Curve Compliance is HIPAA-compliant ad tracking for GLP-1 and weight loss clinic marketing: it replaces browser ad pixels with one script, sends consults and bookings server-side to Meta, Google, TikTok and Microsoft under neutral event names, detects PHI-like patterns before data reaches an ad platform, and signs a BAA on every plan. Curve's team does the setup, and most customers are live in about a week.
Book a callStart with what leaves your site. The HHS bulletin on online tracking says that when a tracking vendor receives protected health information for a covered function, regulated entities must “enter into a business associate agreement (BAA) with these tracking technology vendors to ensure that PHI is protected in accordance with the HIPAA Rules.” Its own example is a clinic booking: the website “might automatically transmit information regarding the appointment and the individual's IP address to a tracking technology vendor.” HHS also says tracking on a page that “permits individuals to schedule appointments or use a symptom-checker tool without entering credentials may have access to PHI in certain circumstances.”
On June 20, 2024, in American Hospital Association v. Becerra, a federal court in Texas vacated one part of that bulletin, the part that treated an IP address plus a visit to a public page about a health condition or provider as enough to trigger HIPAA. The notice at the top of the HHS page says HHS “is evaluating its next steps in light of that order.” Whether a given page on your site involves PHI is a question for your counsel.
Meta draws its own line. Its page About prohibited information lists health information it does not want sent through Meta Business Tools, including “Prescription medications, and over-the-counter (OTC) and supplements for specific medical conditions” and “Body specifications, bodily activities, and biological cycles.” It says the names you choose for events, conversions and Custom Audiences “must not reflect, imply, or be based on any prohibited information.” Meta can also place a pixel into a core setup, which “restricts the transmission of certain data, such as custom parameters and anything in a URL following the domain”. A BMI answer, a drug name in a page URL or an event called semaglutide_consult can all fall under those headings. See what core setup means for a health and wellness business.
Curve Compliance helps on the data side. The free website scan lists the pixels and trackers on your quiz, booking and checkout pages. Curve then replaces browser ad pixels with one script, sends each platform only a fixed list of fields under neutral event names, keeps contact identifiers off by default and SHA-256 hashes them when you turn them on, and detects PHI-like patterns such as condition names, form answers and emails in URLs before data reaches an ad platform, flagging them so they can be stopped at the source.
Every major ad platform has rules for weight loss and prescription drug ads. They decide who may advertise and what the ads may say, and they apply no matter what tracking you use. These are key lines from each policy page as of October 10, 2026, with the platform's own wording in quotation marks. Read the full policy before you launch a campaign.
| Platform and policy | What the policy says |
|---|---|
| Meta, Health and Wellness | Weight loss ads “must be targeted to people at least 18 years or older.” For weight loss products that need a prescription, Meta points to its Drugs and Pharmaceuticals policy. |
| Meta, Drugs and Pharmaceuticals | “Meta requires online pharmacies and telehealth providers to be actively certified with LegitScript.” Prescription drug ads may only target the United States, Canada or New Zealand, only people 18 or older, only in countries where they are certified, must include “a disclaimer to consult a licensed health professional or obtain a valid prescription,” and need authorization from Meta. Ads that “Promote telehealth services generally” don't need written authorization. |
| Google Ads, Healthcare and medicines | Prescription drug services cover businesses that “include but aren't limited to online pharmacies and telemedicine providers,” and advertisers must apply. In the United States, “Google allows telemedicine providers if they're accredited by LegitScript's Healthcare Merchant Certification Program,” and “Advertisers must also be certified with Google.” Google also “restricts the use of prescription drug terms in ads, landing pages, and keywords.” |
| TikTok, Weight Management and Body Image | Weight loss claims “must be restricted to audiences aged 18 years or older.” Not allowed: “Claims that the product alone, without diet or exercise, can lead to weight loss or muscle gain.” |
| TikTok, Healthcare and Pharmaceuticals | In the United States, prescription medicine ads may be allowed if advertisers “Provide proof of approval and certification from appropriate local regional regulating authorities, such as the US Food and Drug Administration (FDA)” and “Restrict the ads to audiences aged 18 years or older.” |
| Microsoft Advertising, Healthcare and Pharmaceutical | “Online pharmacies, telemedicine providers that sell prescription drugs, and prescription drug manufacturers must be preapproved in order to serve ads on the Microsoft Advertising network.” Weight loss ads must target 18+ audiences, and “Ads must not reference specific rates or amount of weight loss.” “Ads must encourage users to consult a healthcare professional before beginning any intensive program.” |
| FDA, unapproved GLP-1 drugs | On unapproved versions of GLP-1 drugs, including semaglutide and tirzepatide, FDA says “unapproved versions do not undergo FDA’s review for safety, effectiveness and quality before they are marketed.” One telehealth red flag FDA lists is a company that “makes claims such as the compounded drug is the same as an FDA-approved drug”. |
Those rules decide whether an ad runs. Tracking decides what a platform learns after the click. Curve's team reviews what your website sends to Meta, Google and TikTok with you and shows what's likely triggering a flag. If an ad was already rejected, start with the guide for that notice: Google Ads unreliable claims for weight loss, Meta prescription drug ads and LegitScript, TikTok weight management rejections or Microsoft Ads weight loss disapprovals.
Curve Compliance replaces your browser ad pixels with one script. Conversions then go from Curve's servers to Meta Conversions API, Google Ads, TikTok and Microsoft Advertising, each with a fixed list of fields and a neutral event name.
Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
Run your eligibility or intake form on Curve Forms: HIPAA-hosted intake and lead forms with ad attribution attached, under the BAA Curve signs on every plan.
