Loading
Know which ads book new patients and cosmetic consults, without telling Google or Meta who booked.
Hippo is HIPAA-compliant ad tracking for dermatology practices. It counts the appointments, consults and calls your ads produce, in an account you own, and keeps patient identities and conditions out of what Google and Meta receive.
No annual contracts.
Transparent pricing.
We set it up for you.
A dermatology patient books through your portal, and the cosmetic line is usually the first thing a practice advertises
Most dermatology practices start paid advertising when the cosmetic line needs filling: Botox, fillers, lasers and the consults that lead to them. That is also when they meet Google's rules. Google restricts prescription drug terms(opens in a new tab), and Botox, isotretinoin and tretinoin are on its list of prescription drugs(opens in a new tab); you can name them on the page, and you must be certified to bid on them(opens in a new tab). The path runs from ad click to an appointment requested through your portal, a cosmetic consult booked, or a call, then the visit and the treatment plan.
The medical booking usually finishes on your EMR vendor's portal and the cosmetic one on a scheduler, and many patients still call. A practice that bills insurance is covered by HIPAA for every patient it sees, the cosmetic patient included. What the account counts as a conversion decides whether the numbers mean anything.
What is worth counting:
- a new-patient appointment requested through your portal
- a cosmetic consult booked
- a call from an ad that books a visit
- for a telederm practice, a paid consult
What isn't:
- clicks
- form starts
- page views
A cosmetic campaign can fill the calendar with online bookings that never show.
Here is the sum, with example numbers.
The sum, with example numbers
- Ad spend a month
- $3,000
- Cosmetic consults booked
- 40
- Cost per booked consult
- $75
- Consults that become treatment patients
- one in two
- A new cosmetic patient costs
- about $150
Example figures. Put in your own. Each line needs a count you trust, and the last one needs the campaign it came from.
Try the sum with your own numbers. If the new patients are not tied to campaigns, that is the gap Hippo closes. It records the portal booking, the consult, the call and the form, ties each to the campaign that produced it, and sends the conversion to Google and Meta without the name, email, phone number, IP address or condition.
What dermatology clinicians and their marketers say
They can't tell what's working
No agreed conversion, bookings that never show, and a founder spending before the tracking exists.
I'm ok burning money in the beginning learning what works as long as I can iterate towards lower cost per conversion (consultation/payment complete.)
Founder, telederm practice By conversion here, what conversion action are you basing off of (form fill, first booking, or appointment complete)?
PPC consultant Additionally, many people book these cosmetic appointments online where no deposits are required, so if filler is 30 minutes and they take my calendar space and then no show, there’s no reprimand for them.
Dermatology PA, medical and cosmetic 
They worry about the tracking itself
Agencies asking whether the conversion action is the liability, and practices asking who has a compliant tag.
This sounds to me as having the same problems as google analytics... Is it a liability to run campaigns with conversion actions for the healthcare industry ???
Agency running ads for cosmetic surgery practices We don't even use a Google tag because it's not HIPAA compliant. Instead, we use a 3rd party HIPAA compliant tag that tracks leads across all sources
Aesthetics agency what is the 3rd party HIPAA compliant tag you use for this?
Aesthetics practice marketer
Google and Meta treat dermatology as health content, and that shapes what you can measure
Google restricts prescription drug terms(opens in a new tab) in ads, landing pages and keywords, and its list names Botox, isotretinoin and tretinoin; you must be certified to bid on them(opens in a new tab), and a campaign that runs under the rule is labeled "Eligible (limited)"(opens in a new tab). Pages about physical health conditions(opens in a new tab), acne and psoriasis among them, are a sensitive health category, so you cannot use your own audience lists(opens in a new tab): no Customer Match, no remarketing lists, no lookalikes. Health conversions cannot be measured with enhanced conversions(opens in a new tab) or offline uploads, and Google does not offer a BAA for Google Analytics(opens in a new tab).
Hippo changes none of that. It does not lift the label or replace certification, adds no words, keywords or claims to your site, and changes no ad copy. It measures what happens after the click.
