PIPEDA as a commercial baseline
When personal information is collected, used or disclosed in the course of commercial activity, PIPEDA expects purpose limitation, meaningful consent where required, and safeguards proportionate to sensitivity. Health information sits at the high end of that scale.