.
No follow-up emails trying to talk you into it.
Four steps. You never hand us your passwords.
A free 15-minute call.
Tell us how things run: where you keep notes and bookings, how forms and invoices go out, who else works with you. We'll tell you if the Checkup's a fit.
You show us, we look.
You share your screen and walk us through your setup. We also check what anyone can see from outside, like whether someone could send email pretending to be you. We never log in, never ask for passwords, and never change a thing.
Your report in 7 days.
A scored report, a 30/60/90-day plan, and a call where we go through every finding with you.
We close your top 3 gaps together.
An hour on screen-share. You click, we tell you where. Then it's your call what happens next.
Everything in your Practice Privacy Checkup.
One price. Here's what's in it, and what each piece would cost on its own.
The Practice Privacy Assessment
We review 12 areas of your practice. You get a score, a 30/60/90-day plan, and a call to go through it.
$1,500 value
Fix-It Session
An hour on screen-share where we close your top 3 gaps with you.
$300 value
Breach Plan, written for your practice
One page: who to call, what to do, and which reporting rules to check where you practise.
$250 value
Insurer Questions Prep
When your insurer asks security questions, you'll know the real answers.
$250 value
Privacy policy and consent review
We make sure your privacy policy mentions the tools you actually use and where the data lives.
$200 value
Staff and contractor checklist
What to set up when someone joins, and what to shut off when they leave.
$100 value
90 days of “ask me anything” email support
Something changes, you email us, we answer.
$300 value
First month of the Practice Privacy Care Plan, free
We keep an eye on the basics for the month after your Checkup.
$199 value
Total value: $3,099
Value is what each piece costs on its own. Solo practice shown. Group and clinic Checkups include the same pieces, scaled to everyone on your team. Advisory review, not legal advice, not a certification.
Your price, solo practice:
$850
Not bad, for peace of mind.
Solo. One practitioner, working alone or with an admin.
$850
Group. 2 to 10 practitioners. More people, more logins, more to check.
$1,650
Clinic. 11 to 20 people, more than one location, or a lot of vendors. We'll quote it before we start.
From $2,500, quoted first
Prices in Canadian dollars. Help closing gaps beyond your Fix-It Session is scoped to what you choose.
Keep it going after month one? Practice Privacy Care Plan, from $199 a month, first month included.
Our guarantee
We find 3 or it's free.
If we don't find at least three real things worth fixing in your practice, you don't pay. You keep the report either way.
Worst case, you find out you're in good shape.
Book your free 15-minute call.
15 minutes on video. We'll tell you straight whether it's worth it.
This is for you if
- You run a small private practice, solo up to about 20 people. Counsellor, psychologist, social worker, physio, chiro, massage therapist, acupuncturist, naturopath, dietitian, OT, SLP, or something close.
- Your records live in Jane, Owl, Cliniko or a mix of tools, and you handle intake, notes and billing yourself or with a small team.
- You know client privacy is on you, and you'd like to actually know if you're covered.
- You want a straight answer, not a pile of jargon.
This is not for you if
- You're a hospital, health authority or big clinic with your own IT and privacy people.
- You want someone to hack your systems to prove a point. We look and advise. We don't attack anything.
Who is doing this.
Yellowbird is a small company working with practices across Canada. We already look after websites, hosting and email for small businesses, so how a small practice handles its information is familiar ground.
We do every Checkup ourselves. Nothing gets handed off. Our checklist follows the CyberSecure Canada baseline controls, and every finding comes with what to do about it.
This is advice, not a product. We tell you where you stand and what to fix, in writing. We don't sell software and we don't try to scare you. Keeping client information private is already your job. We just make it easier.
We sign a confidentiality agreement before we start. What you show us stays with us.
Questions people ask.
I use Jane or Cliniko. Isn't that enough?
They're solid, and they handle their side: hosting and secure storage. What they can't control is how your practice uses them. Who still has access, whether two-step login is on for everyone, whether forms get emailed around outside the system. That's the gap the Checkup looks at, and the Fix-It Session closes the worst three.
