Privacy-First Web Analytics for Healthcare
Curve Compliance is HIPAA-compliant web analytics for healthcare, with a BAA signed on every plan. See how patients find your site, which sources and channels bring them in, and which visits lead to a booking, with goals, funnels and four attribution models built in.
Implement in days, not weeks. Scale Google and Meta ads. No engineering team required.
- SOC 2 Type II
- HIPAA Compliant
- US Hosted
Analytics Built for Healthcare
The Path to a Booking
The Overview counts the visitors who landed, engaged, started and converted, with a live visitor count, landing pages and key actions. Once 30 people have converted in the range, Time to convert and Before they converted appear too.
Goals and Funnels
Track goals as a page visit or an event, and build funnels of two to ten steps, such as a service page, the booking page and a booking. A funnel counts a visitor who finishes every step within 24 hours of the first.
Attribution Under Four Models
Credit your primary conversion to the sources, channels and campaigns that brought people in, under Last Touch, First Touch, U-Shaped or Assisted. Each model looks back 90 days from every conversion.
How It Works
One Script, Set Up for You
Curve's team installs the Curve Compliance script on your site and signs a BAA with you, typically live in about a week. Page views, sources, UTM values, devices and places then flow into the Analytics tab.
Privacy Rules Applied in the Browser
Before a page address leaves the browser, the script redacts the parts that look like contact, health, search or quiz data. With Curve's consent management on, analytics waits for each visitor's choice where opt-in is required.
Reports Your Team Can Act On
Pick a primary conversion such as a booking, compare First Touch with Last Touch, click any row to filter by it, and compare against the previous period or the same period last year.
Every Source and Channel, Paid and Unpaid
Curve Compliance's analytics are built on first-party data, the visits to your own site, so they count organic and other unpaid visits as well as ad clicks. The Sources breakdown lists Google Ads (paid Google clicks) apart from Google (organic search and other unpaid Google traffic), and Channels groups visits under labels such as paid social, paid search and organic search.
- Trend, pages, channels, sources and UTM values
- Devices and places
- Click any row to add it as a filter
- Compare with the previous period or last year
- All time reaches back about 24 months
- Attribution Models4
- Lookback90 Days
- Funnel Steps2 to 10
Meta First or Google First?
Set the booking as your primary conversion, open the Sources breakdown and compare First Touch with Last Touch. First Touch shows where people who booked arrived from first. Last Touch shows where they came from right before booking, and a line tells you how many conversions changed channels between the two.
- Last Touch: the visit right before the conversion
- First Touch: the earliest visit in the 90 days before it
- U-Shaped: 40% each to first and last, 20% shared between
- Assisted: every channel that took part
- Choose the ConversionSet the booking as your primary conversion
- Open SourcesSee Google Ads, Google, Meta and more side by side
- Switch ModelsCompare First Touch with Last Touch
- Read the ChangeSee how many conversions changed channels
Session Recordings and Heatmaps Under the Same BAA
Session recordings replay a visit with your Curve events marked on a timeline, and heatmaps lay clicks, scroll depth or mouse movement over a screenshot of the page, per device. What a visitor types into a form field is masked automatically, and every play is logged.
- Form fields masked in every recording
- Hide any part of a page with the ct-block class
- Clicks, Scroll and Move heatmaps for desktop and mobile
- Recording follows each visitor's analytics consent
- Session RecordingsReplays with your events
- Desktop HeatmapsClicks, scroll and movement
- Mobile HeatmapsA screenshot per device
- Masked InputsForm fields hidden
Curve Compliance vs Google Analytics 4
Google says it does not offer Business Associate Agreements for Google Analytics, and that customers subject to HIPAA may only use Google Analytics on pages that are not HIPAA-covered. For a healthcare website, those are often the pages that matter most to marketing: a service page, a booking page, a thank-you page. Read Google's own wording on the Google Analytics 4 BAA registry page.
Curve Compliance signs a BAA on every plan and reports on those same pages: sources and channels, attribution under four models, goals and funnels, and every breakdown, paid and unpaid. When a conversion needs to reach Meta, Google Ads or TikTok, Curve sends it server-side and each platform receives only a fixed list of fields. Page titles, free text and form answers are never sent.
Not sure what runs on your site today? Curve Compliance's free website scan lists every pixel and tracker on a page in about a minute.
What Our Customers Say
“Working with Curve Compliance has been a valuable addition to our analytics infrastructure at Precision Telemed. As a nationwide, doctor-led telemedicine company, maintaining strict regulatory standards while continuing to scale is critical. Curve has provided clear visibility into our marketing data.”
Carley CannonCEO, Precision TelemedHIPAA-Compliant Analytics Questions
What is the best HIPAA-compliant analytics tool for healthcare?
Look for four things: the vendor signs a BAA, the analytics can run on every page of your site including service and booking pages, PHI stays out of what reaches ad platforms, and the reports credit bookings to the sources that brought people in. Curve Compliance covers all four. It signs a BAA on every plan, reports sources, channels, attribution, goals and funnels from the visits to your own site, sends each ad platform only a fixed list of fields, and credits your chosen conversion under four attribution models.
Is Google Analytics 4 HIPAA compliant?
Google says it does not offer Business Associate Agreements for Google Analytics, and that customers subject to HIPAA may only use it on pages that are not HIPAA-covered. Curve Compliance is a HIPAA-compliant Google Analytics alternative: it signs a BAA on every plan and reports on every page of your site, including the service and booking pages where conversions happen.
What does Curve Compliance's web analytics report?
The Analytics tab in Curve Compliance has four views. Overview counts the visitors who landed, engaged, started and converted. Attribution credits your primary conversion to the sources, channels and campaigns that brought people in. Goals & Funnels tracks goals and funnels of two to ten steps. Explore breaks visits down by trend, pages, channels, sources, UTM values, devices and places.
Can Curve Compliance show whether patients found us through Meta or Google first?
Yes, across all bookings. Set the booking as the primary conversion, open the Sources breakdown and compare First Touch with Last Touch. First Touch shows where people who booked arrived from first, and Last Touch shows where they came from right before booking. Tag Meta ad links with a paid UTM medium, such as utm_medium=cpc, so they count as paid social.
How is Analytics different from Campaign Reporting in Curve Compliance?
Campaign Reporting puts ad spend next to conversions and credits ad clicks inside a lookback of 1, 7 or 30 days. Analytics credits every visit, paid or unpaid, over 90 days, so organic search and other unpaid visits get credit too.
Does Curve Compliance's analytics respect visitor consent?
Yes. With Curve Compliance's consent management on, page views and other non-essential events wait for visitors in opt-in regions to allow analytics, and session recordings and heatmap capture follow the same choice. Every decision is recorded in an audit log you can export as CSV.
Analytics That Respect Patient Privacy
Get the insights you need without the compliance risk.
- Signed BAA included
- Live in ~7 days
- No engineering lift