Curve Compliance is HIPAA ad tracking for online and telehealth pharmacies: it replaces browser ad pixels with one script, sends quiz leads, consults, completed intakes and checkouts server-side to Meta, Google Ads, TikTok and Microsoft Advertising under neutral event names, strips PHI before data reaches an ad platform, and signs a BAA on every plan. Curve's team does the setup, and pharmacies are typically live in about a week.
Book a callAn online pharmacy's pages name drugs, doses and conditions, so a standard ad pixel can carry them in a page URL, a product ID or an event name. The HHS bulletin on online tracking says that when a tracking vendor receives protected health information for a covered function, regulated entities must “enter into a business associate agreement (BAA) with these tracking technology vendors to ensure that PHI is protected in accordance with the HIPAA Rules.” Its own example is a booking, where the website “might automatically transmit information regarding the appointment and the individual's IP address to a tracking technology vendor.” HHS adds that “it is insufficient for a tracking technology vendor to agree to remove PHI from the information it receives or de-identify the PHI before the vendor saves the information.”
Is a pharmacy covered? Under 45 CFR 160.103, health care includes “Sale or dispensing of a drug, device, equipment, or other item in accordance with a prescription.” A covered entity includes “A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter,” and those transactions include “Health care claims or equivalent encounter information.” On June 20, 2024, in American Hospital Association v. Becerra, a federal court in Texas vacated the part of the HHS bulletin that treated an IP address plus a visit to a public page about a health condition or provider as enough to trigger HIPAA. The HHS page says “HHS is evaluating its next steps in light of that order.” How these rules apply to your pharmacy is a legal question, so talk to your counsel. For cash-pay models, see does HIPAA apply to cash-pay telehealth.
Meta draws its own line. Its page About prohibited information lists health information it does not want sent through Meta Business Tools, including “Diseases, medical conditions and injuries” and “Prescription medications, and over-the-counter (OTC) and supplements for specific medical conditions.” The names you choose for events, conversions and Custom Audiences “must not reflect, imply, or be based on any prohibited information.” Meta asks advertisers to check “the data you send with events, such as product IDs, content names, custom properties and URL parameters,” and says “You shouldn't send information about people from web pages where visitors may log in and provide potentially sensitive information, such as patient portals.” Meta can also place a pixel into a core setup, which “restricts the transmission of certain data, such as custom parameters and anything in a URL following the domain”.
Curve Compliance handles the data side. The free website scan lists the pixels and trackers on your public quiz, intake, checkout and refill pages. Curve then replaces browser ad pixels with one script, sends each platform a fixed list of fields under neutral event names, keeps contact identifiers off by default on Meta, Google Ads and TikTok, and checks every event for PHI-like patterns, stripping PHI before data reaches an ad platform. Curve signs a BAA with your pharmacy on every plan.
Every major ad platform treats online pharmacies as a restricted category. These rules decide who may advertise and what the ads may say, and they apply no matter what tracking you use. These are key lines for the United States from each policy page as of October 26, 2026, with each platform's own wording in quotation marks. Read the full policy before you launch a campaign.
