Skip to main content
BAA Directory

Does Freshpaint sign a BAA?

The answer

Signs a BAA

Yes. Freshpaint says it offers a Business Associate Agreement (BAA), and its terms bar PHI until a BAA is executed and in place with Freshpaint.

HIPAA ad tracking. Checked on the vendor's own pages on .

Using Freshpaint on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call

On this page

What Freshpaint says

“Freshpaint is built specifically for HIPAA-regulated environments and offers a Business Associate Agreement (BAA).”

Source: Freshpaint FAQ, Is Freshpaint HIPAA compliant?, checked .

“Customer agrees not to use the Services to collect, store, process or transmit any patient, medical or other Protected Health Information regulated by the Health Insurance Portability and Accountability Act (“HIPAA”), unless and until a Business Associate Agreement (“BAA”) is executed and in place between Customer and Freshpaint.”

Source: Freshpaint Terms of Service, 5.4 Protected Health Information, checked .

“Depending on the use case, that can include documentation like FAQs, BAA coverage, example configurations, and conversations with Freshpaint team members who can help answer implementation and governance questions.”

Source: Freshpaint FAQ, What can I share with my legal, compliance, or security team?, checked .

What this means for ad tracking

Analytics and tag scripts run on every page, including pages about a condition, a treatment or a booking. They collect page addresses, page titles, IP addresses and device identifiers, which together can connect a person to the care they were looking for.

Freshpaint collects website events and sends them on to the marketing tools you choose. Its FAQ describes a “block-by-default” approach: “Nothing is shared unless you explicitly allow it.” Freshpaint also says it “prevents PHI from being sent to non-compliant tools.”

A BAA with Freshpaint covers the data Freshpaint handles for you. It does not make the tools Freshpaint sends data to party to your BAA. This directory lists Meta and Google Ads as not signing a BAA, so the conversion has to reach them without health information. See which ad platforms sign a BAA.

Curve Compliance helps with that part: it sends the conversion itself server-side under a BAA it signs on every plan, sends each platform only a fixed list of fields, and detects PHI-like patterns before data reaches an ad platform. Book a call to see it on your own funnel.

Comparing options? Read PostHog vs Freshpaint for healthcare and Curve vs Freshpaint for small practices.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.

How Curve helps

  • Curve's team does the HIPAA-compliant setup for you, typically live in about a week, under a BAA Curve signs on every plan.
  • Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
  • Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
  • Each platform receives only a fixed list of fields. Contact identifiers are off by default and SHA-256 hashed when enabled, and events can use neutral names.
  • Event Logs show what Curve sent to each platform and what the platform accepted.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Read the full guide

For the full picture on Freshpaint and patient data, read Freshpaint Alternatives for Healthcare Marketing in 2026.

Frequently asked questions

Is Freshpaint HIPAA compliant?

Freshpaint says it is built for HIPAA-regulated environments and offers a BAA, and its terms bar PHI until a BAA is executed and in place. With a signed BAA, Freshpaint can handle patient information for you, set up the way Freshpaint describes. The BAA does not cover ad pixels or tags that send data to other companies.

Does Freshpaint sign a BAA?

Yes. In Freshpaint's words: “Freshpaint is built specifically for HIPAA-regulated environments and offers a Business Associate Agreement (BAA).” We checked Freshpaint's own pages on October 26, 2026.

Which Freshpaint plans include a BAA?

Freshpaint's pricing page lists three plans, Comply, Perform and Scale, each with a “Talk to Sales” button, and does not say which of them include a BAA. Its terms say PHI may not go through Freshpaint “unless and until a Business Associate Agreement (“BAA”) is executed and in place between Customer and Freshpaint,” so confirm the BAA with Freshpaint before you send it patient data.

Does a Freshpaint BAA cover Meta and Google Ads?

No. A BAA binds only the vendor that signs it. This directory lists Meta and Google Ads as not signing one, so events sent on to them need to leave PHI behind.

How does Curve Compliance help with HIPAA ad tracking?

Curve's team sets up server-side conversion tracking for you, typically live in about a week. Curve sends conversions to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from its own servers, detects PHI-like patterns before data reaches an ad platform, and shows in Event Logs what each platform accepted. Book a call to see it on your own funnel.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Freshpaint before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call