Connecting Claude to Clinic Ad Data: What to Allow

A clinic should let Claude read aggregate campaign KPIs, platform spend and weekly conversion counts with small groups withheld, allow search terms and audience data only under written conditions, and never connect it to contact records, form responses, call transcripts or raw event streams. The line matters because Claude's Free, Pro, Max and Team plans carry no BAA, and even on a HIPAA-ready Enterprise plan, Anthropic excludes data sent to third parties through connectors. Curve built its MCP server to return only the allowed tier, from the same HIPAA-compliant tracking layer that ships with a signed BAA on every plan.

The policy in one screen

Sort every source into a tier before clicking "allow" on any OAuth screen:

Allowed (connect read-only):

• Campaign KPIs: impressions, clicks, click-through rate, platform-reported conversions. Source: Google Ads and Meta Ads campaign reports (the reports, not everything the connector can query).
• Spend and cost per conversion by campaign. Source: the same reports.
• Conversion counts by completed week, counted across people, small groups withheld. Source: your tracking layer's reporting, not its event logs.

Conditional (only under the rules below):

• Search terms. Source: the Google Ads search terms report.
• Audiences. Source: Meta custom audiences, Google Ads audience segments and Customer Match lists.

Never (no connector, no copy and paste):

• Contact records. Source: GoHighLevel, HubSpot, any CRM or EHR, Local Services Ads leads.
• Form responses. Source: form builders, CRM submission records, intake and booking tools, Google Ads lead form submissions.
• Call transcripts and message threads. Source: call tracking, CRM conversations, appointment notes.
• Raw event streams. Source: pixel and tag logs, server-side pipelines, webhook payloads, session recordings.

One test sorts them. Could this value, alone or beside what the model already knows, point to one person or reveal their health condition? If not, it is allowed; if only in cases you can define and rule out, it is conditional. If pointing at a person is the record's purpose, it is never.

Why read-only does not mean PHI-safe

Clinics usually ask first whether a connector can change their campaigns. Meta's, TikTok's and Amazon's ad MCP servers can, and Google's official Google Ads server is the only strictly read-only one of the four. For PHI, though, reading is the disclosure. Google's repository says so: "The MCP Server will expose your data to the Agent or LLM that you connect to it."

Every tool result joins the conversation, and the conversation goes to the model vendor, even when the server runs on your laptop. Meta and Google do not sign BAAs for their advertising products, and Meta's Business Tools Terms forbid sharing data that includes or is based on health information.

Write the policy as if no BAA covers the AI hop; on a Team or Pro plan, none does. HIPAA's minimum necessary standard (45 CFR 164.502(b)) points the same way: "which campaign is working" needs aggregates, not a patient. More on the vendor side in Is Claude HIPAA compliant?

Allowed: campaign KPIs, spend and weekly conversions

This is the Monday report: what each campaign cost, what it produced, which way the trend is moving. The platforms compute it across many people before you see it, which is why it rarely carries PHI.

• Google Ads. The official server's search tool runs GAQL. A query on the campaign resource selecting metrics.cost_micros, metrics.clicks and metrics.conversions, segmented by segments.week, is allowed-tier.
• Meta Ads. The performance insights tools in Meta's ads MCP server return the same kind of campaign-level numbers.
• Your tracking layer. Weekly conversion totals per campaign, not a list of conversion events.

Three details keep a figure in this tier:

• Grain. Campaign and week or coarser. No ad group by day, and no postal code, location, age or gender cuts (GAQL offers segments.geo_target_postal_code on the campaign resource, plus geographic_view, age_range_view and gender_view). One Tuesday conversion for a campaign aimed at a single ZIP code discloses far more than a quarterly total.
• Small numbers. Google's server returns whatever count GAQL computes, including a 1. For a campaign with single-digit weekly conversions, ask for 4- or 13-week totals. HIPAA recognizes Safe Harbor and Expert Determination, not "we added it up." Suppression for marketing counts is covered in De-Identified MCP Answers: How Small-Group Rules Work.
• Names. A campaign called "PrEP returning patients" tells the model a patient list was used for targeting. Rename any campaign, audience or conversion action that describes a patient population or service line. Curve's neutral event aliases already send the ad platform a neutral event name instead of the service line, so tracked conversions arrive with nothing to rename.

Conditional: search terms and audiences

Both are too useful to ban and too risky to connect unconditionally.