Meta
Meta allows ads for cosmetic procedures, injectables and lasers to people 18 and older(opens in a new tab); a telederm practice promoting a prescription by name needs LegitScript certification and Meta's authorization(opens in a new tab). Separately, Meta sorts data sources into categories, and a site with a patient portal(opens in a new tab) is a named example of the health and wellness one. That category can block lower-funnel events(opens in a new tab) such as Lead and Schedule, blocks custom events until they are reviewed(opens in a new tab), flags a custom conversion that names a condition(opens in a new tab), and you cannot change the category Meta assigns(opens in a new tab).
Meta's rules name medical procedures, treatments and testing(opens in a new tab) among the information it must not receive, the rule covers the names of your events(opens in a new tab), and its core setup strips anything in a URL after the domain(opens in a new tab). An event called "acne consult booked" breaks it. Meta states that its own filters are no substitute for yours(opens in a new tab).
An event name, before and after
"acne consult booked"Breaks Meta's terms
A neutral event nameWhat Hippo sends
Sent without the patient's
- name
- phone number
- IP address
- condition
With audiences closed off and lower-funnel events restricted, the events that still flow are what steer bidding. Hippo sends them under neutral names that carry no condition, no treatment and nothing that identifies the patient, and keeps a log of new patients by campaign that is yours whatever Meta blocks.
Sources: Google, Restricted drug terms(opens in a new tab) · Google, Prescription drug list(opens in a new tab) · Google, Healthcare and medicines(opens in a new tab) · Google, Health in personalized advertising(opens in a new tab) · Google, Personalized advertising(opens in a new tab) · Google, Customer data policies(opens in a new tab) · Google, HIPAA and Google Analytics(opens in a new tab) · Meta, Health and wellness(opens in a new tab) · Meta, Drugs and pharmaceuticals(opens in a new tab) · Meta, Data source categories(opens in a new tab) · Meta, Data sharing restrictions(opens in a new tab) · Meta, Restrictions on custom conversions(opens in a new tab) · Meta, About prohibited information(opens in a new tab) · Meta, Core setup(opens in a new tab). As of 10/7/26.
HIPAA covers every patient you see, and the wiretap laws are where the money came from
Federal
HIPAA
A practice that submits claims electronically(opens in a new tab) is a covered entity, and the status attaches to the practice, not the service line, so the cash-pay cosmetic patient is covered too. HHS names the booking page: tracking on a page that permits individuals to schedule appointments(opens in a new tab) can reach PHI, and a tracking vendor receiving it is a business associate, and a BAA is required(opens in a new tab). HIPAA has no private right of action, which is why the cases below came under other laws.
Federal
Federal Wiretap Act
$10,000It allows statutory damages of $10,000 per plaintiff, and no proof of harm. Both dermatology practices sued over tracking were sued under it, for what their appointment pages sent.
State
Illinois and Florida
Illinois(opens in a new tab) requires every party's consent to intercept an electronic communication, and both dermatology practices sued over tracking practise there. Florida's Security of Communications Act(opens in a new tab) allows $100 a day or $1,000 per plaintiff, and one of them settled in a Florida court.
State
California
$5,000The state's privacy law(opens in a new tab) sets $5,000 per violation with no proof of harm, and its medical confidentiality law adds nominal damages of $1,000(opens in a new tab). Both claims survived a motion to dismiss against a telederm prescriber in August 2026.
State
Washington
The My Health My Data Act(opens in a new tab) covers health data HIPAA does not, including the visitor who read your acne page and never booked, and sharing it with an ad platform needs consent separate from the consent to collect.
Enforcement in Dermatology
Derick Dermatology(opens in a new tab)
Up to $1 million
Derick Dermatology, an independent practice with locations in Chicago and Tampa Bay offering medical, surgical and cosmetic care, agreed to pay up to $1,000,000(opens in a new tab) to settle federal wiretap and privacy claims over tracking on the website where patients made appointments. The final approval hearing was set for August 2026.
