Healthcare & telehealth

Patient growth data your compliance team signs off

Many health websites still run ad pixels installed before anyone checked what they send, which means legal exposure and ad platforms that optimise blind. We rebuild tracking so identifiers stay under your control, then report bookings, visits and retention from your own warehouse. We have built tracking and reporting for Cigna HK, a US pet telehealth subscription and a US wound care physician group.

Book a free discovery call See the work

Free 30 minute call with the engineer who would do the work. You keep the first fix whether or not you hire us.

What we get called in for

The problems teams bring to us

Telehealth and digital health companies, clinics and physician groups, and health insurers that sell or recruit online.

01

Is GA4 HIPAA compliant?

Google will not sign a business associate agreement for Google Analytics, and its own help page says not to tag pages covered by HIPAA. Logged-in portals, intake forms and booking steps are the pages most likely to be covered. Many teams find this out after the tags have been live for years.

What we do

We audit every tag, pixel and URL parameter on the site and map what each one sends. Tracking moves to a server-side container that strips identifiers and health context before anything reaches an ad or analytics platform. Patient-level data goes to a warehouse on a cloud service that offers a BAA.

02

Meta pixel on our appointment pages: are we exposed?

The FTC acted against GoodRx and BetterHelp for sharing health data through tracking pixels, and its Health Breach Notification Rule was extended to health apps in July 2024. Washington's My Health My Data Act has applied since March 2024 and lets consumers sue. A court narrowed the HHS tracking guidance for public pages in 2024, and booking flows and apps that collect patient details remain a risk.

What we do

We scan pages, apps and tag containers for every pixel and SDK, then document what data leaves and to whom. Pixels come off sensitive pages, and conversions are sent from the server with only the fields legal has approved. You get a written data flow map your counsel can review.

03

Meta blocked our purchase and booking events

Since early 2025 Meta has restricted health and wellness advertisers from optimising on lower-funnel events such as purchases and booked appointments, and it strips URL details on restricted sites. Campaigns that ran well now optimise on thin signals. Cost per patient rises and nobody can prove which spend still works.

What we do

We move the source of truth for conversions into your own warehouse, where bookings and first visits are counted from your scheduling system. We rebuild the ad platform signal with the upper-funnel events Meta still allows. Budget decisions then rest on your numbers.

04

Ad spend never ties to booked and attended appointments

Marketing reports form fills while operations reports kept appointments, and the two never meet. No-shows, cancellations and insurance rejections sit in the practice management system where marketing cannot see them. Money keeps going to channels that fill the calendar with patients who never arrive.

What we do

We join click IDs and campaign data to booking and visit status using de-identified keys in the warehouse. Reporting shows cost per attended visit by channel and location. Ad platforms only receive the outcome events you approve.

05

Telehealth subscription churn by cohort and channel

Subscription health brands often know total members and little else. Which channel brings patients who stay past month three is a guess, and refills, pauses and plan changes live in different tools. Acquisition spend gets judged on first orders alone.

What we do

We model members, subscriptions and events in the warehouse from Segment, billing and product data, then build cohort retention by channel, plan and condition group. We did this for a US pet telehealth subscription. Growth and finance then read the same retention numbers.

06

Our GA360 and BigQuery data is there and nobody uses it

Insurers and large providers pay for GA360 and a BigQuery export, then still pull reports by hand. Quote, application and policy steps are spread across web analytics, CRM and underwriting systems. Analysts spend their week reconciling instead of explaining why sales moved.

What we do

We model the export and the CRM into clean journey tables from first visit to issued policy, with tests on every key number. Dashboards and an AI assistant sit on the model so people ask questions in plain English. We have worked on GA4, GA360 and BigQuery for Cigna HK.

Results

Work we have done in this space

Questions

What people ask us first

Can we use Google Analytics on a healthcare website?

Google does not sign a BAA for Google Analytics and says it should only run on pages that are not covered by HIPAA. Many providers keep it on public marketing pages and remove it from portals, intake and booking. Server-side tagging lets you control and strip what it receives. Your legal counsel should confirm the final scope.

Does the 2024 court ruling mean tracking pixels are safe again?

The ruling vacated part of the HHS guidance about public pages that only link an IP address to a health topic. It left the rest of HIPAA in place, and FTC rules and state laws such as Washington's My Health My Data Act still apply. Pixels on logged-in or booking pages remain a real risk.

How do we measure ads when Meta limits health conversion events?

Count bookings and visits in your own warehouse from your scheduling or billing system and judge channels on those numbers. Feed ad platforms the events they still accept, sent from the server with approved fields only. Compare spend and outcomes over time by channel and location.

Where should patient-level analytics data live?

In a warehouse in your own cloud account, on a service that offers a BAA, such as Google Cloud. Marketing tools receive only the approved, de-identified events. That keeps patient data under your existing agreements and access controls.

Tools we work with here
Server-side Google Tag ManagerGoogle Analytics 4 and GA360BigQuerySnowflakeSegmentdbtMeta Conversions APIGoogle Ads offline conversionsSalesforceLooker Studio
How we work

How an engagement starts

The work runs in three steps. You see working output within weeks and can stop after any stage.

01

Discovery call

A 30 minute call with the engineer who would do the work. We look at your setup, tell you what we would fix first, and whether you need us for it.

Day 1
02

Blueprint sprint

We map your sources, stakeholders and goals, then give you an architecture and a prioritised roadmap. You keep it whether or not we do the build.

2 to 4 weeks
03

Build in sprints

We ship working tracking, models, dashboards and agents every two weeks. You can stop after any sprint, and everything built stays yours.

Every 2 weeks

What happens on the call

Book your call
  • 30 minutes with the engineer who would do the work
  • No slides or sales pitch
  • A clear answer on whether we can help, and a referral if we can’t
  • The first fix we would make, which you can use either way
Next step

Get your first fix in 30 minutes

Bring the question your team can’t answer fast enough. The engineer who would do the work looks at your setup with you and tells you the first thing we would fix, plus a straight answer on whether you need us at all. It costs you half an hour, and you keep the fix either way.

Book a free discovery call