Skip to main content
BAA Directory

Does WhatConverts sign a BAA?

The answer

Signs a BAA on specific plans

Yes, on the Pro and Elite plans. WhatConverts turns on HIPAA compliance for a profile once your BAA is executed.

Call tracking and phones. Checked on the vendor's own pages on .

Using WhatConverts on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call

On this page

What WhatConverts says

“Once your Business Associate Agreement (BAA) is executed, the WhatConverts team will activate HIPAA compliance for your profile.”

Source: WhatConverts Help Center, Enable HIPAA Compliance in a Profile, checked .

“Available on: Pro and Elite Plans”

Source: WhatConverts Help Center, Enable HIPAA Compliance in a Profile (feature availability), checked .

“A signed BAA is required to store patient data in the platform.”

Source: WhatConverts Help Center, Data, Privacy & Security FAQs, checked .

What the BAA covers and excludes

Excludes or limits, in WhatConverts's words:

  • "Webhooks must be sent to secure (HTTPS) URLs, and the receiving platform must also be HIPAA-compliant."

What this means for ad tracking

A phone call or form lead from an ad is often a clinic's most valuable conversion. WhatConverts tracks calls, forms and chats, records and transcribes calls, and can pass leads on to other tools.

A BAA with WhatConverts covers the recordings, transcripts and lead details it holds. It does not cover the ad platform that receives a call or lead conversion, so caller details and call content should stay out of what goes to Google Ads or Meta.

Curve Compliance closes that gap: WhatConverts outcomes show in Curve's Campaign Reporting as CRM revenue and close rate, and the conversion reaches your ad platforms server-side, under a BAA Curve signs on every plan. Book a call to see it on your own funnel.

How Curve helps

  • Keep WhatConverts for what it does well. Curve Compliance carries the conversion signal to your ad platforms separately, under its own BAA.
  • WhatConverts outcomes show in Campaign Reporting as CRM revenue and close rate, next to ad spend per platform and campaign.
  • Server-side conversions to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn, sent from Curve's servers with neutral event names and SHA-256 hashed identifiers.
  • PHI-like pattern detection flags condition names, form answers and emails in URLs before data reaches an ad platform, so they can be stopped at the source.
  • A HIPAA-compliant setup done by Curve's team, in about a week, with a BAA signed on every plan.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Does WhatConverts sign a BAA?

Yes, on the Pro and Elite plans. WhatConverts turns on HIPAA compliance for a profile once your BAA is executed. In WhatConverts' words: “Once your Business Associate Agreement (BAA) is executed, the WhatConverts team will activate HIPAA compliance for your profile.” We checked WhatConverts' own pages on October 1, 2026.

Which WhatConverts plans include a BAA?

WhatConverts lists HIPAA compliance as available on its Pro and Elite plans. You request activation, and the WhatConverts team turns on HIPAA compliance for your profile once your BAA is executed.

Does a BAA with WhatConverts cover my ad pixels?

No. A BAA covers the data WhatConverts handles for you. A pixel sends data from the visitor's browser straight to Meta, Google or TikTok, and none of those platforms is a party to your BAA with WhatConverts.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with WhatConverts before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call