Skip to main content
BAA Directory

Is Vagaro HIPAA compliant? Does it sign a BAA?

The answer

Signs a BAA

Yes, for US businesses. Vagaro has you sign its BAA in the app when you turn on its HIPAA Compliant Notifications setting.

Scheduling and intake. Checked on the vendor's own pages on .

Taking bookings in Vagaro? Curve Compliance credits each booking to the ad click that started it, even when patients book days later, and sends the conversion server-side to Meta, Google and TikTok under a BAA on every plan. Book a call

On this page

What Vagaro says

“Turning on the HIPAA Compliant Notifications setting in Vagaro also requires that you sign the Business Associate Agreement (BAA) to confirm that you will adhere to the rules about allowable and impermissible uses of health information between your business and Vagaro.”

Source: Vagaro Support, Send HIPAA-Compliant Notifications, checked .

“Read the agreement, then select Sign the BAA Agreement.”

Source: Vagaro Support, Send HIPAA-Compliant Notifications (steps), checked .

“This feature is available only to US businesses.”

Source: Vagaro Support, Send HIPAA-Compliant Notifications (prerequisites), checked .

“If your business collects and stores patient information, you can turn on HIPAA compliance in Vagaro when sending messages to your clients via text, push notifications, and emails.”

Source: Vagaro Support, HIPAA Compliance, checked .

“Vagaro provides a BAA as part of its HIPAA compliance features for medical spa customers.”

Source: Vagaro, HIPAA Compliance for Med Spas, checked .

“Customer must execute a Business Associate Agreement with Company prior to activating the E-Prescription Service.”

Source: Vagaro Mid-Market Enterprise Subscription Agreement, 7.6, checked .

What this means for ad tracking

The booking is the conversion most clinics and med spas optimize their ads for, so Vagaro usually sits right where the ad tracking happens. With HIPAA Compliant Notifications on, Vagaro says its emails to clients leave out the name of the scheduled service. A pixel on a booking or confirmation page is a separate path: it can send the page address, the service booked and the visitor's identifiers to Meta, Google or TikTok.

A BAA with Vagaro covers the data Vagaro handles for you. It does not cover what an ad pixel on a booking or confirmation page sends to an ad platform, because the ad platform is a separate recipient that has not signed your BAA. Meta's Business Tools Terms bar health information, so the booking has to reach Meta without it. See which ad platforms sign a BAA.

Curve Compliance helps with that part. When a visitor leaves your site to book in Vagaro, Curve keeps the ad attribution: plain booking links are handled automatically, and a booking made days later still matches the visit that started it. Curve credits the booking to the ad and sends the conversion server-side, under a BAA it signs on every plan, so your campaigns keep a conversion signal without a pixel carrying patient data. Book a call to see it on your own funnel.

For med spas, see Curve for med spas, Does HIPAA apply to med spas? and Best HIPAA-compliant conversion tracking for med spas.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own. To compare schedulers, see our guide to HIPAA compliant scheduling software.

How Curve helps

  • Curve carries the conversion signal to your ad platforms separately, under its own BAA, so you can keep Vagaro for what it does well.
  • Curve keeps ad attribution when a visitor leaves your site to book in Vagaro. Plain booking links are handled automatically, and bookings made days later still match.
  • Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
  • Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
  • Each platform receives only a fixed list of fields. Contact identifiers are off by default and SHA-256 hashed when enabled, and events can use neutral names.
  • Event Logs show what Curve sent to each platform and what the platform accepted.
  • Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Is Vagaro HIPAA compliant?

Vagaro offers a HIPAA Compliant Notifications setting for US businesses, and turning it on requires signing Vagaro's BAA. With the setting on, Vagaro says client emails leave out the name of the scheduled service. The BAA does not cover ad pixels or tags on your booking pages, because they send data to other companies.

Does Vagaro sign a BAA?

Yes, for US businesses. In Vagaro's words: “Turning on the HIPAA Compliant Notifications setting in Vagaro also requires that you sign the Business Associate Agreement (BAA) to confirm that you will adhere to the rules about allowable and impermissible uses of health information between your business and Vagaro.” We checked Vagaro's own pages on October 26, 2026.

How do I sign the BAA in Vagaro?

Vagaro's support article lists the steps. Go to Settings, then Email & Text Notifications (on a phone, select More first). Toggle on HIPAA Compliant Notifications, read the agreement, select Sign the BAA Agreement, then select Save. Vagaro says the feature is available only to US businesses.

Can I track Vagaro bookings in Meta and Google Ads?

Yes, with Curve Compliance. When a visitor clicks a plain booking link from your site to Vagaro, Curve keeps the ad attribution automatically, and bookings made days later still match. Curve sends the conversion to Meta, Google Ads and your other ad platforms server-side, and Event Logs show what each platform accepted. More in our guide to HIPAA compliant scheduling software.

Does a BAA with Vagaro cover my ad pixels?

No. A BAA covers the data Vagaro handles for you. A pixel sends data from the visitor's browser straight to Meta, Google or TikTok, and none of those platforms is a party to your BAA with Vagaro.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Vagaro before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call