A Leaked Valuation Nearly Cost Paulo His Clinic Sale

The situation

The call came in on a Tuesday evening, the kind our office gets when someone has been sitting with a problem for a few days and finally decides they cannot carry it alone. Paulo explained that he was a practicing anesthesiologist who had built a group of three diagnostic imaging clinics across Brampton on the side, starting close to two decades earlier as a way to put his clinical background to use outside the operating room, and that a recent health diagnosis meant he needed to sell within months, not years. He had already retained a business broker, prepared a confidential information memorandum, and signed a letter of intent with a prospective buyer at a price in the mid range of five to eight million dollars. The deal seemed close to done, and Paulo had allowed himself, for the first time in weeks, to think past the closing date.

Paulo was not our client from the start of the sale process. He had used a different lawyer to draft the initial non-disclosure agreement that every prospective buyer signed before receiving financial statements, staffing schedules, and referral source data. That earlier lawyer had since retired, and when the trouble surfaced, Paulo needed someone who could step in immediately, get up to speed on a live deal in motion, and act within days rather than weeks. On that first call, he read us the confidentiality agreement over the phone while we listened, because he did not yet have a lawyer to send it to and wanted to know, right away, whether it was even worth anything.

The prospective buyer was a numbered company controlled by Marek, an operator who ran a competing chain of imaging clinics in the region and had expressed interest in acquiring Paulo's clinics to expand his footprint into Brampton. Marek was also, separately, a commercial landlord who owned several of the buildings his own clinics operated out of, which gave him a sophistication about real estate and business terms that Paulo, whose expertise was medicine rather than transactions, did not share to the same degree. Marek had engaged a consultant named Piotr to assist with due diligence, and Piotr had signed the same confidentiality agreement as a condition of receiving access to Paulo's data room, which contained detailed financials, staff compensation schedules, and referral source relationships built up over years.

Paulo's health made the timeline unforgiving. His physicians had been direct about the treatment schedule ahead, and he had structured the entire sale around closing before a specific date so he could step back from the business and focus on his health without the burden of running three clinics and managing dozens of staff. Every week of delay cost him something he could not get back, which is part of why the call came to us in the first place. He was not looking for a lawyer to fight a war over principle. He was looking for someone who could get his deal across the finish line while he still had the strength to see it through.

The gap nobody had noticed

Ten days before the scheduled closing, over the Civic Holiday long weekend, Paulo received a message from a former staff member who worked at one of his clinics. She had been contacted by a recruiter representing a different competing clinic group, one Paulo had never dealt with and never given access to anything, and the recruiter had cited specific figures from Paulo's internal financials to make the case that the clinic was struggling and staff should look elsewhere before the sale closed. The figures were accurate, down to the decimal. They were also figures that existed nowhere outside the confidential data room Paulo had built for Marek's due diligence, which meant somebody with legitimate access had let them out, deliberately or not.

The timing could not have been worse. Closing was set for the following week, the deal's financing was conditional on staff retention covenants that required a minimum number of technicians and support staff to remain through handover, and now a third party outside the transaction appeared to have Paulo's confidential numbers and was actively using them to unsettle his workforce right before handover. If enough staff left in the days before closing, the buyer's financing bank could treat it as a material adverse change in the business and walk away from funding entirely, which would leave Paulo with a collapsed deal, a diagnosis on the clock, and no obvious path to a replacement buyer on anything like the same timeline.

What had not been noticed, until this moment, was a gap in how the confidentiality agreement had been drafted the year before by Paulo's previous lawyer. It bound the numbered company and named Piotr as a permitted recipient, but it did not clearly restrict onward disclosure to subcontractors or affiliated consultants Piotr might bring in to help with his due diligence work. Piotr, it turned out, had shared portions of the data room with a junior analyst at another firm he sometimes worked with on unrelated engagements, on the assumption that ordinary confidentiality obligations would follow automatically to anyone he brought in. They did not, at least not in a way the original agreement made enforceable against that second firm, which had no signature on anything and no direct relationship with Paulo at all.

