Session Replay and Heatmaps Under the Same BAA

Curve Compliance records visitor sessions and builds click, scroll and movement heatmaps for healthcare websites under the same Business Associate Agreement that covers its server-side conversion tracking, so there is no separate replay vendor to sign or review. Recordings stay in Curve's US-hosted environment and are never sent to Meta, Google or any other ad platform.

Want to see it on your own pages? Book a call with Curve and we'll walk you through recordings and heatmaps for your site.

Why session replay needs a BAA on a healthcare website

A session recorder captures what a visitor sees and does on your pages. On a clinic, telehealth or pharmacy site, that includes which services someone looked at and which forms they started. So the recording tool handles the same kind of information your ad tracking does, and it needs the same agreement behind it.

One vendor, one BAA

Curve Compliance signs a BAA on every plan. Session recordings and heatmaps sit under that same agreement, alongside tracking and attribution, so your team reviews one vendor instead of adding a separate recording tool to the list.

Recordings tied to the conversions you track

Curve's own events appear on each recording's timeline, so you can jump straight to the moment a visitor started a booking, submitted a form or left. Filter recordings by converted visits, UTM source, medium and campaign, page, duration or event to see how people from a specific ad actually behave on your site.

Heatmaps from real visits

Heatmaps are built from recorded sessions. They show where visitors click, how far they scroll and where they move, separately for desktop and mobile, and they appear once a page has enough recorded visits to be meaningful. More on the product pages for session replay and heatmaps.

Consent and access

Recording runs only when a visitor's consent allows analytics, and your organization decides what share of visits is recorded. Access is limited to the users you grant, and every play and every deletion is logged.

Getting it switched on

The Curve team switches on session recordings for your account during setup, alongside your tracking. Book a call to get started.

Frequently Asked Questions

Does Curve Compliance sign a BAA that covers session recordings?

Yes. Curve Compliance signs a BAA on every plan, and session recordings and heatmaps are covered by the same agreement as its conversion tracking.

Are recordings ever sent to Meta or Google?

No. Recordings and heatmaps stay in Curve's US-hosted environment.

Which visits does Curve record?

Visits where the visitor's consent allows analytics, at the share of traffic your organization chooses.

How long are recordings kept?

60 days.

Can I watch visits from a specific campaign?

Yes. Filter by UTM source, medium and campaign, or by converted visits, to see recordings of people who came from a given ad.

Do I need a separate heatmap tool?

No. Heatmaps are built from the same recordings, under the same BAA.