| Platform and policy | What the policy says |
|---|---|
| Meta, Drugs and Pharmaceuticals | “Meta requires online pharmacies and telehealth providers to be actively certified with LegitScript.” Certified advertisers may run prescription drug ads only if they “Only target people in eligible countries (United States, Canada or New Zealand),” “Only target people 18 years or older” and “Obtain authorization from Meta.” Ads must “include a disclaimer to consult a licensed health professional or obtain a valid prescription.” Ads that “Promote telehealth services generally” don't need written authorization. |
| Google Ads, Healthcare and medicines | Under prescription drug services, “Businesses subject to this policy include but aren't limited to online pharmacies and telemedicine providers,” and “Advertisers must apply to serve ads for prescription drug services.” In the United States, “Google allows online pharmacies if they're accredited by one of the organizations listed below”: LegitScript's Healthcare Merchant Certification Program (Internet pharmacy certification) or the National Association of Boards of Pharmacy (Digital Pharmacy Accreditation, or .Pharmacy). “Advertisers must also be certified with Google.” Google also “restricts the use of prescription drug terms in ads, landing pages, and keywords.” |
| Microsoft Advertising, Healthcare and Pharmaceutical | “Online pharmacies, telemedicine providers that sell prescription drugs, and prescription drug manufacturers must be preapproved in order to serve ads on the Microsoft Advertising network.” The United States is on its list of markets where they may advertise. For the United States, the policy adds: “Online pharmacies, including pet pharmacies, that advertise prescription drugs to customers in the United States must be accredited by the National Association Boards of Pharmacy (NABP) or LegitScript.” Its general rules for pharmacy and health care advertisers add: “Advertising must target users ages 18+.” Ads that promote prescription drugs must “Not target users based on sensitive health information.” “Ads for brick and mortar pharmacies are not subject to the same restrictions as businesses that sell prescription drugs online.” |
| TikTok, Healthcare and Pharmaceuticals | In the United States, “Ads for brick-and-mortar pharmacies and online pharmacies may be allowed if the following requirement is met”: “Provide proof of certification by a third-party licensing organization, such as the National Association of Boards of Pharmacy (NABP) or LegitScript, or regional equivalent.” Prescription medicine ads also need proof of approval from regulators such as the FDA and must “Restrict the ads to audiences aged 18 years or older.” |
| LegitScript, Healthcare Certification | LegitScript says pharmacies may qualify if “You operate an online or brick-and-mortar pharmacy that sells prescription or over-the-counter (OTC) medications” or “You want to advertise pharmacy services or prescription drugs on platforms like Google, Meta, Microsoft Bing, LinkedIn, TikTok, Netflix, Nextdoor, and Yahoo.” The steps are in our LegitScript certification guide. |
Certification decides whether an ad runs. Tracking decides what a platform learns after the click. Curve's team reviews what your website sends to Meta, Google and TikTok with you and shows what's likely triggering a flag. If an ad or account was already flagged, start with the guide for that notice: Meta prescription drug ads and LegitScript, Google Ads unauthorized pharmacy suspension, Google Ads GLP-1 ads that need a certificate, Meta peptide and ketamine ad rejections or Microsoft Ads pharmacy and telemedicine preapproval.
Curve Compliance replaces your browser ad pixels with one script. Conversions then go from Curve's servers to Meta Conversions API, Google Ads, TikTok and Microsoft Advertising, each with a fixed list of fields and a neutral event name.
Curve checks every event for PHI-like patterns, such as condition and medication names, form answers and emails in URLs, and removes PHI before anything is sent to an ad platform.
Event Logs show what Curve sent to each platform and what the platform accepted, so you can follow a checkout or a completed intake from your site to Meta or Google.
A telehealth pharmacy funnel often runs from an ad to an eligibility quiz, then a consult or an intake, then a checkout and monthly refills. Curve Compliance credits each step to the original ad click and sends it on server-side with a fixed list of fields, so the platform learns that a step happened, not which drug it was for.
| Funnel step | Where it happens | What Curve does |
|---|---|---|
| Eligibility quiz or intake form | Curve Forms, or your own form | Curve Forms are HIPAA-hosted intake and lead forms with ad attribution attached. The submission can be sent to ad platforms as a lead under a neutral event name. |
| Consult booked | IntakeQ, Calendly, Acuity, Jane App, OptiMantra and other schedulers | Keeps the ad attribution when a visitor leaves your site to book. Plain booking links work automatically, and Curve's team sets up GoHighLevel and embedded widgets. Bookings made days later still match. |
| Intake or visit completed | Healthie, Athenahealth, OptiMantra, IntakeQ or Jane, through Keragon | Receives the outcome and credits it to the original ad click. |
| Checkout on your site | Curve's script on your checkout page | Sends the checkout server-side under a neutral event name, after checking it for PHI-like patterns, in place of a browser pixel firing on the page. |
| Orders, subscriptions and refills recorded elsewhere | Your CRM or EHR, or your Stripe subscription events (see Stripe in the BAA Directory) | Incoming webhooks or offline conversion uploads bring the outcome in, and Curve credits it to the original ad click. Stripe subscription events, such as a paid invoice for a monthly refill, go on as a neutral signal without the Stripe customer email, product name or amount. |
| Every step | Meta Conversions API, Google Ads, TikTok and Microsoft Advertising | Sent from Curve's servers with a fixed list of fields. Event Logs show what Curve sent to each platform and what the platform accepted. |
Campaign Reporting in Curve Compliance puts Meta and Google Ads spend next to the conversions Curve tracked, for each platform and campaign. It offers five attribution models, a list of the conversions behind any number, and a single prospect's journey from ad click to booking. HubSpot and WhatConverts outcomes show as CRM revenue and close rate.
