Buying a healthtech software company in Canada

A demo and a revenue summary do not say whether a healthtech software company can be owned by a new party. A product that works well for clinics today can still be a poor purchase if its integrations stop at closing, if the data it holds cannot be used the way the buyer plans, or if the buyer cannot meet rules that apply to its own situation. This page is about judging the opportunity: what a sound one looks like, what a seller may not mention, and what a buyer has to qualify for personally. Checking the documents comes later, once you are under a letter of intent, and is covered in the due diligence guide.

What a sound one looks like

Signs of a sound target include retention that holds across customer types, not just in aggregate. Small clinics and large institutions can differ in why and when they leave, so ask for retention figures for the two groups separately. Its integration is documented rather than carried in one developer’s memory. Its contracts allow assignment, or at least show a track record of consents being granted. Its marketing claims match what its systems do, and it can show a written view on whether any feature is a regulated medical device function. None of this guarantees a good result, but the absence of several of these points together is a reason to slow down and ask why.

What a weak one looks like

These patterns can signal a weaker target, and each deserves a direct question.

• Heavy dependence on one EMR vendor’s goodwill, with the integration agreement short, informal or silent on a change of owner.
• A feature list that has grown by customer request, with no one able to say when a function began to inform clinical decisions.
• Revenue concentrated in a few institutions, so that BDC’s warning about customer concentration risk applies in full.
• Privacy statements that describe practices the technical team cannot describe back.
• Custom work built for a single large customer that the rest of the product has quietly come to depend on.

What the seller may not volunteer

A seller may not think to raise these points. Ask whether any customer has raised a privacy or safety concern, whether any security event has happened, even a minor one, and where the data is hosted. Ask whether the company uses customer data for anything beyond delivering the service, such as analytics or model training. That question matters because PIPEDA’s principles limit the use of personal information, and Quebec’s privacy regulator says an organization needs express consent before using sensitive personal information for a purpose different from the one it was collected for. The regulator gives medical information as an example of sensitive information. A buyer whose plan depends on reusing data should treat the answer as a finding about what it is buying, not a detail to fix later.

What you must qualify for yourself

Some conditions attach to the buyer rather than the company. A foreign buyer should know that the Investment Canada Act allows the government to review foreign investments of any size on national security grounds, and that ISED describes the Act’s aim as including safeguarding Canada from foreign actors seeking ownership or control of sensitive Canadian goods, technology, infrastructure or personal data for purposes that could be injurious to Canada’s national security. Whether a particular target engages that concern is a question for counsel. A larger strategic buyer may also face the Competition Act’s requirement that the parties to a notifiable merger notify the Competition Bureau before closing; the Bureau says whether a transaction is notifiable depends on financial thresholds for the size of the parties and of the transaction, with other criteria and exceptions set out in the Act. Your own plans are limited by the deal too. To rely on PIPEDA’s exception for completed transactions, the parties must have agreed to use and disclose the information solely for the purposes for which it was collected, permitted to be used or disclosed before the transaction was completed, so a plan to fold patient-related data into your own products cannot be assumed. And ask whether your team can run the regulatory function, because someone must own the device question, the privacy programme and the relationship with each EMR vendor.

Where Ontario and Quebec change the picture

A healthtech buyer can inherit more than one legal regime. PIPEDA applies to personal information that an organization collects, uses or discloses in the course of commercial activities (among other cases, and subject to the exclusions in s.4(2)), and the Act lets the federal government exempt organizations from it for activity within a province where provincial legislation is substantially similar. In Ontario, the Personal Health Information Protection Act puts duties on health information custodians, as the province’s privacy commissioner explains. Quebec’s private-sector law was changed by Law 25, with rules on incident notification, consent and privacy impact assessments. Customers in other provinces may be governed by their own provincial health-information rules, so a company with clients in several provinces needs a clear answer, province by province, to which law governs which data. How the answer feeds into price is covered in what such a company is worth.