Skip to main content
BAA Directory

Is Cometly HIPAA compliant? Does it sign a BAA?

The answer

No public statement

No public statement about a BAA. Cometly's terms say no Cometly feature may ever be used to collect or track health information protected under HIPAA.

Analytics and data. Checked on the vendor's own pages on .

Measuring a healthcare website? Curve Compliance includes web analytics, session replay and heatmaps under the same BAA as its HIPAA-compliant ad tracking. Book a call

On this page

What Cometly says

“You agree not to use the Service to collect, store, or process any data that is subject to heightened legal or regulatory protections (e.g., health information governed by HIPAA, payment card data governed by PCI-DSS) unless you have obtained our prior written consent and implemented any additional required safeguards.”

Source: Cometly Terms of Service, section 8.1 Prohibited Data, checked .

“Health Information protected under any applicable data protection or healthcare law (e.g., HIPAA in the United States), including but not limited to details about an individual’s health status, medical treatments, or insurance information (“Protected Health Information” or “PHI”).”

Source: Cometly Terms of Service, section 8.1 (data you may never collect or track with Events or any other Cometly feature), checked .

“Certain industries (e.g., healthcare, finance) have unique compliance requirements. You are solely responsible for determining whether the Service meets your regulatory requirements”

Source: Cometly Terms of Service, section 9.1 Customer Responsibility, checked .

What this means for ad tracking

Analytics and tag scripts run on every page, including pages about a condition, a treatment or a booking. They collect page addresses, page titles, IP addresses and device identifiers, which together can connect a person to the care they were looking for.

Cometly tracks user actions and conversions through custom events, which its terms call Events. Section 8.1 of its terms says you agree not to use the Service for health information governed by HIPAA “unless you have obtained our prior written consent and implemented any additional required safeguards.” The same section says that under no circumstances may Events, or any other Cometly feature, be used to collect or track health information protected under HIPAA, “including but not limited to details about an individual’s health status, medical treatments, or insurance information.”

We found no statement on Cometly's terms or security page that it signs a BAA, so ask Cometly in writing before any patient information reaches it.

Without a BAA, Cometly should stay off pages where a visit could reveal a condition, a treatment or a booking. Those are also the pages that produce your best conversion signals, so the signals need another route to your ad platforms. This directory lists Meta and Google Ads as not signing a BAA, so the conversion has to reach them without health information. See which ad platforms sign a BAA.

Curve Compliance helps with that part: it sends the conversion itself server-side under a BAA it signs on every plan, sends each platform only a fixed list of fields, and detects PHI-like patterns before data reaches an ad platform. Book a call to see it on your own funnel.

To compare attribution tools that sign a BAA, see Best HIPAA Compliant Attribution Software for Healthcare. For how Cometly's terms compare with Hyros, Triple Whale and Northbeam, read Hyros vs Triple Whale vs Northbeam for telehealth.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.

How Curve helps

  • Curve's team does the HIPAA-compliant setup for you, typically live in about a week, under a BAA Curve signs on every plan.
  • Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
  • Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
  • Each platform receives only a fixed list of fields. Contact identifiers are off by default and SHA-256 hashed when enabled, and events can use neutral names.
  • Event Logs show what Curve sent to each platform and what the platform accepted.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Is Cometly HIPAA compliant?

Cometly's terms say that under no circumstances may its Events, or any other Cometly feature, be used to collect or track health information protected under HIPAA, and we found no statement on its own pages that it signs a BAA. Without a BAA, Cometly should not receive patient information.

Does Cometly sign a BAA?

We could not find a statement about a BAA on Cometly's own pages. Its terms say: “You agree not to use the Service to collect, store, or process any data that is subject to heightened legal or regulatory protections (e.g., health information governed by HIPAA, payment card data governed by PCI-DSS) unless you have obtained our prior written consent and implemented any additional required safeguards.” We checked Cometly's own pages on October 26, 2026.

Can I track conversions on intake or booking pages with Cometly?

Not with patient information. Cometly's terms say its Events, and any other Cometly feature, may under no circumstances be used to collect or track health information protected under HIPAA. Send the conversions from those pages server-side through a service that signs a BAA with you.

What can a healthcare company use for ad attribution under a BAA?

A tool that signs a BAA and sends conversions to the ad platforms without health information. Curve Compliance signs a BAA on every plan and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Its Campaign Reporting puts Meta and Google Ads spend next to those conversions, with five attribution models. Book a call to see it on your own funnel.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Cometly before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call