GLP-1 Quiz Funnels: Where the Compliance Risk Sits

In a GLP-1 quiz funnel the compliance risk sits mostly in the tracking layer rather than in the questions themselves, because answers routinely reach ad platforms and analytics vendors through URLs, query parameters, event payloads, and session recording long before anyone in the company decides to share them. The secondary risk is claim risk in the framing, especially on qualification and result screens. Curve is the HIPAA-compliant tracking layer built to keep quiz data out of ad platforms while preserving attribution, with a signed BAA on every plan.

Why quizzes concentrate risk

A quiz funnel exists to collect exactly what HIPAA cares about. Height, weight, BMI, medical conditions, current medications, pregnancy status, prior GLP-1 use. It then attaches an email address and a phone number, which turns a set of health answers into a set of health answers about a named person.

Every other page on your site is a page view. The quiz is a clinical intake wearing a marketing costume, and it is usually built by the growth team on marketing infrastructure with marketing tooling attached. That mismatch is the whole story.

Where quiz answers actually leak

Six mechanisms account for nearly everything found in an audit. None require anyone to intend a disclosure.

Answers in the URL

Multi-step quizzes commonly encode state in the address bar, either as a path segment or a query string. A step named for a condition, a parameter carrying a selected medication, or a result URL naming the recommended program all become the page URL. Every analytics or advertising tag on that page sends the page URL as a matter of course. Nobody chose to transmit the answer, and the answer went anyway.

Event payloads with answer values attached

Naive instrumentation fires a conversion event per step and passes the selection as a parameter or custom property because that is the useful thing to know. The result is a stream of events describing one person's clinical answers, sitting in an ad platform interface.

Automatic form and click capture

Several analytics and heatmap tools capture form interactions or click text by default. On a quiz, click text is the answer. Teams enable this once for a checkout flow and forget it applies site-wide.

Session recording without controls

A recording of a quiz session is a video of someone disclosing their medical history. Recording is genuinely useful on these funnels, which is why the answer is not to ban it but to run it under a signed BAA with masking and PHI detection rather than through whatever tool the growth team already had.

Third-party quiz builders and embedded widgets

Many quiz platforms, chat widgets, scheduling embeds, and form tools receive the answers as a matter of function. The question is not whether they receive the data but whether they have signed a BAA to hold it. Most consumer-grade marketing tools have not, and the sales team saying they are HIPAA-friendly is not the same as an executed agreement.

The handoff to intake

The quiz usually ends by passing the visitor to a separate intake, booking, or telehealth platform. Teams preserve attribution across that jump by appending parameters to the destination URL, and the fastest thing to append is the answer set. That URL then appears in the destination system's own analytics, its referrer headers, and any tag on the destination page.

The vendor question underneath all six

Meta and Google do not sign BAAs for their advertising products. That single fact resolves most of the debate about which quiz data is acceptable to send. It is not a question of whether a specific field looks clinical. An identifiable person plus an inference about their treatment interest is the disclosure, and the pixel makes it identifiable by design, because a durable browser identifier is what it exists to set.

This is the mechanism behind healthcare pixel litigation with settlements cumulatively past $100 million, and it is separate from the FDA question about claims. Enforcement exposure runs in parallel too: OCR civil monetary penalties were restructured effective 28 January 2026, running from $145 to $2,190,294 per violation category per year. Our piece on whether the Meta Pixel or Conversions API can be made safe works through the distinction properly.

Claim risk in quiz framing

The second risk is what the quiz says rather than what it transmits. Quiz copy is promotional communication, and the FDA reads promotional communications broadly. That matters given the 30 warning letters sent to telehealth companies over compounded GLP-1 claims on 3 March 2026 and the 25 sent during the week of 15 June 2026.

Three framing patterns come up repeatedly.

• Qualification language that reads as a clinical determination. "You qualify" or "you are a candidate" on a screen that appears before any clinician has seen the answers implies a medical judgment the software did not make. Say what actually happened: the responses will be reviewed by a licensed clinician who decides whether treatment is appropriate.
• Result screens carrying outcome claims. A projected weight loss, an expected timeline, or a personalised figure derived from the answers is a specific claim needing substantiation for the product you dispense. Compounded GLP-1 products are not FDA-approved drugs, so the approved brand's trial results do not supply that substantiation.
• Equivalence smuggled into question text. Asking "have you tried the brand-name version of this medication before" positions your compounded product as a version of an approved drug. The claim lives in the question, which is why claim review that covers only the landing page keeps missing it.

Review the quiz with the same rubric you apply to ad copy, screen by screen, including the screens most respondents never reach.

What a safer quiz architecture looks like

The fix is architectural, and it is mostly about deciding what is allowed to leave rather than trying to scrub things afterwards.

