Skip to main content
BAA Directory

Is Pendo HIPAA compliant? Does it sign a BAA?

The answer

Signs a BAA

Yes. Pendo says it supports HIPAA customers via a Business Associate Agreement, and its help center sets separate AI defaults for customers with a BAA.

Analytics and data. Checked on the vendor's own pages on .

Measuring a healthcare website? Curve Compliance includes web analytics, session replay and heatmaps under the same BAA as its HIPAA-compliant ad tracking. Book a call

On this page

What Pendo says

“Pendo supports HIPAA customers via a Business Associate Agreement.”

Source: Pendo blog, How to get Pendo's AI features approved at your company (June 22, 2026), checked .

“Customers with BAA (healthcare)”

Source: Pendo Help Center, Artificial intelligence (AI) at Pendo (AI default settings by customer segment), checked .

“Pendo observes key industry best practices and regulatory schemes to protect the security and privacy of our customers’ data: SOC2, GDPR, TX-RAMP, and HIPAA.”

Source: Pendo, Data Privacy and Security, checked .

What this means for ad tracking

Pendo installs in your web application and records how people use it. Its help center says that on each page load, Pendo collects “the URL, some browser information, such as language and browser version, and the title of the page (if enabled)” (Pendo Help Center).

Pendo also says the names of page elements are captured by default and “can include PII displayed in your application UI,” and that text capture can be turned off (Pendo Help Center). On a patient portal, page addresses and titles can carry health information, so have the BAA signed before Pendo runs there.

A BAA binds only the vendor that signs it. This directory lists Meta and Google Ads as not signing one, so conversions sent to them need to leave PHI behind. Our HIPAA-compliant analytics comparison covers BAA terms for other analytics tools.

Curve Compliance helps with that part: it sends the conversion itself server-side under a BAA it signs on every plan, sends each platform only a fixed list of fields, and detects PHI-like patterns before data reaches an ad platform. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.

How Curve helps

  • Curve carries the conversion signal to your ad platforms separately, under its own BAA, so you can keep Pendo for what it does well.
  • Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
  • Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
  • Each platform receives only a fixed list of fields. Contact identifiers are off by default on Meta, Google Ads and TikTok, and events can use neutral names.
  • Event Logs show what Curve sent to each platform and what the platform accepted.
  • Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Is Pendo HIPAA compliant?

Yes. Pendo says it supports HIPAA customers via a Business Associate Agreement, and its help center sets separate AI defaults for customers with a BAA. With a signed BAA, Pendo can handle patient information for you, set up the way the vendor describes. The BAA does not cover ad pixels or tags on the same pages, because they send data to other companies.

Does Pendo sign a BAA?

Yes. In Pendo's words: “Pendo supports HIPAA customers via a Business Associate Agreement” (Pendo). Its help center lists separate AI default settings for “Customers with BAA (healthcare)” (Pendo Help Center). We checked Pendo's own pages on October 26, 2026.

Which Pendo plan includes a BAA?

The Pendo pages we checked name no plan. Pendo says it supports HIPAA customers via a Business Associate Agreement (Pendo), so ask your Pendo account team to add one to your contract.

Can Pendo run on pages where patients book or type health details?

With a signed BAA, Pendo can handle that data for you. Pendo says page element names are captured by default and can include PII shown in your application, and that text capture can be turned off (Pendo Help Center). Without a BAA, keep Pendo off those pages.

What does Curve Compliance do for ad tracking?

Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. It detects PHI-like patterns before data reaches an ad platform, and Event Logs show what Curve sent to each platform and what the platform accepted. Book a call to see it on your own funnel.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Pendo before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call