Curve Compliance is HIPAA-compliant ad tracking for fertility and IVF clinics, including egg freezing and male fertility programs: it replaces browser ad pixels with one script, sends inquiries, consult bookings and calls server-side to Meta, Google Ads and TikTok under neutral event names, removes PHI before anything is sent to an ad platform, and signs a BAA on every plan. Curve's team does the setup, and most customers are live in about a week.
Book a callReproductive health data is some of the most sensitive data a clinic holds. The HHS bulletin on online tracking says that when a tracking vendor receives protected health information for a covered function, regulated entities must “enter into a business associate agreement (BAA) with these tracking technology vendors to ensure that PHI is protected in accordance with the HIPAA Rules.” Its own example is a clinic booking, where the website “might automatically transmit information regarding the appointment and the individual's IP address to a tracking technology vendor.”
On June 20, 2024, in American Hospital Association v. Becerra, a federal court in Texas vacated the part of that bulletin that treated an IP address plus a visit to a public page about a health condition or provider as enough to trigger HIPAA. The HHS page says HHS “is evaluating its next steps in light of that order.” Whether a page on your site involves PHI is a legal question, so talk to your counsel.
Meta's page About prohibited information lists health information it does not want sent through Meta Business Tools, including “Sexual and reproductive health,” “Medical procedures, treatments and testing” and “Body specifications, bodily activities, and biological cycles.” The names you choose for events, conversions and Custom Audiences “must not reflect, imply, or be based on any prohibited information.” Meta can also place a pixel into a core setup, which “restricts the transmission of certain data, such as custom parameters and anything in a URL following the domain”.
TikTok's notice on prohibited data sharing says: “At TikTok, we don't allow advertisers to share information about children, health or financial information, or other categories of prohibited data.” Its health examples include “Information from apps that may be used to schedule medical appointments.”
Curve Compliance handles the data side. The free website scan lists the pixels and trackers on your inquiry, booking and treatment pages. Curve then replaces browser ad pixels with one script, sends each platform a fixed list of fields under neutral event names, keeps contact identifiers off by default and SHA-256 hashes them when you turn them on, and checks every event for PHI-like patterns before data reaches an ad platform, flagging them so they can be stopped at the source.
On January 13, 2021, the FTC announced a settlement with Flo Health, developer of a period and fertility-tracking app, alleging that Flo disclosed “sensitive health information, such as the fact of a user's pregnancy,” to third parties including Facebook's and Google's analytics divisions. It finalized the order on June 22, 2021. On May 17, 2023, the FTC charged the developer of the fertility app Premom with disclosing “users' sensitive health data to AppsFlyer and Google,” with a proposed order that included a “$100,000 civil penalty for violating the Health Breach Notification Rule.” Both were app companies, not clinics, but they show how regulators view reproductive health data in ad and analytics tools.
Each platform has rules for reproductive health ads and for how you may target them, and they apply no matter what tracking you use. These are key lines from each policy page as of October 12, 2026, with the platform's own wording in quotation marks. Read the full policy before you launch a campaign.
| Platform and policy | What the policy says |
|---|---|
| Meta, Health and Wellness | “Advertisers can run ads that promote sexual health, wellness and reproductive products and services.” Ads for “In Vitro Fertilization (IVF) or any other artificial insemination procedures” are allowed when they target people 18 or older and “the focus is on health and the medical efficacy of the product or the service and not on the sexual pleasure or enhancement.” |
| Meta, Privacy Violations and Personal Attributes | Ads may not “assert or imply the personal attributes of the viewer of an ad,” including “Family status” and “Medical or genetic condition.” |
| Meta, targeting and custom audiences | Meta said that starting January 19, 2022 it would remove Detailed Targeting options that “relate to topics people may perceive as sensitive,” such as “Health causes.” Custom audiences that reference “specific health conditions” are flagged and “cannot be used for running ad campaigns.” |
| Google Ads, Health in personalized advertising | “Content related to Health is a sensitive interest category,” with examples including “Treatments for pregnancy and infertility.” “You can't use advertiser-curated audiences,” which the restricted targeting page lists as Customer match, Your data segments, Audience expansion and Lookalike segments. |
| Google Ads, Birth control, fertility, and testing | “Google doesn't allow the promotion of products and services related to birth control, fertility, and sexually transmitted infections (STI) in the locations below.” Examples include “Fertility testing” and “Surrogacy services.” The United States is not on that list. |
| TikTok, Healthcare and Pharmaceuticals | In the United States, medical institution ads “May be allowed if the following requirements are met,” including “Restrict the ads to audiences aged 18 years or older.” In Canada, “Surrogacy” is among TikTok's examples of what is not allowed. |
Those rules decide whether an ad runs and who sees it. Tracking decides what a platform learns after the click. Curve's team reviews what your website sends to Meta, Google and TikTok with you and shows what's likely triggering a flag.