1. Keep answers out of the address bar. Use step numbers or opaque identifiers in URLs and hold state server-side or in memory. This one change removes the largest leak on most funnels.
2. Instrument steps by position, not by content. A step-three-completed event tells you where people drop without telling anyone what they answered.
3. Default to sending nothing, then map fields deliberately. An allowlist survives a redesign. A blocklist does not, because the next new field is not on it.
4. Inventory every script on the quiz path. Chat widgets, A/B testing tools, heatmaps, tag managers, ad partner tags added for a campaign that ended. Ask for each one whether a BAA is executed, and remove it from the quiz path if not.
5. Fix the intake handoff with a token, not with data. Pass an opaque attribution token across the boundary so the clinical answers never travel in a URL, and match the outcome back afterwards.
6. Send ad platforms a conversion, not a description. A neutral conversion name, hashed identifiers, and nothing else. That is enough for optimization and carries no clinical inference.

Our guide to GLP-1 landing pages that convert without collecting PHI covers the page the quiz sits on, and routing ad clicks to a CRM without PHI covers what happens after the submit.

How Curve handles quiz funnels

Curve is HIPAA-compliant ad tracking, attribution, and analytics for healthcare. It replaces client-side pixels with a server-side path, so the decision about what leaves happens on infrastructure you control rather than in a browser tag you do not.

• Server-side collection. The Curve script installs in place of the Meta Pixel and Google tag. Quiz events reach Curve's US-hosted infrastructure instead of going straight to ad platforms.
• Per-destination field mapping. Only explicitly mapped fields forward to a given destination, and the default is that nothing goes. Answer values, medication-naming URLs, and free-text fields stay behind unless someone deliberately maps them.
• Neutral event aliases. The ad platform receives a neutral conversion name rather than the service line or the quiz outcome, so the ad account never becomes a list of who was interested in what.
• Identifier hashing. Email, phone, and name are SHA-256 hashed to each platform's conversion API requirements before anything is sent.
• Bridge tokens. Attribution survives the handoff into a separate intake or booking tool such as IntakeQ, Calendly, or Jane App, so you do not need to smuggle answers through a URL to keep the chain intact.
• Incoming webhooks. Downstream systems report outcomes back and are matched by email, click ID, or bridge token, and incoming data cannot override protected core attribution and contact fields.
• Offline conversion uploads. Bulk upload from a CRM or EHR with click-ID matching, up to 10,000 rows per file, so you can optimize toward patients who actually start treatment rather than toward quiz completions.
• PHI-pattern detection. A monitoring layer that flags PHI-shaped values such as SSNs, MRN-style identifiers, dates, and long numeric sequences. It is how you learn a quiz field changed shape after a redesign. Protection itself comes from field mapping plus hashing, not from detection.
• Session recording under a BAA. Recording and heatmaps on the quiz path stay available without handing the session to a vendor with no agreement in place.

Clean conversions forward server-side to Meta CAPI, Google Ads Enhanced Conversions, TikTok Events API, Microsoft, LinkedIn, and GA4, and a signed BAA is included on every plan.

Frequently asked questions

Is a pre-qualification quiz PHI if no treatment is prescribed?

Individually identifiable health information held by a covered entity or its business associate is protected, and a prospective patient's answers about conditions and medications generally qualify once they are tied to identity. The prescription is not the trigger. Treat the answers as protected from the first screen.

Can we track quiz completion in Meta at all?

Yes, as a neutral conversion event with hashed identifiers and no answer content, sent server-side. What you cannot safely do is send the answers, the medication-naming URL, or an event name that describes the treatment.

Our quiz builder says it is HIPAA compliant. Is that enough?

Only if there is an executed BAA covering the specific product tier you are using, and only if the tool is not itself loading third-party tags on your quiz pages. Marketing claims about compliance are not agreements, and a compliant vendor with a non-compliant tag stack still leaks.

Should we drop session recording on the quiz?

Not necessarily. Recording is where funnel problems become visible. Run it under a BAA with masking and PHI detection rather than through a general-purpose tool with no agreement, and treat recordings as records subject to access controls.

How do we keep attribution when the quiz hands off to an intake platform?

Pass an opaque token across the boundary and match the outcome to it later. That is what Curve's bridge tokens do, and it removes the temptation to append answers to the destination URL for the sake of continuity.

Does a consent banner solve this?

Consent management is worth having and does not by itself authorise disclosing treatment interest to a vendor with no BAA. Consent governs cookies and preferences. The BAA question governs whether that vendor may hold protected information at all.

Where to start

Open your quiz in a browser and watch the network tab through every step. Write down each domain receiving a request, and for each one, whether a BAA is executed. Then read the address bar at every step and ask whether a stranger reading that URL would learn something clinical about the person. Those two passes surface the majority of what an audit would find.

Then fix the architecture rather than patching fields. Curve gives you server-side collection, per-destination field mapping, hashed identifiers, neutral event aliases, bridge-token attribution, webhook and offline conversion matching, and session recording under a signed BAA, so a quiz funnel can be measured properly without disclosing who answered what. Run the free compliance scanner against your quiz path, or visit curvecompliance.com and we will review it with you.

Reviewed August 2026. This is general information, not legal or regulatory advice. FDA positions, HIPAA enforcement, and platform policies change; consult qualified counsel about your specific funnel.