Loading
Know which ads book consults and treatments, without telling Google or Meta who booked.
Hippo is compliant ad tracking for med spas and aesthetic practices. It counts the booked consults, calls and treatments your ads produce, in an account you own, and keeps client identities and treatments out of what Google and Meta receive.
No annual contracts.
Transparent pricing.
We set it up for you.
A med spa client starts as a booked consult, and most owners meet Google's drug rules the day the Botox page is marked Eligible (limited)
Most med spa owners meet Google's healthcare rules the day the Botox landing page is marked "Eligible (limited)". Google restricts prescription drug terms(opens in a new tab), and Botox, Dysport, Xeomin and semaglutide are on its list of prescription drugs(opens in a new tab): you can name them on the page, and you must be certified to bid on them(opens in a new tab). The path itself runs from ad click to a consult booked in your scheduler or a call, then the consult, the treatment and the membership that follows.
The booking usually finishes in a scheduler or a CRM your agency set up, and most new clients still call. What the account counts as a conversion decides whether the numbers mean anything.
What is worth counting:
- a consult booked in your scheduler
- a call from an ad that books a visit
- a treatment booked online
- for a weight-loss program, a completed intake
What isn't:
- clicks
- lead-form starts
- page views
A promotion can fill the inbox with leads who never book.
Here is the sum, with example numbers.
The sum, with example numbers
- Ad spend a month
- $3,000
- Booked consults
- 50
- Cost per booked consult
- $60
- Consults that become paying clients
- one in two
- A new client costs
- about $120
Example figures. Put in your own. Each line needs a count you trust, and the last one needs the campaign it came from.
Try the sum with your own numbers. If the booked consults are not tied to campaigns, that is the gap Hippo closes. It records the booking, the call and the form, ties each to the campaign that produced it, and sends the conversion to Google and Meta without the name, email, phone number, IP address or treatment.
What med spa owners and their marketers say
They can't tell what's working
Leads in one tool, calls in another, and no line from the ad to the money.
We don't use Google ads because I find it harder to track how many leads are coming in. With Facebook, I can see the results clearly
Owner, med spa nobody could answer the only question that actually matters: Why is the business making money? Not "how many leads." Not "what the CPM was."
CMO, two-location med spa I allowed someone to change mine from within google & I've gotten even less calls since... I've spent way more than ever received.
Owner, med spa 
They worry about getting flagged
A Botox page that stops serving, a certification that does not lift it, and a flag that comes back.
Our Botox landing page is being marked Eligible (limited) under Google's Restricted Drug Terms policy, which in practice means our ads don't run.
Owner, aesthetics clinic The Legitscript fee is obnoxious but I paid it anyway... Still flagged... This is some sort of pay to play game and I'm paying but not playing.
Owner, aesthetics clinic we've run into this on and off for the last 5 years... you'll likely run into this again. It's a huge pain
In-house marketing director, med spa
Google and Meta treat injectables as health content, and that shapes what you can measure
Google restricts prescription drug terms(opens in a new tab) in ads, landing pages and keywords; you can name Botox on the page, and you must be certified to bid on it(opens in a new tab). A campaign that runs under the rule is labeled "Eligible (limited)"(opens in a new tab). Separately, Google treats invasive procedures, including injections and cosmetic surgery(opens in a new tab), as a sensitive health category, so you cannot use your own audience lists(opens in a new tab): no Customer Match, no remarketing lists, no lookalikes. Health conversions cannot be measured with enhanced conversions(opens in a new tab) or offline uploads, and Google does not offer a BAA for Google Analytics(opens in a new tab).
Hippo changes none of that. It does not lift the label, replace certification or clear a trademark, adds no words, keywords or claims to your site, and changes no ad copy. It measures what happens after the click.
Meta
Meta allows ads for injectables, fillers and laser treatments to people 18 and older(opens in a new tab); a spa that promotes semaglutide or tirzepatide by name is promoting a prescription drug and needs LegitScript certification and Meta's authorization(opens in a new tab). Separately, Meta sorts data sources into categories, and a site that books treatment is a candidate for the health and wellness one, whose named examples begin with a patient portal(opens in a new tab). That category can block lower-funnel events(opens in a new tab) such as Lead and Schedule, blocks custom events until they are reviewed(opens in a new tab), and you cannot change the category Meta assigns(opens in a new tab).