Search terms

The search terms report feeds negative keywords, the tedious sorting an assistant does well. It is also made of text typed by the public. Google calls it "a list of search terms that a significant number of people have used" and omits low-volume terms for privacy, but that threshold is about Google's search volume, not your clinic's conversion counts. A common query can still name a drug or a symptom beside a small conversion count, and text from strangers inside a tool result is raw material for prompt injection.

The conditions:

• One job: negative keyword and match type decisions, each approved by a human (strategy in negative keyword strategy for healthcare).
• Never joined to person-level data, or to conversions below campaign level.
• Theme-level outputs, not verbatim terms, in anything shared onward.
• A separate session with no CRM or other client context, so a planted instruction has nothing sensitive to reach.

Google's server will not enforce any of this: its search tool passes any GAQL query, search_term_view included. Because it is open source and self-hosted, an engineer can put a query allowlist in front of it; otherwise enforcement is your policy and your review.

That allowlist matters beyond search terms. The same tool reaches never-tier data in the same account: lead_form_submission_data returns lead form answers, local_services_lead returns a lead's contact details, and local_services_lead_conversation returns message text and call recording URLs. If the account runs lead form assets or Local Services Ads, the connector needs a query allowlist or it is not an allowed-tier source. Full setup: Claude and Google Ads for Clinics: A PHI-Safe MCP Setup.

Audiences

Metadata (name, type, approximate size, which campaigns use it) can be conditional. Membership, the emails and phone numbers behind a customer list, is never. The live risk is the write path: Meta's server can create and update custom audiences, so an assistant that can also reach a CRM could move a patient list into Meta.

Google bars Customer Match, your data segments, audience expansion and lookalikes for health, a sensitive interest category, and Meta's terms bar health information.

The conditions:

• Metadata only, with audience names cleaned first.
• No audience writes. Meta lets you restrict an agent to read-only, approval-required or full access, per asset or in bulk. Choose read-only.
• An audience built from patient records is a compliance finding, not a prompt. Audit it with customer list uploads: a health privacy risk audit.

Never: records that exist to describe a person

These sources are records of individuals by design: who they are, what they said, what they clicked. No condition makes them safe for a vendor without a BAA, because summarizing them means reading them.

• Contact records. GoHighLevel's v1 tools include contacts_get-contact, and its v2 execute_operation tool runs whatever the granted OAuth scopes allow. HubSpot's Sensitive Data setting, on Enterprise plans, blocks activity and conversation data from its MCP server, but contacts remain readable. At a clinic, a name tagged "consult booked" is already health-adjacent. See GoHighLevel MCP for Clinics: Locking Down Contact Data.
• Form responses. In the form builder, the CRM's submission records, the intake tool or Google Ads lead forms. A consultation form is often the most explicit health statement a patient ever gives your marketing stack.
• Call transcripts and messages. GoHighLevel's v1 tools include conversations_get-messages and calendars_get-appointment-notes, and conversations_send-a-new-message lets the connector reply. On the phone, people give their symptoms, medications and dates of birth.
• Raw event streams. One row per visit from one browser: a timestamp, a page, often a click ID, sometimes an IP address. Dates, URLs and IP addresses are all on HIPAA's Safe Harbor identifier list. "Anonymous" event data is a record about a person nobody has looked up yet.

How Curve MCP enforces the allowed tier

Policies that rely on memory drift; a server whose only possible answers sit in the allowed tier does not. Curve built its MCP server that way, on top of its server-side tracking, and it works with any MCP client: Claude (desktop, web or Claude Code), ChatGPT, Cursor or another agent. It has three read-only tools and no write actions: one describes what it can and cannot return, one returns KPIs, and one hands person-level questions back to the product.

Allowed tier, by construction:

• Organization-level KPIs. Visitors, sessions, goal completions and funnel steps.
• Server-side campaigns, reconciled. Each campaign's platform-reported spend, clicks and impressions sit next to the conversions Curve's server-side tracking recorded on last touch, with cost per conversion by completed week. One link opens the full sent, accepted and matched view inside Curve.
• Completed weeks. Last week or the last 4, 13 or 52 weeks, as totals plus a week-by-week series. The current week is never included.
• People, not visits. Counts are distinct people across the window. Small groups are withheld, counts and spend are rounded, cost per conversion uses the rounded figures, and a number that would reveal a small group by subtraction is withheld.
• Approved names only. A goal, funnel or campaign name the clinic has not approved reads "(label hidden)", and its numbers still show.