Core Dermatology(opens in a new tab)
Pending
A patient alleges that Core Dermatology(opens in a new tab), a ten-location dermatology, cosmetic and med spa practice, sent what visitors typed into its consult and appointment forms to Google, Meta and its call-tracking vendor. The case was filed in April 2026, is pending, and the claims are allegations.
Musely(opens in a new tab)
Pending
A patient alleges that Musely, a telederm prescriber of custom skincare, shared her information with Meta and TikTok through tracking on its website. In August 2026 the court let her California privacy and medical-confidentiality claims proceed(opens in a new tab). The case is pending and the claims are allegations.
What the cases have in common:
The pages were booking pages.
The appointment request, the consult form and the online intake.
The tools were ordinary.
Google's tags, the Meta Pixel and, in one case, a call-tracking vendor's tag.
The defendants were independents.
A 23-location group and a ten-location group, not the private-equity platforms.
The federal Wiretap Act reaches any practice with a booking page, and the state laws in Illinois, Florida, California and Washington add their own damages.
See what your booking page sends to Google and Meta →(opens in a new tab)How Hippo works
Your website
Book your appointment
Book now
Call us
Booking
Call
Hippo
Records events
Removes identifying information
Sends clean conversion data
Excluded from conversion events
Names
Conditions
IP addresses
Clean conversion events only
Google / Meta
Booking
Call
Remove the pixels that send PHI.
Take the Google and Meta pixels off your site.
Paste one snippet.
Hippo records visits, bookings, and calls, then removes patient names, health details, and IP addresses from the conversion events sent to Google and Meta.
Send clean conversions back to Google and Meta.
Google and Meta receive conversion signals they can use to optimize your campaigns. Patient names, health details, and IP addresses stay out of those events.
With your portal, your scheduler and your call tracking untouched. Hippo runs on your own domain and records the appointment request, the consult, the call and the form. Your EMR's portal, your cosmetic scheduler and your call-tracking line stay as they are; what changes is what leaves the page. If an agency runs your ads, they keep their reporting and you keep the data and the accounts.
When the booking finishes on your EMR vendor's portal or your cosmetic scheduler, Hippo counts it through its scheduling connections, so a booking made off your site still lands on the campaign that produced it.
Supported integrations
Hippo works with the ad platforms and website tools your practice already uses.
Conversion
Hippo
What you get
New patients and consults, by campaign
See which campaigns led to consult requests and bookings, and what each one cost.
Your numbers, in your account
An independent record of results in an account you own. If you change agencies, it stays with you.
Call tracking
Calls that start from an ad are counted as conversions alongside forms and bookings.
A record of what was sent
A log of every event that went to Google and Meta and what was removed from it first.
Pricing
1,000 visitors/month
$99/month
Month to month.
Start now, no demo call1,000 visitors/month(opens in a new tab)2,000 visitors/month
$199/month
Month to month.
Start now, no demo call2,000 visitors/month(opens in a new tab)10,000 visitors/month
$299/month
Month to month.
Start now, no demo call10,000 visitors/month(opens in a new tab)
Every plan includes:
- BAA signed at checkout
- No setup fees
- Cancel anytime. No compliance add-on that locks you in the day you enable it.
Server-side conversion tracking under a BAA, at a price a practice can actually pay.
Frequently asked questions
Our cosmetic patients pay cash. Does HIPAA apply to them?
Yes, if the practice bills insurance for anyone. A provider is a covered entity when it submits claims electronically(opens in a new tab), and the status belongs to the practice, not to the service line, so the patient who pays cash for Botox is covered like the patient whose plan pays for a biopsy. A practice that only sells cosmetic services and never bills a plan may sit outside HIPAA, and the wiretap laws behind the cases below still reach it.
Our Botox and acne pages are "Eligible (limited)". Will tracking fix that?
No. Google restricts prescription drug terms(opens in a new tab), its list names Botox, isotretinoin and tretinoin, and bidding on them requires certification(opens in a new tab). Hippo does not change ad approval, certification or the label. What it changes is what your site sends after the click, so the campaigns that do run steer on a clean signal.
Meta cut our Lead and Schedule events. Can Hippo get them back?
