Selling a healthtech software company in Canada

An owner who has decided to sell a healthtech software company may be asked first for a data room, but the data behind this product concerns patients and the clinics that look after them, so the order in which things are shown matters as much as what is shown. A sale also depends on people outside the company, such as customers who must consent to a transfer and an EMR vendor whose certification the product relies on. This page sets out a sequence for preparing the sale.

Assemble three files before you list

The first file is a consent map: every customer, integration and supplier agreement, with a note of whether it can be assigned freely, needs consent, or ends on a change of control (the assignment clause is where to look). The second is a written regulatory position on the product. It records why the company believes its features are or are not medical device functions and what correspondence, if any, it has had with Health Canada. The third is a privacy evidence pack: the privacy policy, a description of where data flows and is hosted, the agreements with clinics about who holds and protects records, and the company’s records of past security incidents. Organizations covered by PIPEDA must keep a record of every breach of security safeguards involving personal information under their control, and the Office of the Privacy Commissioner of Canada (OPC) says it can ask to see those records, so they should already exist and be complete.

What a buyer may see, and when

Patient-related information is the hard part. PIPEDA lets the parties to a prospective business transaction use and disclose personal information without the individual’s knowledge or consent if they have entered into an agreement requiring the recipient to use and disclose it solely for purposes related to the transaction, protect it with safeguards appropriate to its sensitivity, and return or destroy it within a reasonable time if the deal does not proceed, and the information is necessary to decide whether to proceed and, if the parties do, to complete the deal. The Act adds that this exception does not apply to a transaction whose primary purpose or result is the purchase, sale or other acquisition or disposition, or lease, of personal information. Its schedule gives medical records as an example of information almost always considered sensitive. Quebec has a rule of its own: since September 2022 a business may, under conditions, communicate personal information without consent where that is necessary to conclude a commercial transaction. A practical approach is to run early rounds on aggregate information and hold anything closer to patient level until terms are signed and you have advice on which statute governs.

Whether the company controls that information or holds it on behalf of clinic customers changes who may disclose it. PIPEDA’s accountability principle keeps an organization responsible for information it has transferred to a third party for processing, so the customer agreements are the first place to look before anything goes into a data room.

Share sale or asset sale changes the data question

Structure decides what has to be done about customer data. An Ontario law-firm answer on tech company sales explains that in a share sale the corporation holding the data does not change, so existing privacy obligations and commitments generally continue as they are. In an asset sale, moving a customer database is itself a use of personal information that has to fit what customers were told when they provided it, and buyers sometimes need to give fresh notice, or in some cases seek consent, depending on how the original privacy policy was worded and what the buyer intends to do with the data. That guidance is written for Ontario businesses, so counsel should confirm what applies to your company.

Telling customers and the EMR vendor

BDC warns that, depending on a listing site’s confidentiality procedures, word could get out to employees, customers or suppliers. Decide in advance who tells whom and when. Customers whose contracts need consent should hear it from you, with a plan, rather than from a buyer. The EMR vendor needs the same treatment if the integration depends on its certification, because its process is not yours to schedule. Clinics also have a reason to care beyond the contract. Ontario’s privacy commissioner stresses that a custodian’s duties to take reasonable steps to protect records and to ensure individuals can exercise their access and correction rights do not end until a legally authorized successor has custody and control. That guidance concerns a custodian’s practice changing, not a software vendor, but it shows what a clinic will ask when its vendor changes: who holds the records, who answers patient requests, and which agreement binds them.

What can delay a close

Several problems can cause late surprises.

• Consent requests that sit with a health authority or hospital, whose approval timetable the seller does not control.
• An EMR certification or integration agreement that turns out not to move to the buyer, discovered late.
• A product feature the buyer’s advisors think may be a regulated medical device function, with no written position from the company.
• Differences between the privacy claims in sales material and what the systems actually do.
• Incident records that are incomplete, or an old security event the owner had not mentioned.

After signing

Closing is not the end of the data work. Where the Act’s exception for completed transactions is relied on, it depends on conditions that include an agreement requiring each party to use and disclose the information solely for the purposes for which it was collected, permitted to be used or disclosed before the transaction was completed, and one of them notifying the individuals, within a reasonable time after completion, that the transaction has been completed and their information was disclosed. BDC also suggests a transition plan to retain employees, customers and suppliers and to explain the change to them. In healthtech, the handover should include the regulatory file and the consent map, because the buyer may otherwise have to rebuild them. The due diligence guide shows what a buyer will test.