Skip to main content
BAA Directory

Is Mindbody HIPAA compliant? Does it sign a BAA?

The answer

Signs a BAA

Yes, on request, for US businesses subject to HIPAA. Mindbody says its BAA covers its SOAP Notes and Progress Notes features only.

Scheduling and intake. Checked on the vendor's own pages on .

Taking bookings in Mindbody? Curve Compliance credits each booking to the ad click that started it, even when patients book days later, and sends the conversion server-side to Meta, Google and TikTok under a BAA on every plan. Book a call

On this page

What Mindbody says

“If you or any Affiliate is subject to HIPAA and providing or processing any PHI in connection with the Services, prior to accessing or using the Services you must notify Mindbody and enter into a Business Associate Agreement ("BAA") in the form provided by Mindbody.”

Source: Mindbody Terms of Service, 6.5 HIPAA, checked .

“You must send notice and request a BAA by submitting a Support Request.”

Source: Mindbody Terms of Service, 6.5 HIPAA, checked .

“If your business meets all three of the following, please contact us to request a Business Associate Agreement:”

Source: Mindbody Support, Business Associate Agreement (BAA) for HIPAA compliance, checked .

“If you are subject to HIPAA and wish to use our services with PHI, it is your responsibility to request a Business Associate Agreement ("BAA") with Mindbody.”

Source: Mindbody Security Policy, 7. Protection of Personal Health Information, checked .

“This feature is unavailable if you have a Business Associate Agreement (BAA) for HIPAA Compliancy with Mindbody.”

Source: Mindbody Support, Client AI predictions on the owner home dashboard, checked .

What the BAA covers and excludes

Covers, in Mindbody's words:

  • “Mindbody offers HIPAA-enabled features, specifically SOAP Notes and Progress Notes, which are designed to support businesses that need to handle PHI within those workflows. The BAA covers these features only.”

Excludes or limits, in Mindbody's words:

  • “The BAA does not extend to the Mindbody platform broadly, nor to any third-party integrations or platforms connected to your Mindbody account, including but not limited to Attentive.”
  • Third-party integrations: “Each integration is evaluated independently for HIPAA compliance.”
  • Client AI predictions on the owner home dashboard: “This feature is unavailable if you have a Business Associate Agreement (BAA) for HIPAA Compliancy with Mindbody.”

What this means for ad tracking

The booking is the conversion most clinics and studios optimize their ads for, so Mindbody usually sits right where the ad tracking happens. A pixel on a booking or confirmation page can send the page address, the service booked and the visitor's identifiers to Meta, Google or TikTok.

Mindbody says its BAA covers its HIPAA-enabled SOAP Notes and Progress Notes only, and does not extend to the Mindbody platform broadly or to third-party integrations connected to your account, such as Attentive. It does not cover what an ad pixel on a booking or confirmation page sends to an ad platform either, because the ad platform is a separate recipient that has not signed your BAA. Meta's Business Tools Terms bar health information, so the booking has to reach Meta without it. See which ad platforms sign a BAA.

Curve Compliance helps with that part. When a visitor leaves your site to book in Mindbody, Curve keeps the ad attribution: plain booking links are handled automatically, and a booking made days later still matches the visit that started it. Curve credits the booking to the ad and sends the conversion server-side, under a BAA it signs on every plan, so your campaigns keep a conversion signal without a pixel carrying patient data. Book a call to see it on your own funnel.

If you run a med spa, see Curve for med spas and Best HIPAA-compliant conversion tracking for med spas. For what a booking page can leak, see Booking widgets: a PHI leak audit.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own. To compare schedulers, see our guide to HIPAA compliant scheduling software.

How Curve helps

  • Curve carries the conversion signal to your ad platforms separately, under its own BAA, so you can keep Mindbody for what it does well.
  • Curve keeps ad attribution when a visitor leaves your site to book in Mindbody. Plain booking links are handled automatically, and bookings made days later still match.
  • Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
  • Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
  • Each platform receives only a fixed list of fields. Contact identifiers are off by default and SHA-256 hashed when enabled, and events can use neutral names.
  • Event Logs show what Curve sent to each platform and what the platform accepted.
  • Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Is Mindbody HIPAA compliant?

Mindbody offers HIPAA-enabled features, SOAP Notes and Progress Notes, and a BAA that covers those features only, for US businesses subject to HIPAA that request one. Its Security Policy says that if you are subject to HIPAA and have not entered into a BAA, “you must not use any of our digital properties in connection with PHI.” The BAA does not cover ad pixels or tags on your booking pages, because they send data to other companies.

Does Mindbody sign a BAA?

Yes, on request, for US businesses subject to HIPAA. Mindbody's Terms of Service say a customer subject to HIPAA must “notify Mindbody and enter into a Business Associate Agreement ("BAA") in the form provided by Mindbody.” We checked Mindbody's own pages on October 26, 2026.

How do I request a BAA from Mindbody?

Mindbody's Terms of Service say: “You must send notice and request a BAA by submitting a Support Request.” Its support article says to contact Mindbody if your business is based in the US, is subject to HIPAA, and handles Protected Health Information as HIPAA defines it.

What does Mindbody's BAA cover?

Mindbody says its BAA covers its HIPAA-enabled SOAP Notes and Progress Notes: “The BAA covers these features only.” It says the BAA does not extend to the Mindbody platform broadly or to third-party integrations connected to your account, and that each integration is evaluated independently. Mindbody also says its client AI predictions feature is unavailable once you have a BAA.

Can I track Mindbody bookings in Meta and Google Ads?

Yes, with Curve Compliance. When a visitor clicks a plain booking link from your site to Mindbody, Curve keeps the ad attribution automatically, and bookings made days later still match. Curve sends the conversion to Meta, Google Ads and your other ad platforms server-side, and Event Logs show what each platform accepted. More in our guide to HIPAA compliant scheduling software.

Does a BAA with Mindbody cover my ad pixels?

No. Mindbody says its BAA covers SOAP Notes and Progress Notes only and does not extend to the Mindbody platform broadly. A pixel sends data from the visitor's browser straight to Meta, Google or TikTok, and none of those platforms is a party to your BAA with Mindbody.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Mindbody before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call