Skip to main content
BAA Directory

Does Triple Whale sign a BAA?

The answer

No public statement

No public statement about a BAA. Triple Whale's DPA says its platform is not intended for sensitive data, a term whose definition lists health information.

Analytics and data. Checked on the vendor's own pages on .

Measuring a healthcare website? Curve Compliance includes web analytics, session replay and heatmaps under the same BAA as its HIPAA-compliant ad tracking. Book a call

On this page

What Triple Whale says

“The Parties agree that the Platform and underlying Services are not intended for the processing of Sensitive Data, and that if Customer wishes to use the Platform and underlying Services to process Sensitive Data, it must first obtain Triple Whale's explicit prior written consent and enter into any additional agreements as required by Triple Whale.”

Source: Triple Whale Data Processing Addendum, section 2.5 Sensitive Data, checked .

“(c) financial, credit, genetic, biometric or health information”

Source: Triple Whale Data Processing Addendum, section 1.1(m), what Sensitive Data may include, checked .

What this means for ad tracking

Analytics and tag scripts run on every page, including pages about a condition, a treatment or a booking. They collect page addresses, page titles, IP addresses and device identifiers, which together can connect a person to the care they were looking for.

Triple Whale says the Triple Whale Pixel “is intended for attribution and analytics purposes” (Triple Whale Trust Center). Its DPA says “the Platform and underlying Services are not intended for the processing of Sensitive Data,” and its definition of Sensitive Data lists “health information.”

The DPA leaves one route open: a customer that wants to process sensitive data must first obtain Triple Whale's “explicit prior written consent” and “enter into any additional agreements as required by Triple Whale.” We checked Triple Whale's terms, privacy notice, DPA and trust center, and none of them mentions HIPAA or a BAA. Ask Triple Whale in writing before any patient information reaches it.

Without a BAA, Triple Whale should stay off pages where a visit could reveal a condition, a treatment or a booking. Those are also the pages that produce your best conversion signals, so the signals need another route to your ad platforms. This directory lists Meta and Google Ads as not signing a BAA, so the conversion has to reach them without health information. See which ad platforms sign a BAA.

For how Triple Whale compares with Hyros and Northbeam on health data, read Hyros vs Triple Whale vs Northbeam for telehealth. Selling through Shopify? See Is Shopify HIPAA compliant?

Curve Compliance helps with that part: it sends the conversion itself server-side under a BAA it signs on every plan, sends each platform only a fixed list of fields, and detects PHI-like patterns before data reaches an ad platform. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.

How Curve helps

  • Curve's team does the HIPAA-compliant setup for you, typically live in about a week, under a BAA Curve signs on every plan.
  • Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
  • Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
  • Each platform receives only a fixed list of fields. Contact identifiers are off by default and SHA-256 hashed when enabled, and events can use neutral names.
  • Event Logs show what Curve sent to each platform and what the platform accepted.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Read the full guide

For the full picture on Triple Whale and patient data, read Switching From Triple Whale: A Guide for Telehealth Brands.

Frequently asked questions

Does Triple Whale sign a BAA?

We could not find a statement about a BAA on Triple Whale's own pages. Its DPA says: “The Parties agree that the Platform and underlying Services are not intended for the processing of Sensitive Data, and that if Customer wishes to use the Platform and underlying Services to process Sensitive Data, it must first obtain Triple Whale's explicit prior written consent and enter into any additional agreements as required by Triple Whale.” We checked Triple Whale's own pages on October 26, 2026.

Is Triple Whale HIPAA compliant?

Triple Whale's DPA says its platform is not intended for sensitive data, a term whose definition lists health information, and none of the Triple Whale pages we checked mentions HIPAA or a BAA. Without a BAA, Triple Whale should not receive patient information.

Can a telehealth brand use the Triple Whale Pixel on its store?

Not on pages that carry patient information. Triple Whale's DPA says its platform is not intended for sensitive data, a term whose definition lists health information, without Triple Whale's explicit prior written consent and any additional agreements it requires. Send the conversions from intake, eligibility and checkout pages server-side through a service that signs a BAA with you. Talk to your counsel about where that line falls for your store.

How do I switch from Triple Whale without losing attribution?

Curve's team sets up server-side conversion tracking to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn, typically live in about a week. Curve's Campaign Reporting puts Meta and Google Ads spend next to Curve-tracked conversions per campaign, with five attribution models and a list of the conversions behind any number. Our guide to switching from Triple Whale walks through the move.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Triple Whale before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call