Skip to main content
BAA Directory

Is VWO HIPAA compliant? Does it sign a BAA?

The answer

Does not sign a BAA

Not by default. VWO's parent company Wingify says a BAA is not applicable because it does not store or collect PHI, so it is not a business associate.

Analytics and data. Checked on the vendor's own pages on .

Measuring a healthcare website? Curve Compliance includes web analytics, session replay and heatmaps under the same BAA as its HIPAA-compliant ad tracking. Book a call

On this page

What Wingify says

“Because Wingify does not store or collect PHI/ePHI by default, we do not meet the definition of a Business Associate or Business Associate Subcontractor under HIPAA.”

Source: Wingify Compliance, HIPAA and HITECH (No PHI/ePHI Storage by default), checked .

“A BAA is required when a vendor handles PHI/ePHI. Since Wingify does not require, request, or store any PHI/ePHI: A BAA is not applicable, and Wingify is not categorized as a Business Associate.”

Source: Wingify Compliance, HIPAA and HITECH (Business Associate Agreement), checked .

“If you believe your specific use case requires a BAA, please contact your Wingify Account Executive or reach out to our Data Protection Officer in writing via email to privacy@wingify.com for escalation.”

Source: Wingify Compliance, HIPAA and HITECH (Business Associate Agreement), checked .

What this means for ad tracking

Testing scripts run on the pages you test, and on a healthcare site those can include service, booking and intake pages. A page address, a page title or a form step can connect a visitor to the care they were looking for.

Wingify puts that part on the customer. It says “customers must ensure that no configurations expose or transmit any PHI, ePHI, or other sensitive health-related information through VWO,” and that page elements and URL parameters carrying PHI must be anonymized or blocked by the customer (Wingify).

Without a BAA, keep PHI out of VWO. Curve's VWO integration tracks variant performance without exposing patient data, and our guide to HIPAA-compliant A/B testing covers setups that keep PHI out of testing tools.

Your ad platforms need conversions too, and this directory lists Meta and Google Ads as not signing a BAA. Curve Compliance sends the conversion itself server-side under a BAA it signs on every plan, sends each platform only a fixed list of fields, and detects PHI-like patterns before data reaches an ad platform. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.

How Curve helps

  • Curve's VWO integration tracks variant performance without exposing patient data.
  • Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
  • Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
  • Each platform receives only a fixed list of fields. Contact identifiers are off by default on Meta, Google Ads and TikTok, and events can use neutral names.
  • Event Logs show what Curve sent to each platform and what the platform accepted.
  • Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Is VWO HIPAA compliant?

Not by default. VWO's parent company Wingify says a BAA is not applicable because it does not store or collect PHI, so it is not a business associate. Without a BAA, VWO should not receive patient information.

Does VWO sign a BAA?

Not by default. In Wingify's words: “A BAA is not applicable, and Wingify is not categorized as a Business Associate.” It asks customers who believe their use case requires a BAA to contact their Wingify account executive (Wingify). We checked Wingify's own page on October 26, 2026.

On which VWO plan is a BAA available?

Wingify's HIPAA page names no plan with a BAA. It says “If you believe your specific use case requires a BAA, please contact your Wingify Account Executive” (Wingify).

Can VWO run on pages where patients book or type health details?

Wingify says customers must make sure no configuration exposes or transmits PHI through VWO, including page elements and URL parameters that carry it (Wingify). Without a BAA, keep PHI out of VWO on booking and intake pages.

What does Curve Compliance do for ad tracking?

Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. It detects PHI-like patterns before data reaches an ad platform, and Event Logs show what Curve sent to each platform and what the platform accepted. Book a call to see it on your own funnel.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Wingify before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call