Improvado Improvado
Get your demo
Improvado research Early beta

HIPAA-safe web analytics for healthcare marketing

See which ad clicks become booked appointments — without Google Analytics, without patient data leaving your boundary, and without the legal exposure that came with tracking pixels.

Status
Early beta
Contract
Signed BAA
Data residency
US-only
Feedback call
30 minutes
01

Why analytics went dark

The problem

Healthcare removed its analytics — and went blind

The tracking stack that every other industry takes for granted became a legal liability for covered entities. Three facts explain the gap this beta exists to close.

01

The pixel lawsuits reached $47.5M

Kaiser Permanente’s settlement over website tracking pixels reached $47.5M — one of a wave of wiretapping-law class actions against health systems.

02

Google won’t sign the contract healthcare needs

Hospitals and clinics strip Google Analytics and ad pixels because Google won’t sign the HIPAA contract (BAA) that covered entities legally require.

03

Budgets are reallocated blind

With tracking gone, nothing connects a paid click to a booked patient — budgets are reallocated blind.

BAA = Business Associate Agreement, the HIPAA contract where a vendor takes legal responsibility for patient data.

02

Who sees identifiers

The boundary

The difference is whose servers see the raw identifiers

Both approaches observe the same visit. What separates them is where each identifier is allowed to travel.

IP address Sent to the platform Server-only, discarded
Persistent client ID Held by the platform Anonymous first-party cookie inside the BAA boundary
Full page URL (can name a condition) Sent Redacted at collection
Email & phone Leaks from forms and URLs Hashed, opt-in only
Ad click ID (gclid, fbclid) One of many signals The only thing that ever leaves

The ad platform still learns “click X converted” — enough to optimize campaigns. It never learns who the person is or what care they sought.

03

First-party by construction

How it works

First-party by construction

Five steps from ad click to measured booking — with the allowlist, not an after-the-fact filter, deciding what leaves.

  1. 01

    Ad click lands

    Google, Meta, and LinkedIn append their click ID to the landing URL — the one identifier the ad platform already owns.

  2. 02

    Pixel on your domain

    A ~3KB script reports to an endpoint on the clinic’s own domain. No third-party beacons.

  3. 03

    Server-side allowlist

    The default is send nothing: IP discarded, URL path redacted, PHI blocked.

  4. 04

    Your warehouse

    Clean events land next to your ad-spend data. You stay the data owner; we stay a processor.

  5. 05

    Click ID only

    Optionally, the bare click ID returns to the ad platform so bidding keeps learning.

  • We sign a BAA and operate as your Business Associate
  • Consent banner built in — tracking starts only after explicit visitor consent
  • US-only data residency, encryption in transit and at rest, full audit log
04

What you see

The product surface

What you see

Concept mockup — not final product Concept preview of the HIPAA-safe web analytics dashboard: patient-journey funnel, conversions by channel, cost per booking, and server-side destinations
Concept preview — patient-journey funnel, conversions by channel, cost per booking, and server-side destinations at a glance. Lives next to the spend data Improvado already consolidates from 500+ ad and marketing platforms.
05

Compliance evidence

For your legal team

Compliance you can show your legal team

Concept mockup — not final product Concept mockup of the Data Allowlist screen with per-property allowed, redacted, server-only, hashed opt-in, and blocked states
The Data Allowlist: every property is explicitly allowed, redacted, server-only, hashed opt-in, or blocked — with an audit log of every change.
Concept mockup — not final product Concept mockup of a visitor journey view showing exactly which data the ad platform received, stamped No PHI
Any journey, one question answered: exactly what did the ad platform receive — stamped No PHI.
06

Five beta questions

What we ask of you

Early beta — five questions, thirty minutes

The product is early on purpose. Your answers to five questions decide what gets built next.

  1. 1

    Is this problem real for you and your clients today — how painful is the loss of web analytics?

  2. 2

    How do you measure paid campaigns right now without GA — and what does that cost you?

  3. 3

    Would you pilot the beta on one property or sub-client site?

  4. 4

    Looking at this UI — what is missing for your day-to-day work?

  5. 5

    What would your compliance and legal team need to see to approve a pilot?

Early access

Join the early beta

We are onboarding a small group of healthcare organizations to shape the product before launch — feedback first, no commitment.

Join the early beta
  1. 01

    A 30-minute feedback call — five questions, your reality, no pitch deck.

  2. 02

    If it resonates, a pilot on one property under a signed BAA.

  3. 03

    Measured CAC by channel next to your spend, inside your boundary.