Meta's rules name medical procedures, treatments and testing(opens in a new tab) among the information it must not receive, the rule covers the names of your events(opens in a new tab), and its core setup strips anything in a URL after the domain(opens in a new tab). An event called "lip filler consult" breaks it. Meta states that its own filters are no substitute for yours(opens in a new tab).
An event name, before and after
"lip filler consult"Breaks Meta's terms
A neutral event nameWhat Hippo sends
Sent without the client's
- name
- phone number
- IP address
- treatment
With audiences closed off and lower-funnel events restricted, the events that still flow are what steer bidding. Hippo sends them under neutral names that carry no treatment and nothing that identifies the client, and keeps a log of booked consults by campaign that is yours whatever Meta blocks.
Sources: Google, Restricted drug terms(opens in a new tab) · Google, Prescription drug list(opens in a new tab) · Google, Healthcare and medicines(opens in a new tab) · Google, Health in personalized advertising(opens in a new tab) · Google, Personalized advertising(opens in a new tab) · Google, Customer data policies(opens in a new tab) · Google, HIPAA and Google Analytics(opens in a new tab) · Meta, Health and wellness(opens in a new tab) · Meta, Drugs and pharmaceuticals(opens in a new tab) · Meta, Data source categories(opens in a new tab) · Meta, Data sharing restrictions(opens in a new tab) · Meta, About prohibited information(opens in a new tab) · Meta, Core setup(opens in a new tab). As of 10/7/26.
Where HIPAA applies, and the wiretap laws that reached the cash-pay spas
Federal
Where HIPAA applies
A practice that submits claims electronically(opens in a new tab) to a health plan is a covered entity; a cash-only med spa may not be. The cases below did not turn on HIPAA. They were pleaded under wiretap and privacy laws that reach any business whose booking page sends what a visitor typed to an ad platform.
Federal
Federal Wiretap Act
$10,000It allows statutory damages of $10,000 per plaintiff, and no proof of harm. In September 2026 a federal court dismissed a body-contouring chain's California claims and kept the federal wiretap claim, which reaches every state.
State
Florida
The Security of Communications Act(opens in a new tab) allows $100 a day or $1,000 per plaintiff, punitive damages and attorney's fees. It was pleaded in the laser-and-injectables chain's settlement in Florida state court.
State
California
$5,000The state's privacy law(opens in a new tab) sets $5,000 per violation with no proof of harm. It is the statute behind the demand letters med spas in California receive about the tags on their booking pages.
State
Washington
The My Health My Data Act(opens in a new tab) covers health data HIPAA does not, which for a cash-only spa is all of it, including the visitor who read your treatment page and never booked. Sharing needs consent separate from the consent to collect.
Federal
FTC Act and the Health Breach Notification Rule
$53,088For a weight-loss program that prescribes online and sits outside HIPAA, the Health Breach Notification Rule(opens in a new tab) counts an unauthorized disclosure to an advertiser as a breach, with civil penalties of up to $53,088 per violation.
Enforcement in Med Spas
Ideal Image(opens in a new tab)
Up to $3.5 million
Ideal Image, the laser and injectables chain, settled claims(opens in a new tab) that the Meta Pixel and other trackers on its consultation-scheduling pages shared visitors' information, under Florida, California and federal wiretap law. The settlement caps its total payment at $3.5 million, and payments for approved claims were issued on September 30, 2026(opens in a new tab).
Sono Bello(opens in a new tab)
Pending
A patient alleges that Sono Bello(opens in a new tab), the body-contouring chain, sent Meta information including the conditions patients sought treatment for and their body-image concerns. In September 2026 the court dismissed the California claims and kept the federal wiretap claim(opens in a new tab). The case is pending and the claims are allegations.
