Skip to main content
BAA Directory

Is CustomerLabs HIPAA compliant? Does it sign a BAA?

The answer

Signs a BAA

Yes. CustomerLabs' DPA includes a HIPAA Business Associate Agreement, Annex F, which applies when a covered entity or business associate sends it PHI.

HIPAA ad tracking. Checked on the vendor's own pages on .

Using CustomerLabs on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call

On this page

What CustomerLabs says

“The terms in Annex F apply automatically to the extent Customer is a Covered Entity or Business Associate and Customer Data includes PHI.”

Source: CustomerLabs Data Processing Addendum, section 16 HIPAA (PHI) Addendum, checked .

“CustomerLabs is a Business Associate or subcontractor Business Associate as applicable with respect to PHI.”

Source: CustomerLabs DPA, Annex F HIPAA Business Associate Agreement, 2.1 Roles, checked .

“Customer will not configure the Services to transmit PHI to advertising or marketing platforms, ad networks, social media platforms, or other recipients that are not permitted to receive PHI under HIPAA.”

Source: CustomerLabs DPA, section 3.5(f) PHI restriction for activation, checked .

What the BAA covers and excludes

Covers, in CustomerLabs's words:

  • "Customer authorizes CustomerLabs to create, receive, maintain, and transmit PHI only as necessary to provide the Services and as otherwise permitted by this Annex F."

Excludes or limits, in CustomerLabs's words:

  • "Customer will not configure the Services to transmit PHI to advertising or marketing platforms, ad networks, social media platforms, or other recipients that are not permitted to receive PHI under HIPAA."

What this means for ad tracking

Analytics and tag scripts run on every page, including pages about a condition, a treatment or a booking. They collect page addresses, page titles, IP addresses and device identifiers, which together can connect a person to the care they were looking for.

CustomerLabs sends data on to destinations its customers choose. Its DPA calls these Customer Controlled Destinations, “including advertising platforms, analytics platforms, CRMs, warehouses, cloud storage destinations, and Customer's own systems.”

A BAA binds only the vendor that signs it. CustomerLabs' DPA says the customer “will not configure the Services to transmit PHI to advertising or marketing platforms.” CustomerLabs' health and wellness page says it “strips path segments and query params that contain health terms before the event leaves your server,” and its DPA leaves the final check with the customer: “Customer is responsible for excluding PHI from outbound payloads and destinations.” This directory lists Meta and Google Ads as not signing a BAA, so the conversion has to reach them without health information. See which ad platforms sign a BAA.

Curve Compliance helps with that part: it sends the conversion itself server-side under a BAA it signs on every plan, sends each platform only a fixed list of fields, and detects PHI-like patterns before data reaches an ad platform. Book a call to see it on your own funnel.

To compare attribution tools that sign a BAA, see Best HIPAA Compliant Attribution Software for Healthcare. For why a server-side setup still needs PHI controls, read Is Server-Side Tracking HIPAA Compliant? Not by Itself.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.

How Curve helps

  • Curve's team does the HIPAA-compliant setup for you, typically live in about a week, under a BAA Curve signs on every plan.
  • Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
  • Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
  • Each platform receives only a fixed list of fields. Contact identifiers are off by default and SHA-256 hashed when enabled, and events can use neutral names.
  • Event Logs show what Curve sent to each platform and what the platform accepted.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Is CustomerLabs HIPAA compliant?

CustomerLabs includes a HIPAA Business Associate Agreement as Annex F of its DPA, which applies when a covered entity or business associate sends it PHI. With that BAA, CustomerLabs can handle PHI for you as the DPA describes. The BAA does not cover the ad platforms CustomerLabs sends data to, and its DPA says customers will not configure it to send PHI to advertising platforms.

Does CustomerLabs sign a BAA?

Yes, through Annex F of its DPA, titled “HIPAA Business Associate Agreement (BAA).” In CustomerLabs' words: “The terms in Annex F apply automatically to the extent Customer is a Covered Entity or Business Associate and Customer Data includes PHI.” We checked CustomerLabs' own pages on October 26, 2026.

Can CustomerLabs send PHI to Meta or Google?

Not under its DPA, which says: “Customer will not configure the Services to transmit PHI to advertising or marketing platforms, ad networks, social media platforms, or other recipients that are not permitted to receive PHI under HIPAA.” This directory lists Meta and Google Ads as not signing a BAA, so events sent on to them need to leave PHI behind.

How does Curve Compliance help with HIPAA ad tracking?

Curve's team sets up server-side conversion tracking for you, typically live in about a week. Curve sends conversions to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from its own servers, detects PHI-like patterns before data reaches an ad platform, and shows in Event Logs what each platform accepted. Book a call to see it on your own funnel.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with CustomerLabs before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call