Hyros vs Triple Whale vs Northbeam for Telehealth

For a telehealth brand, Hyros, Triple Whale and Northbeam differ in who they are built for, but none of the three is set up for patient health data: each vendor's own terms keep it out, Triple Whale's unless it gives prior written consent (Hyros; Triple Whale; Northbeam), so none fits the intake, booking and checkout pages where health information shows up. Curve Compliance covers those pages: it signs a BAA on every plan, strips PHI before data reaches an ad platform, and sends conversions server-side to Meta, Google Ads and other ad platforms, with setup done by Curve's team.

Book a call. Running Hyros, Triple Whale or Northbeam on a telehealth funnel? Curve's team will look at what your site sends to Meta, Google and TikTok with you and map your key conversions onto a setup under a BAA. Book a call with Curve.

The short answer, in each vendor's words

What each vendor's own pages say, opened October 26, 2026:

Vendor	Built for, in its words	What it says about health data	Source
Hyros	"high-spend direct-response advertisers" (Hyros)	Customers must not process PHI; "Company does not enter into Business Associate Agreements for the Services"	Terms, 9.1.19; Trust Center
Triple Whale	"the AI operating system built for modern commerce" (Triple Whale)	Platform is "not intended for the processing of Sensitive Data," a term whose definition lists "health information," without "explicit prior written consent"; no mention of HIPAA or a BAA	DPA, 1.1(m) and 2.5; Trust Center
Northbeam	"The marketing intelligence platform for profitable growth" (Northbeam)	Customer "shall not store, or process" health information as HIPAA defines it; no mention of a BAA	Terms, 3.2

For one vendor at a time, see Curve's guides: is Hyros HIPAA compliant, switching from Triple Whale and switching from Northbeam.

What their terms say about patient data

Hyros

Hyros's terms, last revised July 1st, 2026, say customers must not "submit, transmit, store, disclose, or otherwise process PHI through the Services" and that "the Services are not designed for the processing of PHI" (Hyros terms, section 9.1.19). Its trust center adds: "Hyros is not HIPAA-certified and cannot enter into Business Associate Agreements (BAAs)" (Hyros Trust Center).

Triple Whale

Triple Whale's terms of service, privacy notice, trust center and DPA do not mention HIPAA or business associate agreements. The Data Processing Addendum defines "Sensitive Data" with a list that includes "financial, credit, genetic, biometric or health information." Section 2.5 says the platform and services "are not intended for the processing of Sensitive Data," and that a customer who wants to process it "must first obtain Triple Whale's explicit prior written consent and enter into any additional agreements as required by Triple Whale" (Triple Whale DPA).

Northbeam

Northbeam's terms, last modified March 5, 2026, say "the Company Solution is not designed to host, process, or store Sensitive Personal Information" and that the customer "shall not store, or process Sensitive Personal Information in the Company Solution, including but not limited to Personal Health Information, as defined by the Health Insurance Portability and Accountability Act" (Northbeam terms, section 3.2). They do not mention a BAA.

Cometly

Cometly's terms, last updated October 23, 2026, bar data "subject to heightened legal or regulatory protections (e.g., health information governed by HIPAA, payment card data governed by PCI-DSS)" unless the customer has "obtained our prior written consent and implemented any additional required safeguards." The same section adds: "Under no circumstances shall you use these Events (or any other feature of the Cometly platform, including AI Chat) to collect or track: Health Information protected under any applicable data protection or healthcare law (e.g., HIPAA in the United States)" (Cometly terms, section 8.1; Directory entry).

None of the three lists HIPAA among its compliance frameworks. Hyros's trust center lists CCPA, EU AI Act, EU-US DPF, GDPR, SOC 2 Type 2 and SOC 3 (Hyros). Triple Whale's lists CCPA, GDPR, SOC 2 Type 1 and Type 2, SOC 3, three Data Privacy Framework listings and Standard Contractual Clauses (Triple Whale). Northbeam's security page says "Northbeam is certified SOC 2 compliant" (Northbeam).

