Loading
Know which ads book free tests and consults, without telling Google or Meta who came in.
Hippo is compliant ad tracking for men's health clinics and telehealth brands. It counts the free tests, consults and first orders your ads produce, and keeps patient identities and the treatment out of what Google and Meta receive.
No annual contracts.
Transparent pricing.
We set it up for you.
A men's health patient starts as a free test, and since October 2025 the test is what you can advertise
Since October 2025 a clinic that is not certified cannot bid on the drug names, and what it can still advertise is the free testosterone test or the consult. For a clinic the path runs from ad click to a booking or a call, then the test, then a treatment plan. For a telehealth brand it runs from ad click to an intake form, then the first paid order.
The booking and the call happen on your site; the treatment decision happens in the room or in the chart. What the account counts as a conversion decides whether the numbers mean anything.
What is worth counting:
- a booked free test or consult
- a call that came from an ad
- for a telehealth brand, a completed intake and the first paid order
- a membership started
What isn't:
- clicks
- quiz starts
- page views
A campaign can fill the calendar with people who will never start treatment.
Here is the sum, with example numbers.
The sum, with example numbers
- Ad spend a month
- $4,000
- Booked free tests
- 50
- Cost per booked test
- $80
- Tests that become patients
- one in four
- A new patient costs
- about $320
Example figures. Put in your own. Each line needs a count you trust, and the last one needs the campaign it came from.
Try the sum with your own numbers. If the patients are not tied to campaigns, that is the gap Hippo closes. Hippo cannot lift a category Meta has assigned or make an uncertified clinic eligible for drug keywords. It records the booking, the call and the first order on your own site, ties each to the campaign that produced it, and sends the conversion to Google and Meta without the name, email, phone number, IP address, test result or treatment.
What clinic owners and their marketers say
They can't tell what's working
Three consultants, ten conversions a campaign, and no way to see what changed.
We’ve cycled through three different marketing consultants, tried optimizing for both high- and low-funnel events, and have hit 10+ conversions on most campaigns—yet performance hasn’t improved meaningfully.
In-house marketer, telehealth startup one of our conversion events is when a user creates an account with us. In our system, I see 10, but meta only shows 1 (many times none).
In-house marketer, telehealth company I'm starting to wonder—could skipping Google's native pixel be slowing down how quickly their ML can optimize our campaigns?
In-house marketer, telehealth startup 
They worry about getting restricted
Events blocked by Meta, nobody to call, and turnkey fixes that turned out not to be compliant.
I run a small telemedicine business and our events have been restricted because of HIPAA... recommendations for a freelance-type martech person that can help us set this up in a compliant way? And what would that cost?
Owner, small telemedicine business For healthcare, I wouldn’t DIY this unless you already know the compliance side really well. The setup is not just CAPI, it’s controlling what data/events never get sent in the first place.
Agency running Meta ads for healthcare clients I've seen people in similar health niches get burned by "turnkey" solutions that weren't actually compliant or scalable.
Founder, TRT telehealth startup
Google and Meta treat the drug as the problem, and the consult as the way around it
Google restricts prescription drug terms in ads, landing pages and keywords(opens in a new tab), and since October 29, 2025 you must be certified to keyword-target them(opens in a new tab). A clinic advertising a free test or a consult needs no certification; the moment its keywords name a listed drug such as tadalafil, finasteride or semaglutide, it does, and a telehealth brand that prescribes is certified as a telemedicine provider(opens in a new tab) before it runs at all.
Hippo changes none of that. It does not get ads approved, does not replace LegitScript or Google's certification, and adds no words, keywords or claims to your site. It measures what happens after the click.
Health content, sexual health included(opens in a new tab), is a sensitive interest category, so you cannot use your own audience lists(opens in a new tab): no Customer Match, no remarketing lists, no lookalikes. Conversions tied to sensitive categories cannot be measured with enhanced conversions(opens in a new tab), and Google does not offer a BAA for Google Analytics(opens in a new tab).
Meta
Promoting telehealth services generally(opens in a new tab) needs no authorization from Meta, and ads for erectile dysfunction are allowed(opens in a new tab) when the focus is health. A brand promoting a prescription drug needs LegitScript certification and Meta's authorization(opens in a new tab). Separately, Meta sorts data sources into categories, telemedicine platforms are a named example(opens in a new tab) of the health and wellness one, that category can block lower-funnel events(opens in a new tab) such as Lead and Purchase, and you cannot change the category Meta assigns(opens in a new tab).
Meta's rules name sexual and reproductive health(opens in a new tab) and prescription medication(opens in a new tab) among the information it must not receive, and the rule covers the names of your events(opens in a new tab). An event called "TRT consult booked" breaks it. Meta states that its own filters are no substitute for yours(opens in a new tab).
An event name, before and after
"TRT consult booked"Breaks Meta's terms
A neutral event nameWhat Hippo sends
Sent without the patient's
- name
- phone number
- IP address
- test result
With audiences closed off and lower-funnel events restricted, the events that still flow are what steer bidding. Hippo sends them under neutral names that carry no condition, no treatment and nothing that identifies the patient, and keeps a log of bookings by campaign that is yours whatever Meta blocks.