Paulo did not know any of this when he called us. He knew only that his numbers were out, his staff were being poached with real information, his holiday weekend had turned into a crisis, and his closing date was ten days away. Figuring out how the leak happened, whether it could be stopped, and whether the deal could still close on anything close to its original terms became the entire focus of the next week, and there was no room in that timeline for a slow, methodical investigation.

What we did

1. Reviewed the confidentiality agreement line by line to identify exactly what obligations it created and against whom, since any response depended on knowing whether we were dealing with a breach we could actually enforce or a gap the original drafting had left open. We found the onward-disclosure gap within the first day, flagged it as the likely source of the leak, and told Paulo plainly that the agreement was weaker than he had assumed.
2. Traced the leaked figures back to their source by comparing the exact numbers the recruiter had used against several versions of financial summaries stored in the data room, since different recipients had received slightly different formatting, rounding, and file naming conventions. The match pointed specifically to the file set shared with Piotr, narrowing the field from several possible leak points down to one identifiable path within about a day of work.
3. Contacted Marek's counsel directly rather than sending a formal demand letter first, because an accusatory letter risked hardening positions and blowing up a deal that both sides, underneath the crisis, still genuinely wanted to close. We laid out what we had found in plain terms and asked for a straight, prompt answer about how Piotr had actually handled the data once he received it.
4. Obtained a written account from Piotr's side confirming that a subcontracted analyst had received data room materials without a signed confidentiality undertaking of his own, which established the source of the leak clearly enough that neither side needed to spend months in litigation trying to prove it through discovery. Getting this in writing, rather than accepting a verbal assurance, gave Paulo something concrete to rely on if the retention covenants were ever challenged later.
5. Negotiated a staff retention response alongside the legal issue, working with Paulo to communicate directly and personally with staff who had been contacted by the outside recruiter, correcting the inaccurate framing of the clinic's financial position before more employees seriously considered leaving over false information. Paulo made these calls himself, since staff trusted his own account more than a lawyer's letter.
6. Rebuilt the confidentiality terms for the remainder of the transaction, adding an express prohibition on any further onward disclosure without our written consent in advance and requiring any new recipient, including subcontractors, to sign the agreement personally before receiving anything further from the data room. This closed the exact gap that had let the leak happen and gave Paulo a document he could actually enforce for whatever remained of the deal.
7. Negotiated a revised closing package that addressed the harm already done, since the leak had happened and could not be undone, only accounted for in the final terms. This meant several rounds of direct discussion about price and timeline adjustments rather than threatening to walk away from a deal Paulo genuinely still needed to complete on schedule, always keeping the health-driven deadline in view.
8. Documented the sequence of events in a detailed closing memorandum in case the staff departures affected the financing conditions later, so Paulo would have a clear, dated record showing the cause was a third-party breach outside his control rather than any underlying weakness in the clinics themselves, which mattered for his own peace of mind as much as for any future dispute.

The outcome

The deal closed, but not on the original terms and not on the original date. Closing slipped by three weeks while the retention issue settled, which meant Paulo carried the clinics, and the stress of running them, longer than his health situation had really allowed for. The purchase price came down by an amount in the low hundreds of thousands to reflect two staff departures that could not be reversed and the cost of a short-term recruiter engagement to backfill one clinic's imaging technician roster before handover took effect.

Marek's side did not admit fault outright, and Piotr's specific personal responsibility was never formally established in a way either side wanted to spend the money litigating. What we secured instead was a negotiated acknowledgment, built directly into the closing documents, that the breach had occurred and that Marek's company bore responsibility for the actions of anyone it had brought into the deal process, whether or not that person had signed the original agreement personally. That acknowledgment mattered less as a moral victory and more as concrete leverage in the price and timeline discussion that followed over the next two weeks.

Paulo did not get the clean, on-schedule exit he had planned around his treatment timeline, and we told him from the start that a fully undamaged outcome was no longer realistic once the leak had already reached his staff. He got a sale that closed close enough to it, at a price he considered fair given what had happened, with staff retained where it counted most for ongoing patient care. He told us afterward that the three weeks of delay were the hardest part, not the money. The clinics changed hands, Marek's company took over operations, and Paulo was able to step back from the business in time to focus fully on his health, just later than he had originally hoped when he first called us.

What you can learn from this