Curve Compliance replaces your browser ad pixels with one script. Conversions then go from Curve's servers to Meta Conversions API, Google Ads, TikTok and Microsoft Advertising, each with a fixed list of fields and a neutral event name.
Curve checks every event for PHI-like patterns, such as condition names, form answers and emails in URLs, and removes PHI before anything is sent to an ad platform.
Run your new patient inquiry form on Curve Forms: HIPAA-hosted intake and lead forms with ad attribution attached, under the BAA Curve signs on every plan.
A fertility patient often starts with an inquiry form or a phone call, books a first consult, and starts treatment later. Curve Compliance credits each step to the original ad click and sends it on server-side with a fixed list of fields, and strips PHI before data reaches an ad platform.
| Funnel step | Where it happens | What Curve does |
|---|---|---|
| Inquiry form | Curve Forms, or your own form | Curve Forms are HIPAA-hosted intake and lead forms with ad attribution attached. The submission can be sent to ad platforms as a lead under a neutral event name. |
| Consult booked | IntakeQ, Calendly, Acuity, Jane App, GoHighLevel and other schedulers | Keeps the ad attribution when a visitor leaves your site to book. Plain booking links work automatically, and Curve's team sets up GoHighLevel and embedded widgets. Bookings made days later still match. |
| Phone call | CallRail or another call tracking tool | The call tracking tool sends each call to Curve through an incoming webhook, and Curve credits it to the original ad click. |
| Consult attended or treatment started | Your CRM or EHR, or Healthie, Athenahealth, OptiMantra, IntakeQ or Jane through Keragon | Incoming webhooks, Keragon or offline conversion uploads bring the outcome in, and Curve credits it to the original ad click. |
| Every step | Meta Conversions API, Google Ads, TikTok and Microsoft Advertising | Sent from Curve's servers with a fixed list of fields. Event Logs show what Curve sent to each platform and what the platform accepted. |
Many fertility inquiries start with a phone call. Google's Call Ads Supplemental Terms say “Google does not intend use of the Communication Features to create obligations under” HIPAA. A covered entity or business associate that wants those features “should not accept these Supplemental Terms” and should instead contact its Google account representative or Google support “to request exclusion from monitoring and recording of Communications.” With Curve Compliance, your call tracking tool sends each call to Curve through an incoming webhook, Curve credits it to the original ad click, and the conversion goes to Google Ads or Meta server-side under a neutral name. Check whether your call tracking tool signs a BAA in the BAA Directory: CallRail, CallTrackingMetrics and WhatConverts.
Campaign Reporting in Curve Compliance puts Meta and Google Ads spend next to the conversions Curve tracked, for each platform and campaign. It offers five attribution models, a list of the conversions behind any number, and a single prospect's journey from ad click to booking. HubSpot and WhatConverts outcomes show as CRM revenue and close rate.
For a fertility clinic, that shows which IVF, egg freezing and male fertility campaigns produced booked consults and calls, not only form fills.
The free website scan lists the pixels and trackers on your inquiry, booking and treatment pages.
Curve's team swaps your browser ad pixels for one script and connects Meta, Google Ads, TikTok and Microsoft Advertising server-side, with neutral event names.
Your scheduler, call tracking, CRM, EHR and offline uploads are linked so consults and calls credit the right ad. Curve signs a BAA on every plan, and most customers are live in about a week.