Milan Laser(opens in a new tab)
Pending
A customer sued Milan Laser(opens in a new tab), the laser hair removal chain, in May 2026, alleging that Meta and Google trackers on the pages where people booked a free consult sent their name, email, location and appointment details. The case is pending and the claims are allegations.
Derick Dermatology(opens in a new tab)
Up to $1 million
Derick Dermatology, a dermatology and aesthetics practice in Chicago and Tampa Bay, agreed to pay up to $1,000,000(opens in a new tab) to settle claims over tracking on the website where patients made appointments. The final approval hearing was set for August 2026.
Core Dermatology & Medspa(opens in a new tab)
Pending
A patient alleges that a ten-location dermatology and med spa practice(opens in a new tab) sent what visitors typed into its consult and appointment forms to Google, Meta and its call-tracking vendor. The case was filed in April 2026, is pending, and the claims are allegations.
What the cases have in common:
The pages were booking pages.
Every case was pleaded on the consult or appointment flow, where the treatment is named.
The tools were ordinary.
The Meta Pixel, Google's tags and, in one case, a call-tracking vendor's tag.
Cash-pay did not keep them out of court.
The claims were under wiretap and privacy law, not HIPAA.
The federal Wiretap Act reaches any med spa with a booking page, and state laws in Florida, California and Washington add their own damages.
See what your booking page sends to Google and Meta →(opens in a new tab)How Hippo works
Your website
Book your appointment
Book now
Call us
Booking
Call
Hippo
Records events
Removes identifying information
Sends clean conversion data
Excluded from conversion events
Names
Conditions
IP addresses
Clean conversion events only
Google / Meta
Booking
Call
Remove the pixels that send PHI.
Take the Google and Meta pixels off your site.
Paste one snippet.
Hippo records visits, bookings, and calls, then removes client names, health details, and IP addresses from the conversion events sent to Google and Meta.
Send clean conversions back to Google and Meta.
Google and Meta receive conversion signals they can use to optimize your campaigns. Client names, health details, and IP addresses stay out of those events.
With your scheduler, your CRM and your phones untouched. Hippo runs on your own domain and records the booking, the call and the form. Your scheduler, your CRM and your EMR stay as they are; what changes is what leaves the page. If an agency runs your ads, they keep their reporting and you keep the data and the accounts.
If your bookings finish on your scheduler's own page, Hippo counts them through its scheduling connections, so a booking that happens off your site still lands on the campaign that produced it.
Supported integrations
Hippo works with the ad platforms and website tools your practice already uses.
Conversion
Hippo
What you get
Booked consults, by campaign
See which campaigns led to consult requests and bookings, and what each one cost.
Your numbers, in your account
An independent record of results in an account you own. If you change agencies, it stays with you.
Call tracking
Calls that start from an ad are counted as conversions alongside forms and bookings.
A record of what was sent
A log of every event that went to Google and Meta and what was removed from it first.
Pricing
1,000 visitors/month
$99/month
Month to month.
Start now, no demo call1,000 visitors/month(opens in a new tab)2,000 visitors/month
$199/month
Month to month.
Start now, no demo call2,000 visitors/month(opens in a new tab)10,000 visitors/month
$299/month
Month to month.
Start now, no demo call10,000 visitors/month(opens in a new tab)
Every plan includes:
- BAA signed at checkout
- No setup fees
- Cancel anytime. No compliance add-on that locks you in the day you enable it.
Server-side conversion tracking under a BAA, at a price a practice can actually pay.
Frequently asked questions
We're cash-pay and not a covered entity. Does any of this apply to us?
Yes. None of the aesthetics cases needed HIPAA. Ideal Image settled under Florida, California and federal wiretap law; the federal wiretap claim against Sono Bello survived a motion to dismiss in September 2026; Milan Laser was sued under federal and Maryland wiretap law. Those laws turn on what a booking page sends to an ad platform, not on whether the spa bills insurance.
Our Botox page is "Eligible (limited)". Will tracking fix that?
No. Google restricts prescription drug terms(opens in a new tab), Botox is on its list, and bidding on it requires certification(opens in a new tab). Hippo does not change ad approval, certification or the label. What it changes is what your site sends after the click, so the campaigns that do run steer on a clean signal.
