Skip to main content
BAA Directory

Is Lucky Orange HIPAA compliant? Does it sign a BAA?

The answer

No public statement

No public statement about a BAA. Lucky Orange's DPA says its service is not designed to process sensitive data, and no page we checked mentions a BAA.

Analytics and data. Checked on the vendor's own pages on .

Measuring a healthcare website? Curve Compliance includes web analytics, session replay and heatmaps under the same BAA as its HIPAA-compliant ad tracking. Book a call

On this page

What Lucky Orange says

“The Service is not designed to Process Sensitive Data, and Lucky Orange shall have no obligation to implement additional safeguards specific to such data.”

Source: Lucky Orange Data Processing Agreement, 6.4 Sensitive Data, checked .

“Customer shall not, and shall not permit any third party to, provide Lucky Orange with any Sensitive Data or other high risk Personal Data (including without limitation, special categories of Personal Data under Article 9 of the GDPR), unless otherwise expressly agreed in writing by Lucky Orange.”

Source: Lucky Orange Data Processing Agreement, 6.4 Sensitive Data, checked .

“One important distinction of Lucky Orange is that we do not allow the transmission of sensitive data to our servers.”

Source: Lucky Orange Knowledge Base, Security Overview, checked .

What this means for ad tracking

Heatmaps and session recordings run on every page you track, including pages about a condition, a treatment or a booking. Recordings follow the clicks, scrolling and pages a visitor moves through, which can connect a person to the care they were looking for.

Lucky Orange says “we do not allow the transmission of sensitive data to our servers” and offers ways to keep it in the browser, such as opt-in keystroke logging and CSS classes that mark sensitive content (Lucky Orange). Its DPA says “The Service is not designed to Process Sensitive Data” (Lucky Orange).

None of the Lucky Orange pages we checked mention a business associate agreement. Until Lucky Orange signs one with you, keep patient information out of it, on booking and intake pages most of all.

Your ad platforms need conversions too, and this directory lists Meta and Google Ads as not signing a BAA. Curve Compliance sends the conversion itself server-side under a BAA it signs on every plan, sends each platform only a fixed list of fields, and detects PHI-like patterns before data reaches an ad platform. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.

How Curve helps

  • Curve includes session replay and heatmaps under the same BAA as its ad tracking.
  • Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
  • Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
  • Each platform receives only a fixed list of fields. Contact identifiers are off by default on Meta, Google Ads and TikTok, and events can use neutral names.
  • Event Logs show what Curve sent to each platform and what the platform accepted.
  • Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Is Lucky Orange HIPAA compliant?

We found no statement from Lucky Orange about HIPAA or a BAA for its service. Its DPA says “The Service is not designed to Process Sensitive Data” (Lucky Orange). A HIPAA covered entity needs a signed BAA from any vendor that handles its patients' information, so ask Lucky Orange directly.

Does Lucky Orange sign a BAA?

No public statement. We checked Lucky Orange's security overview, privacy and security articles, DPA, terms of service and privacy statement on October 26, 2026, and none of them mention a business associate agreement.

Can I use Lucky Orange on pages where patients book?

Not with patient information until Lucky Orange signs a BAA with you. Its DPA bars customers from providing sensitive data unless Lucky Orange expressly agrees in writing, so keep Lucky Orange off booking and intake pages until a BAA is in place.

What should I use for ad conversions on pages where Lucky Orange runs?

Send conversions server-side, without health details. Curve Compliance replaces browser ad pixels with one script and sends conversions to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from its servers, with a fixed list of fields and neutral event names, under a BAA it signs on every plan. Book a call to see it on your own funnel.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Lucky Orange before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call