Run Curve's free website scan on the page your ads send people to. It lists the ad pixels, analytics tags, session recorders and other trackers running there. Book a call and Curve's team will go through the results with you, then set up HIPAA-compliant tracking that keeps your campaigns optimizing.
Or book a callMore from Curve: Curve's BAA, all integrations and Curve Compliance for telehealth platforms.
Sources, checked October 12, 2026: HHS bulletin on online tracking technologies; FTC, Flo Health settlement (January 13, 2021); FTC, Flo Health final order (June 22, 2021); FTC, Premom proposed order (May 17, 2023); Meta, About prohibited information; Meta Advertising Standards, Health and Wellness; Meta, Privacy Violations and Personal Attributes policy; Meta, Removing certain ad targeting options; Meta, Restrictions on certain custom audiences; Google Ads, Health in personalized advertising; Google Ads, Restricted targeting in personalized advertising; Google Ads, Birth control, fertility, and testing policy; Google Ads, Call Ads Supplemental Terms; TikTok Healthcare and Pharmaceuticals policy; TikTok, About notifications of potentially prohibited data sharing.
Meta lists sexual and reproductive health, and medical procedures, treatments and testing, among the health information it does not want sent through its Business Tools. HHS says a tracking vendor that receives PHI for a clinic needs a business associate agreement. Curve Compliance replaces browser ad pixels with one script, sends conversions to Meta Conversions API from its servers with a fixed list of fields and a neutral event name, removes PHI before anything is sent to Meta, and signs a BAA with your clinic on every plan. Sources: Meta, About prohibited information; HHS bulletin on online tracking technologies.
Yes, within Meta's rules. Meta's Health and Wellness policy lists IVF and other artificial insemination procedures among reproductive health ads that must target people 18 or older and focus on health and medical efficacy. Its Personal Attributes policy bars ads that assert or imply a viewer's family status or medical condition, so write about your clinic's services, not about the person reading the ad. Sources: Meta Advertising Standards, Health and Wellness; Meta, Privacy Violations and Personal Attributes policy.
Google treats health as a sensitive interest category and names treatments for pregnancy and infertility as an example. Advertisers in that category can't use advertiser-curated audiences, such as Customer Match, your data segments (previously called remarketing) and lookalike segments. Predefined Google audiences, such as in-market and affinity segments, can still be used. Sources: Google Ads, Health in personalized advertising; Google Ads, Restricted targeting in personalized advertising.
In the United States, TikTok's healthcare policy says medical institution ads may be allowed if they comply with local laws and regulations and are restricted to audiences aged 18 or older, and that certifications from local regulating authorities may be required. The policy doesn't name fertility clinics; medical institutions is the closest category it lists for the United States. TikTok also says it does not allow advertisers to share health information, including through its pixel and Events API. Sources: TikTok Healthcare and Pharmaceuticals policy; TikTok, About notifications of potentially prohibited data sharing.
Connect your call tracking tool to Curve Compliance. The tool sends each call to Curve through an incoming webhook, Curve credits it to the original ad click, and the conversion goes to Google Ads or Meta server-side under a neutral name. Google's Call Ads Supplemental Terms say a HIPAA covered entity that wants Google's own call features should not accept those terms, and should instead ask Google to exclude its calls from monitoring and recording. Source: Google Ads, Call Ads Supplemental Terms. CallRail with Curve.
Yes. When your CRM or EHR records a later step, such as an attended consult or a treatment start, it reaches Curve through an incoming webhook, Keragon or an offline conversion upload, and Curve credits it to the original ad click. Campaign Reporting then shows Meta and Google Ads spend next to those conversions. Healthcare integrations.
Yes. Curve Compliance signs a BAA on every plan, and Curve is SOC 2 Type II. Curve's team does the setup, and most customers are live in about a week. To check the other tools in your stack, such as your scheduler, CRM or call tracking tool, use the BAA Directory. BAA Directory.
Server-side ad tracking for fertility and IVF clinics, set up by Curve's team, with a BAA on every plan.