Sources: Google, Healthcare and medicines(opens in a new tab) · Google, Restricted drug terms(opens in a new tab) · Google, Health in personalized advertising(opens in a new tab) · Google, Personalized advertising(opens in a new tab) · Google, Customer data policies(opens in a new tab) · Google, HIPAA and Google Analytics(opens in a new tab) · Meta, Drugs and pharmaceuticals(opens in a new tab) · Meta, Health and wellness(opens in a new tab) · Meta, Data source categories(opens in a new tab) · Meta, Data sharing restrictions(opens in a new tab) · Meta, About prohibited information(opens in a new tab). As of 10/7/26.
Where HIPAA applies, and what reaches a cash-pay clinic
Federal
Where HIPAA applies
Providers that submit claims electronically are covered entities(opens in a new tab). A clinic that takes a copay or bills Medicare is in; a membership clinic that never bills a payer may sit outside, and the largest telehealth brand says the same about itself. For a covered clinic, HHS says that when a visitor books through a website that uses third-party tracking, the tracking vendor is a business associate and a BAA is required(opens in a new tab).
Federal
FTC Act
A privacy promise is enforceable. The FTC's complaint against Hims & Hers(opens in a new tab) quotes the words "100% online, private, and secure" and alleges that health information reached Meta and other platforms through customer lists and tracking tools. No HIPAA finding is needed.
Federal
Federal Wiretap Act
$10,000It allows statutory damages of $10,000 per plaintiff, and no proof of harm. It is pleaded in most federal website tracking suits against providers.
State
California
$5,000The state's privacy law(opens in a new tab) sets $5,000 per violation with no proof of harm, and its medical confidentiality law adds nominal damages of $1,000(opens in a new tab) for a negligent release by a provider of health care, whether or not it bills insurance. Call-On-Doc has agreed to a proposed settlement of claims under the first.
State
Washington
The My Health My Data Act(opens in a new tab) covers health data HIPAA does not, including website visitors who never become patients, and requires consent for sharing that is separate from the consent to collect.
Enforcement in Men's Health
LifeMD and RexMD(opens in a new tab)
About $1.1 million
LifeMD, which runs the RexMD men's health brand, settled Nevada claims(opens in a new tab) that tracking tags on its sites disclosed health information. Final approval was granted on September 30, 2025; claimants receive $10 in cash or a $25 voucher, and the company recorded about $1.1 million for the settlement(opens in a new tab) in its annual report.
Hims & Hers(opens in a new tab)
Pending
The FTC, California and Utah sued Hims & Hers on July 29, 2026(opens in a new tab), alleging that health information reached Meta and other platforms through customer lists and through tracking tools. The complaint(opens in a new tab) names the Meta Pixel and the Conversions API and quotes the company's promise of a "100% online, private, and secure" process. The case is pending and Hims denies the allegations.
Call-On-Doc(opens in a new tab)
Proposed
Call-On-Doc, an online urgent care service, agreed to a proposed settlement(opens in a new tab) of claims under California privacy laws over tracking pixels on its web pages, with class members who file a claim receiving up to $20 each. The court granted preliminary approval in May 2026 and held the final approval hearing on August 31, 2026; the settlement site still says the court has to decide whether to approve it. Call-On-Doc denies wrongdoing.
What the cases have in common:
The pages were booking pages and intake forms.
Where ad traffic lands, and where the treatment is named.
The tools were ordinary.
Pixels and tags, and in one case the Conversions API. Server-side is not a defense.
Cash-pay did not keep them out of court.
The claims were under the FTC Act, wiretap law and state privacy law, not HIPAA.
The laws behind these cases reach any clinic or brand whose booking page a California or Washington resident uses, and the FTC's reach is nationwide.
See what your booking page sends to Google and Meta →(opens in a new tab)How Hippo works
Your website
Book your appointment
Book now
Call us
Booking
Call
Hippo
Records events
Removes identifying information
Sends clean conversion data
Excluded from conversion events
Names
Conditions
IP addresses
Clean conversion events only
Google / Meta
Booking
Call
Remove the pixels that send PHI.
Take the Google and Meta pixels off your site.
Paste one snippet.
Hippo records visits, bookings, and calls, then removes patient names, health details, and IP addresses from the conversion events sent to Google and Meta.
Send clean conversions back to Google and Meta.
Google and Meta receive conversion signals they can use to optimize your campaigns. Patient names, health details, and IP addresses stay out of those events.
With your booking form, your phone line and your EHR untouched. Hippo runs on your own domain and records the booking, the call and the first order where they happen. Your scheduler, your intake flow and your chart stay as they are; what changes is what leaves the page. If an agency runs your account, they keep their reporting and you keep the data.
Installing Hippo adds no words, keywords or claims to your site and changes no ad copy, so it touches nothing Google reviews when it decides whether your ads are eligible.
Supported integrations
Hippo works with the ad platforms and website tools your practice already uses.