I don't have time.
It's about three hours of your time over two weeks. There's no 40-item homework list. You show us your setup, and in the Fix-It Session we sit with you while you make the changes. We do the write-up.
What if you find something bad?
Then you hear it from us, privately, before anyone else does. The report goes to you and nobody else. Most of what we find is ordinary stuff: a shared login, two-step login turned off, a backup nobody's tested. We rank it and fix the top three with you. We're not lawyers, and if something needs one, we'll tell you.
Is $850 worth it for a solo practice?
It's roughly five or six sessions, once. You get the report and plan, a session where we fix your top three gaps, a breach plan, help with your insurer's questions, a privacy policy review, a staff checklist, 90 days of email support and your first month of the Care Plan. Bought separately, that's $3,099. And if we don't find three things worth fixing, you don't pay.
What happens on the 15-minute call?
Fifteen minutes on video. If you took the security check, we go through your score. If not, we ask how your practice runs. Then we tell you straight whether the Checkup's worth it for you. If it isn't, we'll say so. Nobody follows up to pressure you.
Is this a certification?
No. We don't hand out badges. There's no Canadian program that certifies a practice as privacy compliant, so a badge wouldn't mean anything. This is an advisory review. We check your practice against reasonable safeguards, using the CyberSecure Canada baseline controls as our checklist.
What qualifies you to do this?
We hold the Google Cybersecurity Professional Certificate, and Yellowbird already runs websites, hosting, email and file storage for small businesses, so this is familiar ground. Our checklist follows the CyberSecure Canada baseline controls. We're not lawyers, and when something needs one, we'll say so.
Do you log into my systems?
No. You never give us passwords or logins. We work from what you show us on screen-share, plus what anyone can see from outside. In the Fix-It Session you make the changes. We just tell you where to click.
Does the law actually require this?
Canadian privacy law says you have to protect the client information you hold with reasonable safeguards, and health information counts as sensitive, so the bar's higher. Which law applies depends on your province and sometimes your profession. None of them tells you to buy anything or get certified. They just expect your safeguards to be reasonable. If you have a college, it may have its own record-keeping rules too. The Checkup shows you where you stand. It's advice, not legal advice, and not a certificate.
Will anyone else see my report?
No. It's yours. We don't share it with anyone, including your college or association.
How long does it take?
You get your report 7 days after the review, and your top three fixes are usually done inside two weeks. The call is 15 minutes, and all in, it's about three hours of your time.
Is my information safe with you?
Yes. We sign a confidentiality agreement before we start, we never take logins, and we only see what you choose to show us. We don't keep anything beyond what we need for your report.
Do I have to buy anything after?
No. The report and plan are yours to use however you want. Your first month of the Care Plan is included. After that it's from $199 a month if you want to keep it. If you want more help with fixes, just ask. No pressure.
What will you tell me to change?
Depends what we find. The first fixes are usually cheap and quick: turning on two-step login, cleaning up who has access, changing how forms and invoices get sent, and making sure your backup actually works.
My profession isn't on your list, or I don't have a college. Is this for me?
Probably. The list is just examples. If you run a small practice and keep client information, the same questions apply: who can log in, how information moves, where it's stored, and what you'd do if something went wrong. No college doesn't mean no privacy law, and your clients trust you either way.
Do you work outside my province?
Yes, anywhere in Canada, over video. The security side is the same everywhere: logins, two-step, encrypted devices, backups that restore, where your tools keep data. What changes by province is which privacy law and professional rules apply. We're not lawyers, so for legal advice on your situation you'd still ask one.
Find out where your practice stands, before you have to.
Book a free 15-minute call. We'll look at your practice and tell you whether the Checkup is worth it. If it is, you'll have your report in 7 days and your top 3 gaps closed within two weeks. If it isn't, you've lost 15 minutes.
Not sure yet? Take the 3-minute check first. No sign-up.
Prefer to write instead? Send a request.
Yellowbird
Questions? brett@yellowbirdcompany.com