The four vendors make the same point in different words: patient health information is not meant to enter these tools. Whether HIPAA applies to your program, and which of your pages carry health information, depends on your setup; talk to your counsel. Cash-pay programs can start with does HIPAA apply to cash-pay telehealth.

How each one collects data

Each starts with a script on your site, joins what it sees to sales or orders, and sends results back to ad platforms. In each vendor's words:

Vendor	On your website	Other data it joins	What goes back to ad platforms
Hyros	A pixel with a "Device fingerprint" that "Recognizes real buyers across devices and sessions" (Hyros)	"Your first party historic data," "3rd party live data" and patterns from its network (Hyros)	"We FEED this data back to your ad platforms." (Hyros)
Triple Whale	The Triple Pixel builds "a unique anonymous identity of each visitor" (Triple Whale Help Center)	Data from your "connected ecommerce platform"; shopper data can include "product views, page interactions" and "order information" (Sonar Optimize 101; Trust Center)	Enriched conversion events sent "through their Conversions APIs" (Sonar Optimize 101)
Northbeam	The pixel collects "Marketing touchpoints & Pages visited" (Northbeam docs)	Order data from Shopify or your order feed, used as "the source of truth" (Northbeam docs)	Apex "sends the Northbeam-attributed performance for each ad to the partner platform" (Northbeam Apex)

On a telehealth site, the page a visitor reads, the product they view and the item they order can each name a condition, a treatment or a prescription.

Why a telehealth funnel is different

For a HIPAA covered entity, HHS's tracking bulletin says user-authenticated pages, "such as a patient or health plan beneficiary portal or a telehealth platform," generally give tracking technologies access to PHI. Tracking on a page that "permits individuals to schedule appointments or use a symptom-checker tool without entering credentials may have access to PHI in certain circumstances," and a tracking vendor that handles PHI for a covered entity needs a BAA (HHS bulletin). A June 20, 2024 court order vacated one part of the bulletin, about IP addresses on public pages that address health conditions (HHS, note at top).

Meta says the information it does not permit businesses to share "includes health information," names "Prescription medications" and "Medical procedures, treatments and testing" as examples, and warns that "UTM parameters in a URL string may contain prohibited data from the landing pages viewed" (Meta Business Help). It lists a "telemedicine platform" and a "pharmacy" as examples of its health and wellness data source category, and says "Certain data source categories may have additional data sharing restrictions" (Meta Business Help).

Shopify's Acceptable Use Policy says "certain business activities are not supported by our platform, such as uploading Protected Health Information subject to HIPAA" (Shopify; see does Shopify sign a BAA), and both Triple Whale and Northbeam read order data from connected stores such as Shopify (Triple Whale; Northbeam). Selling prescriptions online? See Curve for online pharmacies.

Which one fits a telehealth brand

On their own descriptions, Hyros fits "high-spend direct-response advertisers" (Hyros), with setups for e-commerce stores, SaaS, courses and coaching, and "Booked calls and closed deals" (Hyros). Triple Whale fits commerce brands that want "Attribution, MMM, and Incrementality working together" (Triple Whale). Northbeam fits brands that want multi-touch attribution built on their own order data (Northbeam). For a telehealth brand, the question comes down to pages. Intake, eligibility, booking, checkout and logged-in pages are where health information shows up and where your most valuable conversions happen, so that part of the funnel is where a conversion tool that signs a BAA belongs.

That tool should send conversions server-side instead of through browser pixels, use neutral event names, check events for PHI before anything reaches an ad platform, and credit bookings made in other tools back to the ad. See measuring ads without tracking pixels and which ad platforms sign a BAA.