For an online pharmacy, that shows which campaigns produced booked consults, completed intakes and checkouts, not only quiz starts, and which ones keep producing refills. Event Logs let you follow a single conversion from your site to Meta or Google.
The free website scan lists the pixels and trackers on your public quiz, intake, checkout and refill pages.
Curve's team swaps your browser ad pixels for one script and connects Meta, Google Ads, TikTok and Microsoft Advertising server-side, with neutral event names.
Your scheduler, EHR, CRM and offline uploads are linked so consults, intakes and refills credit the right ad. Curve signs a BAA on every plan, and pharmacies are typically live in about a week.
Run Curve's free website scan on the page your ads send people to. It lists the ad pixels, analytics tags, session recorders and other trackers running there. Book a call and Curve's team will go through the results with you, then set up HIPAA-compliant tracking that keeps your campaigns optimizing.
Or book a callMore from Curve: Curve Compliance for GLP-1 and weight loss clinics, Curve Compliance for telehealth platforms, Curve's BAA and the BAA Directory.
Sources, checked October 26, 2026: HHS bulletin on online tracking technologies; 45 CFR 160.103, Definitions; Meta, About prohibited information; Meta Advertising Standards, Drugs and Pharmaceuticals; Google Ads Healthcare and medicines policy; Microsoft Advertising Healthcare and Pharmaceutical policy; TikTok Healthcare and Pharmaceuticals policy; LegitScript Healthcare Certification.
Send conversions from a server with a fixed list of fields and neutral event names, keep drug and condition names out of URLs and events, and use a tracking vendor that signs a BAA. Curve Compliance does all three for online and telehealth pharmacies, and its team sets it up for you. Source: HHS bulletin on online tracking technologies.
Meta's own rules limit what the pixel may carry. Meta lists prescription medications and diseases among the health information it does not want sent through its Business Tools, and says the names of events, conversions and Custom Audiences must not reflect or imply it. HHS says a tracking vendor that receives PHI for a regulated entity needs a business associate agreement. Curve Compliance replaces browser ad pixels with one script, sends conversions to Meta Conversions API from its servers with a fixed list of fields and a neutral event name, strips PHI before data reaches Meta, and signs a BAA on every plan. Sources: Meta, About prohibited information; HHS bulletin on online tracking technologies.
It depends on how the pharmacy operates. Under 45 CFR 160.103, health care includes the sale or dispensing of a drug in accordance with a prescription, and a health care provider is a covered entity when it transmits health information electronically in connection with a covered transaction, such as a health care claim. Cash-pay models raise their own questions, covered in our guide on cash-pay telehealth. Source: 45 CFR 160.103, Definitions. HIPAA and cash-pay telehealth.
For prescription drug ads in the United States, Meta requires online pharmacies to be LegitScript certified and then authorized by Meta, while Google, Microsoft and TikTok accept LegitScript or NABP, Google also requires its own certification, and Microsoft requires preapproval. Sources: Meta Advertising Standards, Drugs and Pharmaceuticals; Google Ads Healthcare and medicines policy; Microsoft Advertising Healthcare and Pharmaceutical policy; TikTok Healthcare and Pharmaceuticals policy. LegitScript certification for healthcare ads.
A conversion event under a neutral name, sent from Curve's servers to Meta Conversions API with a fixed list of fields. Contact identifiers are off by default on Meta, Google Ads and TikTok. Curve checks every event for PHI-like patterns and strips PHI before data reaches Meta, and Event Logs show what Curve sent and what Meta accepted. Curve and Meta.
Yes. When your CRM or EHR records an order, a subscription start or a refill, it reaches Curve through an incoming webhook, Keragon or an offline conversion upload, and Curve credits it to the original ad click. Curve can also forward Stripe subscription events, such as a paid invoice for a monthly refill, as a neutral signal without the Stripe customer email, product name or amount. Campaign Reporting then shows Meta and Google Ads spend next to those conversions. Healthcare integrations.
Yes. Curve Compliance signs a BAA on every plan, and Curve is SOC 2 Type II. Curve's team does the setup, and pharmacies are typically live in about a week, though it varies with the funnel. To check the other tools in your stack, such as your EHR, CRM or payment processor, use the BAA Directory. BAA Directory.
Server-side ad tracking for online and telehealth pharmacies, set up by Curve's team, with a BAA on every plan.
