On this page
Acuity Scheduling can be made HIPAA-enabled on its Powerhouse and Premium plans, with a BAA you enter into from Acuity's settings, while Calendly says it “isn't intended for collecting Protected Health Information” and doesn't currently offer a BAA (Squarespace; Calendly). For clinics running ads, the second question is attribution: the booking happens on the scheduler's page, so the conversion has to reach Meta and Google without a pixel carrying patient details. Curve Compliance, which credits Calendly and Acuity bookings to the ad click that started them, checked both vendors' pages on November 9, 2026.
Book a call. Running ads that send patients to Calendly or Acuity? Curve Compliance keeps the ad click attached when a visitor leaves your site to book, credits bookings made days later to the original ad, and sends the conversion server-side with a fixed list of fields. Curve's team does the setup, typically live in about a week. Book a call with Curve.
Calendly vs Acuity at a glance
| Calendly | Acuity Scheduling | |
|---|---|---|
| BAA | “we don't currently offer a BAA” (Calendly's Community Manager, Calendly Community) | Yes. In Acuity's settings, “click the BAA link to begin the process of entering into a BAA” (Squarespace) |
| Plans | None, per that answer | “You can make your Acuity account HIPAA-enabled on the Powerhouse or Premium plans.” Custom BAAs are available on an Enterprise plan (Squarespace) |
| Where patient details may go | Calendly advises you to “keep any personal or medical details out of your invitee intake questions” (Calendly) | Acuity only: “Acuity is the only Squarespace feature currently designed to offer services consistent with HIPAA obligations” (Squarespace) |
| Other HIPAA statements | “Calendly does not currently comply with HIPAA, GLBA, or similar health and financial regulations” (Notetaker FAQ, Calendly) | “Enabling HIPAA-related features in Acuity alone isn't enough to make you HIPAA compliant” (Squarespace) |
| Ad attribution with Curve Compliance | Plain links to Calendly carry the ad click across automatically (Calendly integration) | Plain links to Acuity carry the ad click across automatically (Acuity integration) |
Directory entries: Calendly and Acuity Scheduling. Single-vendor verdicts: Is Calendly HIPAA compliant? and Is Acuity Scheduling HIPAA compliant?
What Calendly says about HIPAA
Asked whether Calendly would adopt a BAA, Calendly's Community Manager answered that Calendly is built as a secure platform, “but as it stands today it isn't intended for collecting Protected Health Information, and we don't currently offer a BAA.” The same answer adds: “If you do use Calendly in a clinical context, the safest approach is to keep any personal or medical details out of your invitee intake questions, and to check with your own legal/compliance team on what your practice requires,” and says Calendly has no “firm roadmap commitment or a date to share right now” on a BAA (Calendly Community).
Calendly's Notetaker FAQ says the same about its meeting notes feature: “Calendly does not currently comply with HIPAA, GLBA, or similar health and financial regulations” (Calendly). Whether a booking with your practice creates PHI depends on what you offer and what the booking asks, so talk to your counsel before you choose. If you are moving away from Calendly, see switching from Calendly to HIPAA-compliant scheduling.
What Acuity's BAA covers, and what it leaves to you
- One account at a time. “An account only becomes HIPAA-enabled when a separate BAA is entered into for that specific account” (Squarespace).
- Acuity only, not your Squarespace site. “Your Business Associate Addendum (BAA) doesn't cover other Squarespace features,” and “Other parts of the Squarespace platform, including contact form features like the form block, can't be used as part of a HIPAA compliant solution” (Squarespace).
- Extra protections once enabled. “Email notifications we send you won’t include client form answers,” Reserve with Google and some calendar syncs are turned off, and “You'll be logged out of your account after four hours of inactivity” (Squarespace).
- Notifications are your job. “Email and text notifications may contain Protected Health Information (PHI) by default, including client names, email addresses, appointment types, and appointment dates and times. You're responsible for changing the information in messages by updating your notification settings” (Squarespace).
- So are integrations. “If you connect Acuity to any third-party integrations, such as Google Calendar or Stripe, it's your responsibility to determine if the integration is acceptable for your business” (Squarespace).
Intake questions: what to ask, and what to leave out
The booking form is where the risk sits. HHS gives this example: “tracking technologies might collect an individual's email address, or reason for seeking health care typed or selected by an individual, when the individual visits a regulated entity's webpage and makes an appointment with a health care provider” (HHS).
