Guide / Tracking

Track every conversion. Leak no health data.

The FTC actions against GoodRx and BetterHelp came down to one thing: health information flowing to ad platforms through tracking code.

This is the setup we use so campaigns optimize on real purchases while nothing about a patient's condition leaves your systems.

The rules in plain terms

HIPAA applies to covered entities and their business associates. Many cash-pay telehealth brands are pulled into it through their clinical partners. Even where HIPAA does not apply, the FTC Health Breach Notification Rule and the FTC Act cover health apps and websites that share health data, and state laws such as Washington's My Health My Data Act add their own consent requirements. The practical answer is the same in every case: do not send anything that reveals a condition, treatment, or medication to an ad platform.

This is how we build tracking. It is not legal advice, and your counsel should sign off on the final setup.

The setup, step by step

No browser pixels on intake, checkout, or condition pages. Pixels collect URLs, page titles, and form interactions automatically. That is where most leaks happen.
Server-side events. Conversions go from your server to the Meta Conversions API and Google enhanced conversions, never from the patient's browser.
A BAA-covered middle layer. A healthcare tracking tool such as Freshpaint, or a server-side tagging setup you control, receives events, strips anything sensitive, and forwards only what is safe.
Generic event names and neutral URLs. "Purchase" and "Lead," never "GLP-1 purchase." Use /start rather than /weight-loss-intake on any page that sends data anywhere.
Minimal identifiers. Hashed contact details only where your counsel approves them for matching. Never intake answers, conditions, or medications.
Stripe as the source of truth. Ad platform numbers are modeled estimates. Stripe tells you who paid, who refilled, and who churned.

What each event can carry

Event	Send to ad platforms?	How
Landing page view	Yes	Server-side, generic page name
Intake started	Yes	As a generic "Lead," with no answers attached
Intake answers	Never	Stay in BAA-covered systems only
First order	Yes	As "Purchase," value only, no product or medication name
Refill or renewal	Yes, optionally	As a generic subscription event for value-based bidding
Condition, medication, dosage	Never	Never leaves clinical and CRM systems

What to expect from ad platforms

Meta has restricted some health and wellness advertisers from sending or optimizing on certain lower-funnel events. Expect thinner in-platform reporting than a typical ecommerce brand. Server-side events and strong first-party reporting close most of that gap, though not all of it.

Attribution that does not depend on pixels

UTM parameters saved to the patient record at signup.
A "how did you hear about us" question after purchase, which catches podcasts, TikTok, and word of mouth that platforms miss.
Cohort reports by month and channel: acquisition cost against refill revenue at 30, 60, and 90 days.

Tracking has to be designed before launch. Retrofitting it after pixels have fired on intake pages for months is how brands end up with a problem. If you are launching soon, the telehealth marketing page covers how tracking fits into the full build.

Free first step

Want your real number instead of an estimate?

We request an appointment the way a new patient would: your form, your phone line, your hours. Then we time every step and send a short written report in two business days. Reply speed, booking friction, and where inquiries go quiet. Free, no obligation.

Prefer to talk it through? Book a 30-minute call.

Common questions

Straight answers

Is the Meta Pixel HIPAA compliant?

Meta does not sign business associate agreements, so the pixel should never receive protected health information. Keep it off intake, checkout, and condition pages, and send conversions server-side through a layer that strips sensitive data.

What is server-side tracking?

Instead of code in the patient's browser reporting to ad platforms, your server sends a controlled event, such as a purchase, through the platform's API. You decide exactly what fields leave your systems.

Can I use Google Analytics on a telehealth site?

Google does not offer a BAA for Google Analytics and says it should not be used with protected health information. Many healthcare brands use a HIPAA-oriented analytics tool or keep GA4 strictly off sensitive pages.

Does this apply to cash-pay telehealth?

Yes. Cash-pay brands are often covered through their clinical partners, and even where HIPAA does not apply, FTC rules and state health privacy laws do.

What is Freshpaint?

A tracking platform built for healthcare that signs a BAA and controls which data reaches ad and analytics tools. It is one common way to implement the middle layer described here.

Go deeper: telehealth marketing, the healthcare marketing stack, the healthcare advertising compliance checklist, telehealth lifecycle email and SMS.

Tool guides

Setup guides for each layer: Customer.io for Healthcare, Braze vs Customer.io, Klaviyo Alternatives for Healthcare, Twilio for HIPAA SMS, Meta Conversions API for Healthcare, Using Claude for Healthcare Marketing.