No. Hippo cannot lift a category Meta has assigned, and you cannot change it(opens in a new tab) either; under the health and wellness category Meta blocks specific mid- and lower-funnel events(opens in a new tab). What a compliant feed changes is what still flows: a booking sent with no condition in the name, no URL path and nothing that identifies the patient, and a log of new patients by campaign that is yours whatever Meta blocks.
Our appointments are booked through our EMR's patient portal. Can you count them?
Yes. Most dermatology bookings finish on the EMR vendor's hosted portal or a cosmetic scheduler, where your site's tags cannot see the confirmation. Hippo counts the click and the call from your pages and the completed booking through its scheduling connections, so the campaign report shows appointments, consults and calls together.
Our patient portal is linked from our website. Does that matter?
Yes. HHS says tracking on a patient portal's logged-in pages(opens in a new tab) generally has access to PHI, and that part of its guidance still stands. If your site's tags also load on the portal pages, or follow the patient into them, they can carry what happens there. Hippo keeps ad tags off logged-in pages and sends nothing from them, so the portal stays out of what Google and Meta receive.
We already run call tracking. Is that the problem?
It can be part of it. One of the dermatology complaints names the practice's call-tracking vendor as a recipient of what visitors typed into its forms. Keep the call tracking if you use it; what matters is what each tag on the page sends and to whom. Hippo ties the call, the form and the booking to the campaign and sends Google and Meta a conversion with nothing that identifies the patient.
Our agency runs the ads. Who installs this, and who owns the data?
We install it for you on a subdomain of your own domain; the agency keeps running the campaigns and sees the same conversions in Google Ads and Meta. The account, the conversions and the log are yours, whichever agency you work with next year.
We are an independent practice. Aren't the lawsuits against the private-equity platforms?
No. The two dermatology practices sued over website tracking are independents: a 23-location group in Illinois and Florida, which agreed to pay up to $1 million, and a ten-location group in Illinois and Iowa, whose case is pending. The platforms' cases so far are data breaches, not tracking.
We have a cookie banner. Isn't that consent?
Not for what the booking page sends. HHS says a cookie banner is not a HIPAA authorization(opens in a new tab), and the wiretap claims in the dermatology cases turn on what the appointment page disclosed, which a banner does not change. Hippo waits for consent where it is required and removes identifiers before anything reaches Google or Meta.
We run a telederm line that prescribes online. What changes?
Two things. Promoting a prescription by name needs LegitScript certification(opens in a new tab) and the platforms' own authorization, which certifies your licensing and says nothing about what your site sends them. And the online intake carries the condition on every step, so the events that leave it must name no drug and no condition. The telederm case above is under California's privacy and medical-confidentiality laws, which reach a provider whatever its HIPAA status.
Should we talk to a lawyer about the tracking on our website?
Yes, if you want to know how these laws apply to your practice. This page describes laws, policies and court cases for general information and is not legal advice. Hippo handles the tracking; an attorney can advise you on your obligations.
Other industries
Therapists & Group Practices
See which campaigns bring new clients.
Addiction Treatment & Recovery
Connect campaign spend to intake inquiries.
Ketamine Clinics
Measure consultation bookings by campaign.
Telehealth
Understand what drives online bookings.
Pharmacy
See which campaigns bring transfers and refills.
Mens Health
Compare acquisition across your campaigns.
Womens Health & Fertility
See which campaigns drive consultations.
Dental
Know your cost per booked patient.
Med Spas
See which promotions get booked.
Dermatology
Connect campaign spend to appointments.
Eye Care & LASIK
See which campaigns book consultations.
Imaging & Radiology
Measure calls and booking inquiries.
Primary Care & Multi Specialty Groups
See which campaigns bring new patients.
Urgent Care
See which campaigns bring walk-ins and online check-ins.
Labs & at Home Testing
Understand which campaigns drive inquiries.
Medicare & ACA Agencies
See which campaigns bring quote requests and calls.
Hospitals & Health Systems
Connect campaigns to appointment inquiries.
Consumer Apps & Devices
See which campaigns bring trials, subscriptions and orders.