Security and Data Handling at Curve Compliance
Curve Compliance is SOC 2 Type II and signs a BAA on every plan. Conversions go from Curve's servers to each ad platform with a fixed list of fields, and Curve strips PHI before data reaches an ad platform. Curve's team does the setup, and Event Logs show what was sent.
Book a call- Implement in days, not weeks
- Scale Google and Meta ads
- No engineering team required
- HIPAA Compliant
- SOC 2 Type II
- US Hosted
How Data Moves Through Curve
Curve Compliance replaces the browser ad pixels on your site with one script. Conversions then go from Curve's servers to each platform's API: Meta Conversions API, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Nothing on your site talks to an ad platform directly.
| Step | What happens |
|---|---|
| On your website | One Curve Compliance script runs in place of your browser ad pixels. |
| Inside Curve | Curve receives your event data under the BAA it signs with you and checks every event for PHI-like patterns. |
| To each ad platform | Conversions go from Curve's servers with only the fields set for that platform. Curve strips PHI before data reaches an ad platform. |
| In Event Logs | Event Logs show what Curve sent to each platform and what the platform accepted. |
What Each Ad Platform Receives
Each ad platform receives only the fields set for it. Page titles, free text and form answers are never sent. Contact identifiers are off by default on Meta, Google Ads and TikTok, and events can use a neutral name such as “Lead” in place of a treatment or condition.
The same rule applies to forms. Curve Forms are hosted by Curve under the BAA it signs on every plan, so a submission never passes through a third-party form tool, and form answers are never sent to an ad platform.
PHI Checks Before Data Reaches an Ad Platform
Curve Compliance checks every event for PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform. It flags them so they can be stopped at the source, and it removes PHI before anything is sent to an ad platform.
To see what runs on your pages today, start with the free website scan. It lists the pixels and trackers on a page, so you know what Curve will replace. For what counts as PHI on a website, see what counts as PHI on a website.
Proof You Can Check in Event Logs
Event Logs show what Curve sent to each platform and what the platform accepted. When someone on your team asks what Meta or Google received for a booking, you can open the record and show them.
Your BAA and the Tools You Connect
Curve signs a BAA on every plan for its own handling of your data. Connected tools work under their own agreements with you. Before you connect a scheduler, EHR, CRM or analytics tool, check it in the BAA Directory, which shows each vendor's own statement and source link. For the ad platforms themselves, see which ad platforms sign a BAA.
What HIPAA Asks of a Tracking Vendor
A tracking vendor that handles PHI for you is a business associate. In its business associates FAQs, HHS says the HIPAA Rules permit a covered entity to disclose PHI to a business associate “if the covered entity obtains satisfactory assurances, in the form of a contract or other written arrangement” that “the business associate will appropriately safeguard the information, among other obligations.”
Safeguards are their own requirement. The HHS summary of the Security Rule says: “The Security Rule requires regulated entities to implement reasonable and appropriate administrative, physical, and technical safeguards for protecting ePHI.”
For tracking tools, the HHS bulletin on online tracking technologies says: “Regulated entities must ensure that all tracking technology vendors have signed a BAA and that there is an applicable permission prior to a disclosure of PHI.” It adds: “Further, it is insufficient for a tracking technology vendor to agree to remove PHI from the information it receives or de-identify the PHI before the vendor saves the information.” That is why Curve does both: it signs a BAA with you, and it strips PHI before data reaches an ad platform.
On June 20, 2024, a federal court in Texas vacated a portion of that bulletin, and the notice at the top of the HHS page says “HHS is evaluating its next steps in light of that order.” Whether a given page or event on your site involves PHI is a question to talk through with your counsel.
How Setup Works
Scan What Runs Today
The free website scan lists the pixels and trackers on the pages your ads send people to.
Replace Pixels With One Script
Curve's team swaps your browser ad pixels for one script and connects your ad platforms server-side, each with its fixed list of fields and neutral event names.
Sign the BAA and Go Live
Curve signs a BAA on every plan. Setup is done for you by Curve's team and is typically live in about a week, case by case.
What Curve Compliance Gives Your Security Review
- SOC 2 Type II
- A BAA on every plan
- Server-side delivery with a fixed list of fields for each ad platform
- PHI stripped before data reaches an ad platform
- Event Logs that show what Curve sent and what each platform accepted
- Setup done for you by Curve's team
More on How Curve Handles Data
Sources, checked October 26, 2026: HHS, Business Associates FAQs; HHS, Summary of the HIPAA Security Rule; HHS bulletin on online tracking technologies.
Curve Compliance Security Questions
How does Curve Compliance protect patient data in ad tracking?
Curve Compliance is SOC 2 Type II and signs a BAA on every plan. It sends each ad platform only a fixed list of fields from Curve's servers and strips PHI before data reaches an ad platform.
Does Curve Compliance sign a BAA?
Yes. Curve Compliance signs a BAA on every plan for its own handling of your data. Connected tools, such as your scheduler, EHR or CRM, work under their own agreements with you, and the BAA Directory shows which tools sign one. BAA Directory.
Is Curve Compliance SOC 2 Type II?
Yes. Curve Compliance is SOC 2 Type II, and it signs a BAA on every plan. Book a call to walk through your data flow with Curve's team.
Does PHI reach Meta or Google through Curve?
No. Curve strips PHI before data reaches an ad platform. Each platform receives only the fields set for it, page titles, free text and form answers are never sent, and contact identifiers are off by default on Meta, Google Ads and TikTok. Curve itself receives your site's event data under the BAA it signs with you.
How can I see exactly what Curve sent to an ad platform?
Open Event Logs in Curve Compliance. Event Logs show what Curve sent to each platform and what the platform accepted, so you can check any conversion against the fields you agreed to send.
Where is Curve Compliance hosted?
Curve Compliance is US hosted. Conversions go from Curve's servers to each ad platform's API, and nothing on your site talks to an ad platform directly.
Does Curve's BAA cover my other tools?
Curve's BAA covers Curve's own handling of your data. Your booking platform, EHR, CRM and other connected tools each work under their own agreement with you, so check each one before you connect it. Check a vendor in the BAA Directory.
Talk to Curve Compliance
Walk through your data flow with Curve's team: SOC 2 Type II, a BAA on every plan and setup done for you.
- Signed BAA included
- Live in ~7 days
- No engineering lift