Conversion
Hippo
What you get
Booked tests and consults, by campaign
See which campaigns led to consult requests and bookings, and what each one cost.
Your numbers, in your account
An independent record of results in an account you own. If you change agencies, it stays with you.
Call tracking
Calls that start from an ad are counted as conversions alongside forms and bookings.
A record of what was sent
A log of every event that went to Google and Meta and what was removed from it first.
Pricing
1,000 visitors/month
$99/month
Month to month.
Start now, no demo call1,000 visitors/month(opens in a new tab)2,000 visitors/month
$199/month
Month to month.
Start now, no demo call2,000 visitors/month(opens in a new tab)10,000 visitors/month
$299/month
Month to month.
Start now, no demo call10,000 visitors/month(opens in a new tab)
Every plan includes:
- BAA signed at checkout
- No setup fees
- Cancel anytime. No compliance add-on that locks you in the day you enable it.
Server-side conversion tracking under a BAA, at a price a practice can actually pay.
Frequently asked questions
We're cash-pay. HIPAA doesn't apply to us, so why does website tracking matter?
The cases in this industry did not need HIPAA. The FTC sued Hims & Hers under the FTC Act over the promise "100% online, private, and secure"; LifeMD settled claims over tags on RexMD's site; Call-On-Doc agreed to a proposed settlement of California privacy claims over pixels on its web pages. Those laws reach any site a California or Washington resident uses, and the FTC's reach is nationwide. HIPAA applies the moment you submit a claim electronically(opens in a new tab).
Since October 2025 we can't bid on the drug names. What is left to measure?
What you can advertise: the free test or the consult booked from a campaign. Google restricts prescription drug terms(opens in a new tab) and requires certification to keyword-target them(opens in a new tab); a clinic advertising a consult needs none. That booking, and the call from the ad, are the conversions Hippo sends to Google Ads and Meta, without the test result or the treatment attached.
Does Hippo get our ads approved, or replace LegitScript?
No. Google requires certification to keyword-target drug terms and for telemedicine providers(opens in a new tab); Meta requires telehealth providers promoting prescription drugs to be LegitScript-certified and authorized by Meta(opens in a new tab). LegitScript certifies your licensing and business practices to the platforms and says nothing about what your website sends them. Hippo touches no ad copy, keyword, landing page or certification. It measures what happens after the click.
Meta put our site in the health and wellness category and blocked our Lead and Purchase events. Can Hippo lift that?
No. Meta assigns the category, you cannot change it(opens in a new tab), and it blocks specific mid- and lower-funnel events(opens in a new tab) when it does. What a compliant feed changes is which events still flow and how clean they are: a booking or a first order sent with no custom parameters, no URL path and no condition in the event name, and a log of bookings by campaign that is yours whatever Meta blocks.
We already send events server-side through the Conversions API. Isn't that the fix?
Transport is not de-identification. The FTC's complaint against Hims & Hers(opens in a new tab) names the Meta Pixel and the Conversions API together as the two ways health information reached Meta, and Meta's rules say event names must not imply(opens in a new tab) a condition or a treatment by any route. What matters is what leaves. Hippo removes the name, email, phone number and IP address and keeps the treatment out of the event before anything is sent, and keeps a log you can show.
Our franchisor runs the website and the booking page. What can a single location do?
When the booking page lives on the brand's domain, the tags on it are the franchisor's. A location that advertises its own landing page or phone number can measure those; the brand's booking flow is the franchisor's to fix. Send them this page.
We got an FDA letter about our compounded GLP-1 claims. Does Hippo help with that?
No. The FDA's warning letters to telehealth companies(opens in a new tab) concern claims that compounded products are the same as FDA-approved drugs, and the state attorneys general letters concern weight-loss ad content. Those are advertising-claims matters between you, your counsel and the platforms. Hippo covers one thing: what your website sends to Google and Meta after the click.
Should we talk to a lawyer about the tracking on our website?
Yes, if you want to know how these laws apply to your clinic or brand. This page describes laws, policies and court cases for general information and is not legal advice. Hippo handles the tracking; an attorney can advise you on your obligations.
Other industries
Therapists and Group Practices
See which campaigns bring new clients.
Addiction Treatment and Recovery
Connect campaign spend to intake inquiries.
Ketamine Clinics
Measure consultation bookings by campaign.
Telehealth
Understand what drives online bookings.
Mens Health
Compare acquisition across your campaigns.
Womens Health and Fertility
See which campaigns drive consultations.
Dental
Know your cost per booked patient.
Med Spas(opens in a new tab)
See which promotions get booked.
Dermatology(opens in a new tab)
Connect campaign spend to appointments.
Imaging and Radiology(opens in a new tab)
Measure calls and booking inquiries.
Primary Care and Multi Specialty Groups(opens in a new tab)
See which campaigns bring new patients.
Labs and at Home Testing(opens in a new tab)
Understand which campaigns drive inquiries.
Hospitals and Health Systems(opens in a new tab)
Connect campaigns to appointment inquiries.
Consumer Apps & Devices(opens in a new tab)
See which campaigns drive website inquiries.