Do we need LegitScript, and does Hippo replace it?
LegitScript certification(opens in a new tab) is what Google and Meta require of businesses that prescribe online, such as a weight-loss program run by telehealth. It certifies your licensing and business practices to the platforms and says nothing about what your website sends them. Hippo touches no ad copy, keyword, landing page or certification.
Meta cut our Lead and Schedule events. Can Hippo get them back?
No. Hippo cannot lift a category Meta has assigned, and you cannot change it(opens in a new tab) either; under the health and wellness category Meta blocks specific mid- and lower-funnel events(opens in a new tab). What a compliant feed changes is what still flows: a booking sent with no treatment in the name, no URL path and nothing that identifies the client, and a log of booked consults by campaign that is yours whatever Meta blocks.
Can we promote Botox on Meta at all?
Yes, to adults. Meta allows ads for injectables, fillers and laser treatments to people 18 and older(opens in a new tab), and before-and-after images for cosmetic procedures. Promoting a prescription weight-loss drug by name is different: it needs LegitScript certification and Meta's authorization(opens in a new tab).
Our bookings happen in our scheduler's widget, not on our page. Can you count them?
Yes. Most med spa schedulers either open on their own page or sit in a widget your site's tags cannot see inside. Hippo counts the click and the call from your page and the completed booking through its scheduling connections, so the campaign report shows booked consults, calls and forms together.
Our agency set up our CRM and landing pages. Who owns the data?
You do. We install Hippo for you on a subdomain of your own domain, and the conversions and the log belong to your account, whichever agency runs the ads. If the agency also hosts your landing pages and CRM, ask for admin access to the ad accounts and the data before anything else.
We added a GLP-1 weight-loss line. What changes?
Two things. A spa that prescribes online is a telemedicine provider to Google and Meta and needs LegitScript and their authorization to promote the drug by name. And a weight-loss intake carries health information on every step, so the events that leave it must name no drug and no condition. Outside HIPAA, the Health Breach Notification Rule(opens in a new tab) treats a disclosure to an advertiser as a breach.
We have a cookie banner. Isn't that consent?
Not for what the booking page sends. HHS says a cookie banner is not a HIPAA authorization(opens in a new tab), and the wiretap claims in the aesthetics cases turn on whether the spa disclosed what a visitor typed into the booking flow, which a banner does not change. Hippo waits for consent where it is required and removes identifiers before anything reaches Google or Meta.
Regulators are going after med spa GLP-1 ads. Does Hippo help with that?
No. The FDA's warning letters(opens in a new tab) and the state attorneys general concern what the ads and the product pages claim. Those are advertising matters between you, your counsel and the platforms. Hippo covers one thing: what your website sends to Google and Meta after the click.
Should we talk to a lawyer about the tracking on our website?
Yes, if you want to know how these laws apply to your practice. This page describes laws, policies and court cases for general information and is not legal advice. Hippo handles the tracking; an attorney can advise you on your obligations.
Other industries
Therapists and Group Practices
See which campaigns bring new clients.
Addiction Treatment and Recovery
Connect campaign spend to intake inquiries.
Ketamine Clinics
Measure consultation bookings by campaign.
Telehealth
Understand what drives online bookings.
Mens Health
Compare acquisition across your campaigns.
Womens Health and Fertility
See which campaigns drive consultations.
Dental
Know your cost per booked patient.
Med Spas
See which promotions get booked.
Dermatology(opens in a new tab)
Connect campaign spend to appointments.
Imaging and Radiology(opens in a new tab)
Measure calls and booking inquiries.
Primary Care and Multi Specialty Groups(opens in a new tab)
See which campaigns bring new patients.
Urgent Care(opens in a new tab)
See which campaigns bring walk-ins and online check-ins.
Labs and at Home Testing(opens in a new tab)
Understand which campaigns drive inquiries.
Hospitals and Health Systems(opens in a new tab)
Connect campaigns to appointment inquiries.
Consumer Apps & Devices(opens in a new tab)
See which campaigns drive website inquiries.