Conditional tier, left out:

• No search terms or audiences. It returns no revenue, ROAS, search terms or audiences, and no breakdown by channel, device, region or page, so conditional-tier work stays in the ad platforms with a human reviewing.
• No visitor-set strings. Inputs are fixed choices, and no string a visitor can set (UTM values, page paths, referrers) comes back. That keeps out PHI-shaped text and planted instructions alike.

Never tier, unreachable:

• A database role blind to it. The service's own role cannot read contact details, form answers or journeys, and it verifies this every time it starts.
• A guard that fails closed. Anything shaped like an email, phone number, ID, date or name blocks the whole answer; nothing is scrubbed and sent. If the guard cannot run, nothing is returned.
• Person-level questions leave the chat. "Which patients came from the spring campaign?" gets no data, only a single-use link that opens Curve Analyst behind a login. The link expires quickly and carries nothing itself.

Access controls. MCP is a per-user switch, off by default, and only the clinic's primary user can turn it on for the organization. Tokens are scoped and expire, issuing one needs a confirmation code, and admins are notified. Every call is logged, and no data is returned if the log cannot be written.

The model is still a vendor you choose: Curve's BAA covers the tracking platform, not the AI provider, which is why the server releases only numbers built to be safe to hand over.

Putting the policy in writing

Keep the written version to one page:

• A connector register. Every MCP server in use, the accounts it reaches, its tier and who approved it. Include personal Claude plans, because that is where unapproved connectors live.
• Named roles, re-checked quarterly. Who may use each tier, and a quarterly re-check of the register. Tool lists change: Meta's server added rules management in July 2026.
• Controls at the source. The MCP specification treats tool annotations such as readOnlyHint as untrusted hints and says a human should always be able to deny a tool call. Set agent permissions in the ad platform, and never auto-approve.
• Copy and paste covered. Banning a CRM connector while allowing a pasted lead export bans nothing, for the reasons in why you cannot paste your patient funnel into ChatGPT.

Frequently asked questions

Can a clinic connect Claude to Google Ads without a BAA?

Yes, for campaign-level aggregates, and only because nothing in that tier should be PHI. Google does not sign a BAA for its advertising products, and Anthropic's BAA does not cover connector traffic. The catch is reach: the official server's search tool runs any GAQL query, including search terms and, if you use lead form assets or Local Services Ads, lead form answers and lead contact details. Connect it behind a query allowlist, or only to accounts that use neither.

Who should own this allow/deny policy?

Split it. Whoever holds HIPAA privacy and security duties at the clinic owns the tiers and signs the page. Whoever runs the ad accounts, in-house or at an agency, keeps the connector register current but cannot move a source up a tier. If an agency runs your accounts through its own assistant, put the tiers in its contract.

What do we do when someone needs data outside the allowed tier?

Answer it where the data already lives. "Which leads from the spring campaign booked?" belongs in the CRM, worked by staff who already have access, not in a chat. A conditional-tier need gets a written exception naming the source, the one job, the person and an end date. Nothing in the never tier gets an exception. Curve MCP takes the same route automatically.

Can we use the GoHighLevel or HubSpot connector just for reporting?

Not safely. The connector does not know your question is about reporting. It returns whatever objects its scopes reach, and in a clinic CRM that means contact records. Pull reporting numbers from the ad platforms or your tracking layer instead.

Does Curve MCP show Claude which patient converted?

No. It returns organization-level counts, spend and cost per conversion for completed weeks. A person-level question gets a single-use link into Curve Analyst behind a Curve login, and the link carries no data.

Where to start

1. List every MCP connector and AI integration in use, including on personal plans, and put each one in a tier.
2. Disconnect anything in the never tier today and revoke its tokens. Closing a chat does not revoke access.
3. Set Meta agent access to read-only, and limit Google Ads access to the accounts that need it.
4. Check what your website already sends the ad platforms, because an assistant reading them sees the conversion and event names your tracking created there. Curve's free compliance scanner checks your site's tracking.
5. For the allowed tier, book a demo of Curve MCP to see weekly spend, conversions and cost per conversion answered in Claude, ChatGPT or any other MCP client. The tracking platform behind it is at curvecompliance.com.

Reviewed September 2026. MCP server capabilities for Google Ads, Meta, GoHighLevel and HubSpot, and the scope of Anthropic's BAA, reflect each vendor's public documentation as of that month.