Switching from Hyros, Triple Whale or Northbeam

Curve has a step-by-step guide for each move: switching from Hyros, switching from Triple Whale, switching from Northbeam and switching from Elevar. Each covers what carries over, the switch itself, running both tools side by side without sending a conversion twice, and which reports to compare. For a ranked list of tools that sign a BAA, see the best HIPAA compliant attribution software for healthcare.

How Curve Compliance helps

Curve Compliance handles the conversions a telehealth funnel cares about, under a BAA. One script replaces browser ad pixels, and conversions go server-side from Curve's servers to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives a fixed list of fields, events can use neutral names, and contact identifiers are off by default on Meta, Google Ads and TikTok. Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform, and Event Logs show what Curve sent to each platform and what it accepted.

Attribution holds when a patient books in IntakeQ, Calendly, Acuity, Jane App or another supported scheduler, even days later. Outcomes from booking systems, CRMs, call tracking and EHRs come back through incoming webhooks, Keragon or offline uploads, each credited to the original ad click. Campaign Reporting puts Meta and Google Ads spend next to those conversions, with five attribution models.

Curve signs a BAA on every plan and is SOC 2 Type II. Curve's team does the setup, and customers are typically live in about a week, depending on the funnel. See Curve for telehealth.

Sources, checked October 26, 2026: Hyros terms, Trust Center, homepage, swarm data and Hyros vs Triple Whale; Triple Whale terms, privacy notice, DPA, Trust Center, homepage, Triple Pixel and Sonar Optimize 101; Northbeam terms, homepage, data security, What is Northbeam?, data sources and Apex; Cometly terms; HHS tracking bulletin; Meta Business Help on prohibited information and data source categories; Shopify Acceptable Use Policy.

Frequently Asked Questions

Hyros vs Triple Whale: which is better for a telehealth brand?

By their own descriptions, Hyros suits direct-response funnels and Triple Whale suits commerce brands, but neither is designed for patient health data: Hyros's terms bar PHI, and Triple Whale's DPA requires its prior written consent before sensitive data, a category that lists health information, is processed (Hyros; Triple Whale). On intake, booking and checkout pages, use a conversion tool that signs a BAA, such as Curve Compliance.

What do Hyros, Triple Whale and Northbeam say about patient health data?

All three keep it out: Hyros and Northbeam bar it in their terms, and Triple Whale's DPA requires its explicit prior written consent first (Hyros; Northbeam; Triple Whale). Curve's guides on Hyros, Triple Whale and Northbeam cover each one.

How do Hyros, Triple Whale and Northbeam collect data?

Each runs a script on your site and joins it to sales or orders: Hyros adds historic, third-party and network data (Hyros), the Triple Pixel builds "a unique anonymous identity of each visitor" (Triple Whale), and Northbeam's pixel records touchpoints and pages visited alongside your orders (Northbeam).

Can a telehealth brand use Triple Whale or Northbeam on its Shopify store?

Their terms point them at data without patient health information, and Shopify's Acceptable Use Policy says uploading PHI subject to HIPAA is not supported on its platform (Shopify). Send intake, booking and checkout conversions through a tool that signs a BAA.

What is the best Hyros or Triple Whale alternative for telehealth?

A conversion tool that signs a BAA. Curve Compliance signs one on every plan, sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn, strips PHI before data reaches an ad platform, and credits bookings in tools like IntakeQ and Calendly back to the ad.

Does Curve Compliance sign a BAA?

Yes. Curve signs a BAA on every plan (why Curve includes a BAA with every account).

How long does it take to switch from Hyros, Triple Whale or Northbeam?

Curve's team does the setup, and customers are typically live in about a week, depending on the funnel. Run both tools side by side for at least one full customer journey, as the Hyros, Triple Whale and Northbeam guides explain.

Talk to Curve Compliance

Book a call. Bring your Hyros, Triple Whale or Northbeam setup, and Curve's team will map your conversions onto server-side tracking under the BAA Curve signs on every plan, with PHI stripped before data reaches an ad platform. Book a call with Curve.