Three steps, and the whole thing takes an evening:

1. Buy a domain — your name, or your practice name if you have one.

2. Put a mailbox on it with a business email provider. Not a forwarding address that sends to your personal inbox and replies from it; an actual mailbox you sign into separately.

3. Use it for everything work-related from the first day — directory profile, consent forms, receipts, software accounts, referral sources, your regulator.

The reason to own the domain rather than take a free address is not professionalism. It is control. An address on a domain you own can move to a different provider without anyone having to be told, which means the address on five years of documents never has to change. An address ending in someone else's domain cannot.

The reason to have a separate mailbox rather than a folder in your personal inbox is the same reason you keep a separate phone number: you can close it at the end of the day, and someone else could be given access to it if you were unwell.

What should the address actually be?

Something a stranger can hear over the phone and type correctly.

Your name, or hello@ or contact@ at your practice domain. Avoid anything cute, anything with a hyphen you will have to spell out, and anything that names a modality or a population — those change, and the address will outlive them.

Set up one address, not five. A solo practice does not need separate inboxes for billing and intake, and every extra address is another place a message can sit unread for a week.

Is email safe enough for client information?

Here is where the honest answer has to be careful.

Ordinary email is not a private channel by default — messages pass through several systems on the way and are stored on machines you do not control. Practitioners setting up in Canada tell each other to make sure the email is compliant, and the advice is well-meant, but "compliant" is not a status an email provider can hand you. What a provider can offer is specific things: where the data is stored, who can access it, whether messages can be encrypted in transit and at rest, and whether they will sign a written agreement about how they handle information on your behalf.

Ask for those specifics. Then decide what you are willing to put in an email — which is a clinical and professional judgement, not a vendor one.

What the Colleges publish is narrower than "use a compliant provider", and more useful. Ontario's psychotherapy College asks registrants to avoid "the use of non-secure methods of communication, such as email, when transmitting confidential information, unless the client consents to the risk and there is no practical alternative" (CRPO Professional Practice Standards). Read that carve-out closely. It is consent and no practical alternative, not either one on its own.

Ontario's privacy regulator asks for two artefacts. A written policy — custodians "should develop and implement a written policy for sending and receiving personal health information by email", one that "should address when, how and the purposes for which this information may be sent and received by email, as well as any conditions or restrictions on doing so". And a consent that is specific rather than a tick-box: it "should be in plain language and indicate the types of information that may or may not be communicated by unencrypted email, the risks of using unencrypted email and the circumstances where the custodian will use unencrypted email" (IPC, Communicating Personal Health Information by Email).

Outside Ontario the counselling therapy standards ask for the same artefact in plainer words — a "written policy with respect to electronic communication with clients", shared with the client as part of informed consent, and stating at minimum "in what instances these communications will be used (e.g., scheduling versus therapy)", the technologies used, the privacy risks, and "anticipated response times" (CCPA Standards of Practice).

And Nova Scotia's psychology regulator says the quiet part about the technology itself: "Typically, regular email accounts are often not encrypted unless specifically setup with encryption settings" (Nova Scotia Regulator of Psychology, Use of Technology by Psychologists).

Notice what none of them do: name a provider, or bless a product. The obligation runs to you — a written policy, a specific consent, and a judgement about what goes in an email. Which is why the practical position most practitioners land on is that email carries scheduling, logistics and forms, clinical content goes somewhere else, and the consent form says so in as many words.

What goes wrong with email that nobody warns you about?

Your replies land in spam. A brand-new domain has no sending history, and messages from it are treated with suspicion — especially by the corporate mail systems a lot of Canadians use at work. When you set up the mailbox, have your provider walk you through the sending-authentication records for your domain. It is a twenty-minute job that prevents a category of invisible failure where you reply to every inquiry and hear nothing back.

Directory notifications arrive empty or not at all. If your inquiries come through a directory, check occasionally that its notifications are still reaching you. Therapists describe inquiries piling up unnoticed, and the cause is not always the therapist.

You reply from the wrong address. If you forward work mail into a personal inbox, you will eventually reply from the personal one. That is how the personal address ends up on a client's phone.

It becomes the thing you check at 11pm. The same boundary problem as the phone, with fewer people talking about it. Decide when you read work email, say so in your signature, and let the signature do the work of holding the line.

Do I need encrypted email?

Depends what you are sending, and it is worth separating two things people merge.

Encryption in transit — the ordinary protection between mail servers — is standard with any reputable provider and is not something you buy separately. Secure delivery, where the recipient reads the message through a portal or with a password, is a product, and it has the same weakness as portal messaging generally: it works only when the recipient will do the extra step.

Buy the second one when you genuinely need to send documents, not because a marketing page made ordinary email sound reckless.

What should be in the signature?

Four things, and they save you more time than anything else on this page:

• Your name, credential and registration number if your regulator expects it

• Your practice phone number

• When you read email and how quickly you reply

• What to do in an emergency, in one sentence, naming the local service

Those last two are the email equivalent of a voicemail greeting, and they do the same job: they let you be unavailable without leaving anyone in silence.

The short version

Own the domain, run a real mailbox on it, use it for everything from day one, and get the sending records set up so your replies actually arrive. Say in your signature when you read it and what to do if it is urgent. And decide deliberately what you will and won't put in an email — before a client asks you something clinical in one.

About Rivet

Rivet is a Canadian practice line built for therapists — a separate number for calls, texts and voicemail, with video sessions and clinical tools in the same place. Your data stays in Canada, and transcription runs on Rivet's own hardware rather than a third-party AI service.

One plan, $65 CAD a month, everything included. Fourteen-day trial, no card.

See what's included · Start the trial