- On Calendly, follow Calendly's own advice and keep personal and medical details out of invitee questions.
- On Acuity, once the account is HIPAA-enabled you can collect intake answers under the BAA, but appointment type names still show in notifications by default, so name them neutrally.
- On both, keep condition and treatment names out of booking page addresses and appointment type names that a pixel on the page could read.
- For longer intake, collect it in Curve Forms, hosted by Curve under the BAA Curve signs on every plan, then redirect people to your booking page after they submit.
Keeping ad attribution when patients book in Calendly or Acuity
When a visitor leaves your site for a scheduler, the click ID and UTMs stay behind, so the booking can't be credited to the ad. The usual workaround is a pixel on the booking or confirmation page, which is exactly the page HHS's scheduling example describes. The safer pattern is to let the scheduler report the booking to a server, credit it there to the original click, and send a neutral conversion with a fixed list of fields.
Curve Compliance does this with a bridge token: when a visitor clicks a plain link to Calendly or Acuity, Curve keeps their ad attribution, adds a short reference to the booking link, credits the booking when the scheduler's webhook arrives, and sends the conversion server-side to Meta, Google, TikTok, Microsoft and LinkedIn. The token carries no form content and is not a patient identifier, and bookings made days after the click still match. See the Calendly and Acuity Scheduling integration pages, and what website tracking sends from a health site. If bookings then land in a CRM, see GoHighLevel vs HubSpot for healthcare.
How Curve Compliance helps
Curve Compliance replaces browser ad pixels with one script and keeps the ad click attached when a visitor leaves your site to book in Calendly, Acuity, IntakeQ, Jane App or another scheduler. Each booking is credited to the original click, even days later, and sent server-side from Curve's servers to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn with a fixed list of fields and a neutral event name. Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform, and Event Logs show what each platform accepted.
Campaign Reporting puts Meta and Google Ads spend next to the tracked bookings for each campaign. Curve is SOC 2 Type II, signs a BAA on every plan, and its team does the setup, typically live in about a week. Book a call to see your own booking flow tracked from ad click to appointment.
Sources, checked November 9, 2026: Calendly Community, BAA/HIPAA compliance (answer from Calendly's Community Manager); Calendly Notetaker FAQ; Squarespace, Acuity Scheduling and HIPAA; HHS, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates.
Frequently Asked Questions
Calendly vs Acuity: which is better for healthcare?
For bookings that collect patient details, Acuity is the one of the two that offers a BAA, on its Powerhouse and Premium plans, while Calendly says it doesn't currently offer one (Squarespace; Calendly). Either way, send the booking to your ad platforms server-side rather than with a pixel on the booking page.
Is Calendly HIPAA compliant?
Calendly says it “isn't intended for collecting Protected Health Information” and “we don't currently offer a BAA” (Calendly Community), and its Notetaker FAQ says “Calendly does not currently comply with HIPAA” (Calendly).
Does Acuity Scheduling sign a BAA?
Yes, on the Powerhouse or Premium plan: you enter into the BAA from Acuity's Scheduling Page settings, and each account needs its own (Squarespace). Custom BAAs are available on an Enterprise plan.
Does Squarespace's BAA cover my whole website?
No. Squarespace says “Your Business Associate Addendum (BAA) doesn't cover other Squarespace features” and that Acuity is the only Squarespace feature designed for HIPAA obligations (Squarespace).
Can I put a Meta pixel on my booking confirmation page?
HHS says tracking on a page “that permits individuals to schedule appointments” may have access to PHI in certain circumstances (HHS). Send the booking server-side as a neutral event instead of firing a pixel there.
How do I track bookings made on Calendly or Acuity?
Carry the ad click across to the scheduler and credit the booking when its webhook arrives. Curve Compliance does this with a bridge token on plain links, then sends the conversion to Meta and Google server-side, even when the patient books days later.
Does Acuity's HIPAA mode change notifications?
Partly. Acuity says email notifications it sends you won't include client form answers, but notifications may still contain PHI by default, such as appointment types and times, until you change your notification settings (Squarespace).
Talk to Curve Compliance
Book a call. Want every Calendly or Acuity booking credited to the ad that drove it? Curve Compliance carries the click across to the scheduler, sends the booking to Meta and Google server-side with a fixed list of fields, strips PHI before data reaches an ad platform and signs a BAA on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.