A typical GLP-1 funnel runs from an ad to an eligibility or intake form, then a consult, then a prescription and a recurring subscription. Curve Compliance credits each step to the original ad click and sends it on server-side, so the platform learns that a step happened, not what it was for.
| Funnel step | Where it happens | What Curve does |
|---|---|---|
| Eligibility or intake form | Curve Forms, or your own form | Curve Forms are HIPAA-hosted intake and lead forms with ad attribution attached. The submission can be sent to ad platforms as a lead under a neutral event name. |
| Consult booked | IntakeQ, Calendly, Acuity, Jane App, OptiMantra, Boulevard and other schedulers | Keeps the ad attribution when a visitor leaves your site to book. Plain booking links work automatically, and Curve's team sets up GoHighLevel and embedded widgets. Bookings made days later still match. |
| Visit completed or prescription recorded | Healthie, Athenahealth, OptiMantra, IntakeQ or Jane, through Keragon | Receives the outcome and credits it to the original ad click. |
| Subscription or refill | Your CRM or EHR | Incoming webhooks or offline conversion uploads bring the outcome in, and Curve credits it to the original ad click. |
| Every step | Meta Conversions API, Google Ads, TikTok and Microsoft Advertising | Sent from Curve's servers with a fixed list of fields. Event Logs show what Curve sent to each platform and what the platform accepted. |
Campaign Reporting in Curve Compliance puts Meta and Google Ads spend next to the conversions Curve tracked, for each platform and campaign. It offers five attribution models, a list of the conversions behind any number, and a single prospect's journey from ad click to booking. HubSpot and WhatConverts outcomes show as CRM revenue and close rate.
For a GLP-1 clinic, that means you can see which campaigns produced booked consults and started subscriptions, not only form fills. Event Logs show what Curve sent to each platform and what the platform accepted, so you can follow a consult event from your site to Meta or Google.
The free website scan lists the pixels and trackers on your quiz, intake, booking and checkout pages.
Curve's team swaps your browser ad pixels for one script and connects Meta, Google Ads, TikTok and Microsoft Advertising server-side, with neutral event names.
Your scheduler, EHR, CRM and offline uploads are linked so consults and subscriptions credit the right ad. Curve signs a BAA on every plan, and most customers are live in about a week.
Sources, checked October 10, 2026: HHS bulletin on online tracking technologies; Meta, About prohibited information; Meta Advertising Standards, Health and Wellness; Meta Advertising Standards, Drugs and Pharmaceuticals; Google Ads Healthcare and medicines policy; TikTok Weight Management and Body Image policy; TikTok Healthcare and Pharmaceuticals policy; Microsoft Advertising Healthcare and Pharmaceutical policy; FDA, concerns with unapproved GLP-1 drugs used for weight loss.
Meta's own rules limit what the pixel may carry. Meta lists prescription medications and body specifications among the health information it does not want sent through its Business Tools, and says event and conversion names must not imply it. HHS says a tracking vendor that receives PHI for a clinic needs a business associate agreement, and that disclosing PHI to tracking vendors for marketing without patients' HIPAA-compliant authorization is not permitted. Curve Compliance replaces browser ad pixels with one script, sends conversions to Meta Conversions API from its servers with a fixed list of fields and a neutral event name, detects PHI-like patterns before data reaches Meta, and signs a BAA with your clinic on every plan. Sources: Meta, About prohibited information; HHS bulletin on online tracking technologies.
Yes. Meta's Health and Wellness policy says weight loss ads must be targeted to people at least 18 years or older. For weight loss products that need a prescription, Meta points to its Drugs and Pharmaceuticals policy, which requires telehealth providers to be actively certified with LegitScript and to get authorization from Meta. Sources: Meta Advertising Standards, Health and Wellness; Meta Advertising Standards, Drugs and Pharmaceuticals.
Google covers telemedicine providers under its prescription drug services policy, and advertisers must apply. In the United States, Google allows telemedicine providers accredited by LegitScript's Healthcare Merchant Certification Program, and they must also be certified with Google. Google also restricts prescription drug terms in ads, landing pages and keywords. Source: Google Ads Healthcare and medicines policy.
TikTok restricts weight loss claims to audiences aged 18 or older and does not allow claims that a product alone, without diet or exercise, leads to weight loss. In the United States, its healthcare policy says prescription medicine ads may be allowed with proof of approval and certification from regulators such as the FDA, restricted to audiences aged 18 or older. Sources: TikTok Weight Management and Body Image policy; TikTok Healthcare and Pharmaceuticals policy.
A booking event under a neutral name, sent from Curve's servers to Meta Conversions API with a fixed list of fields. Contact identifiers are off by default and SHA-256 hashed when you turn them on. Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches Meta, and Event Logs show what Curve sent and what Meta accepted. Curve and Meta.
Yes. When your CRM or EHR records a subscription start or a refill, it reaches Curve through an incoming webhook, Keragon or an offline conversion upload, and Curve credits it to the original ad click. Campaign Reporting then shows Meta and Google Ads spend next to those conversions. Healthcare integrations.
Yes. Curve Compliance signs a BAA on every plan, and Curve is SOC 2 Type II. To check the other tools in your stack, such as your scheduler, CRM or email platform, use the BAA Directory. BAA Directory.
Curve's team does the setup for you, and most customers are live in about a week. That covers the website scan, replacing browser pixels with one script, connecting Meta, Google Ads, TikTok and Microsoft Advertising server-side, and linking your booking and EHR tools. Start with the free website scan.
Server-side ad tracking for GLP-1 and weight loss clinics, set up by Curve's team, with a BAA on every plan.
