Consent Management Built for Healthcare Privacy Laws
Curve Compliance provides consent management for healthcare websites: it applies the right rule for each visitor's region, shows a banner where opt-in is required, records every decision, and holds back tracking and ad forwarding for visitors who have not allowed it.
Implement in days, not weeks. Scale Google and Meta ads. No engineering team required.
- SOC 2 Type II
- HIPAA Compliant
- US Hosted
Healthcare Consent Management That Gates Tracking
Rules by Region
Washington, Nevada, EU member states and countries outside the US start as opt-in, so non-essential tracking waits until the visitor accepts. California and the other US states start as opt-out. Every US state has its own row you can switch.
Append-Only Audit Log
Every accept, decline, change and withdrawal is recorded with the banner version the visitor saw, in an append-only log you can filter and export as CSV.
Consent That Gates Tracking
Analytics consent gates event collection, session recordings and heatmaps. Advertising consent gates click IDs and forwarding to ad platforms, and every skipped send shows in Event Logs as Skipped No Consent.
How It Works
Set Your Rules
Decide with your legal or privacy contact which regions need opt-in. Under Jurisdiction Settings, switch any US state between opt-in and opt-out, or turn the consent flow off for it.
Choose How the Banner Shows
Show the banner to every visitor, only where consent is legally required (recommended), or never, if you run your own consent tool and pass its choices to Curve. In the recommended mode, opt-out visitors get a small Privacy choices control.
Enforce and Audit
Curve Compliance holds back tracking and ad forwarding until each visitor's choice allows it, treats Global Privacy Control as a decline of advertising, and records every decision for your audit log and consent analytics.
Three Banner Modes
Pick the display mode that fits your site. Curve Compliance's recommended mode shows the banner only where consent is legally required and gives opt-out visitors a small Privacy choices control. Already run OneTrust, Cookiebot or another consent tool? Keep it, and pass its choices to Curve.
- Banner for visitors in opt-in regions
- Privacy choices control in opt-out regions
- Works with your existing consent tool
- Banner version stored with each decision
- Show to Every VisitorA banner in every region, until they decide
- Only Where RequiredRecommended: a banner in opt-in regions only
- Never Show Curve's BannerFor sites that run their own consent tool
Jurisdiction Settings
Each visitor's region gets one of two rules. Opt-in regions keep non-essential tracking blocked until the visitor accepts. Opt-out regions allow tracking until the visitor declines. Global Privacy Control is honored in every region.
- Opt-in: Washington, Nevada and EU member states
- Opt-in: countries outside the US and EU
- Opt-out: California and the other US states
- Switch any state, or turn the flow off for it
- Global Privacy Control honored everywhere
- WAWashingtonOpt-in
- NVNevadaOpt-in
- CACaliforniaOpt-out
- EUEU Member StatesOpt-in
Audit Log and Consent Analytics
Every decision is recorded with the banner version the visitor saw. Filter the append-only log, export it as CSV, and track acceptance rates by region and over time.
- Accept, decline, change and withdraw recorded
- Banner version stored with each decision
- Filter and export as CSV
- Acceptance rates by region and over time
- Audit LogAppend-Only
- ExportCSV
- Acceptance RatesBy Region
A Cookie Banner Is Not a HIPAA Authorization
HHS guidance on online tracking technologies is clear on this point: a website banner that asks visitors to accept or reject cookies or other tracking does not count as a valid HIPAA authorization. Patient consent on a website covers privacy-law choices. On its own, a banner click does not authorize sharing protected health information with an ad platform.
So a healthcare website needs both. Curve Compliance's consent management applies each visitor's choice, and Curve's server-side tracking sends each ad platform only a fixed list of fields, flags PHI-like patterns such as condition names and emails in URLs, and works under a BAA signed on every plan. Whether your site needs a banner depends on where your visitors are and which laws apply to you, so settle that with your legal or privacy contact, and Curve Compliance enforces what you decide.
To see which pixels and trackers run on your pages today, start with Curve Compliance's free website scan.
Healthcare Consent Management Questions
What is the best consent management for healthcare websites?
Look for consent management that applies the right rule for each visitor's region, records every decision, and actually holds back tracking and ad forwarding until a visitor allows it. Curve Compliance does all three: opt-in and opt-out rules by region with a row for every US state, an append-only audit log you can export as CSV, and consent that gates event collection, session recordings, heatmaps and ad forwarding.
Is a cookie banner a HIPAA authorization?
No. HHS guidance on online tracking technologies says a website banner that asks visitors to accept or reject cookies or other tracking is not a valid HIPAA authorization. Curve Compliance's consent management handles privacy-law choices, and its server-side tracking keeps form answers, page titles and free text out of what reaches ad platforms, under a BAA signed on every plan.
What does Curve Compliance's consent management block?
The banner has two categories. Analytics gates event collection, session recordings, heatmap capture and the session and UTM context that follows a visitor between pages. Advertising gates click IDs and forwarding to ad platforms. When a visitor declines advertising, Meta and TikTok receive the event with contact fields removed and marked as limited use, GA4 receives it marked as consent denied, and Google Ads click conversions, Microsoft, LinkedIn and Premion are not sent at all.
Can I keep OneTrust or Cookiebot with Curve Compliance?
Yes. Choose Never show Curve's banner, and have your web person wire your existing consent tool to Curve Compliance so your visitors' choices are passed through. Curve's team gives them what to call.
Where can I see who accepted or declined?
On the Consent Management screen in Curve Compliance. Every accept, decline, change and withdrawal is recorded with the banner version the visitor saw, in an append-only audit log you can filter and export as CSV. Consent analytics show acceptance rates by region and over time.
Consent Management That Keeps You Compliant
Jurisdiction-aware. Fully auditable. Built for healthcare.
- Signed BAA included
- Live in ~7 days
- No engineering lift