Loading
HIPAA Compliant Conversion Data for Klaviyo
Klaviyo's policy bars health information in Klaviyo. Its onsite tracking comes off your pages with the ad tags, and nothing from Hippo goes to Klaviyo. Hippo sends your bookings, calls and forms to Google Ads and Meta (Facebook) with no protected health information, and you see which campaigns bring patients, in an account you own.
No annual contracts.
Transparent pricing.
We set it up for you.
Klaviyo Is Not HIPAA Compliant by Default
Klaviyo's acceptable use policy bars storing or sending medical records or health information, including Protected Health Information, in the Klaviyo platform. Klaviyo offers no BAA (as of 10/13/26), and the policy is part of the binding agreement a customer accepts with Klaviyo's terms of service.
Enforcement
Klaviyo can shut your account down
If Klaviyo decides, in its sole discretion, that you violated its policy, it can immediately suspend, terminate or limit your access(opens in a new tab). Your lists and flows live in that account.
What it sends
Klaviyo's script records visits by people it can identify
Whenever a browser it can identify visits your site, its onsite tracking records the URL of the page visited(opens in a new tab). A subscriber who clicks through from your Klaviyo newsletter to your page on one treatment can put that page's address on their Klaviyo profile.
Workaround
A connector doesn't change the rule
Klaviyo makes businesses that build or offer integrations with it responsible for ensuring their integrations do not reasonably enable(opens in a new tab) uses its policy bars. The ban on health information holds whichever tool sends it into Klaviyo.
How Hippo sends Google Ads and Meta your conversions
Your website
Book your appointment
Book now
Call us
Booking
Form
Number tap
Hippo
Records events
Removes identifying information
Sends clean conversion data
Excluded from conversion events
Names
Conditions
IP addresses
Clean conversion events only
Google Ads and Meta
Booking
Form
Number tap
The tracking comes off.
We take the ad tags and Klaviyo's onsite tracking off your pages and install Hippo on a subdomain of your domain. Tools you keep, like a scheduler or a payment form, keep their own code.
Hippo cleans the conversion.
When a patient who clicked your ad books, sends a form or calls, Hippo prevents protected health information from reaching Google Ads and Meta in the conversion it sends, and gives the conversion a name that implies no condition, treatment or service.
Google Ads and Meta get the conversion.
Hippo sends it from its server to Google Ads and through Meta's Conversions API, and keeps its own record of it by the campaign that produced it. Whoever runs your ads sees it arrive in Google Ads and in Meta's Events Manager.
What Google Ads and Meta receive
Sent
Sent: the conversions you choose, with no protected health information
Hippo sends Google Ads and Meta only the conversions you allow, under neutral names. Klaviyo gets nothing from Hippo. Hippo waits for consent where it is required.
Excluded
Excluded from conversion events
Names, emails, phone numbers, dates of birth and IP addresses, plus URL paths and anything typed into a form.
Held
Held until you allow it
An event Hippo doesn't recognize stays in Hippo, so a new form can't start sending to Google Ads or Meta on its own.
Kept
Kept in Hippo, under your BAA
Hippo stores what it records in its own storage under the BAA it signs with every customer, with a log of what Hippo sent Google Ads and Meta and what it removed first.
A lawsuit over marketing automation tracking on a health site
Axia Women's Health(opens in a new tab)
Pending
A website user alleges that Adobe Marketo Engage Munchkin was one of at least five trackers that collected what visitors viewed and searched for on the women's health system's site, where patients look for care and request appointments. The complaint(opens in a new tab) says Munchkin connects the site to a marketing automation platform whose data can feed targeted email.
The complaint counts a marketing automation script among the trackers on a health system's own website.
See what your site sends to Google Ads and Meta(opens in a new tab)What you get
Ad conversions, by campaign
Bookings, calls and forms from your Google Ads and Meta campaigns, recorded in your Hippo account by the campaign that produced them, whatever each platform does with the conversion.
Your numbers, in your account
An independent record of results in an account you own. If you change agencies, it stays with you.
Call tracking
Calls that start from an ad are counted as conversions alongside forms and bookings.
A record of what was sent
A log of what Hippo sent Google Ads and Meta and what it removed first.
Supported integrations
Hippo works with the ad platforms and website tools your practice already uses.
Pricing
1,000 visitors/month
$99/month
Month to month.
Start now, no demo call1,000 visitors/month2,000 visitors/month
$199/month
Month to month.
Start now, no demo call2,000 visitors/month10,000 visitors/month
$299/month
Month to month.
Start now, no demo call10,000 visitors/month
Every plan includes:
- BAA signed at checkout
- No setup fees
- Cancel anytime. No compliance add-on that locks you in the day you enable it.
Server-side conversion tracking under a BAA, at a price a practice can actually pay.
Frequently asked questions
Is Klaviyo HIPAA compliant? Will Klaviyo sign a BAA?
Not for health information. Klaviyo offers no BAA, and its acceptable use policy(opens in a new tab) bars customers from storing or sending medical records or health information, including Protected Health Information, in the Klaviyo platform. That policy is part of the agreement(opens in a new tab) you accept with Klaviyo's terms of service. What your pages and forms send Klaviyo is your responsibility.
If Klaviyo offers no BAA, what do we use for patient emails and texts?
A service that signs a BAA with you, for any message that carries protected health information. Under HIPAA, a practice covered by the rule may share PHI with a vendor that handles it on the practice's behalf only after the vendor gives satisfactory assurance(opens in a new tab) that it will safeguard the information, and the rule requires that assurance in a written contract, which is the BAA. Hippo handles the conversions from your ads and sends no emails or texts.
Can a business like ours use Klaviyo at all? Will Klaviyo shut our account down?
That is Klaviyo's decision. Its policy bars using Klaviyo to offer products or services related to(opens in a new tab) a list of categories that ends with prescription medications, pharmaceutical products or services, medical therapies and telehealth, and Klaviyo does not define medical therapies. If Klaviyo decides, in its sole discretion, that you violated the policy, it can suspend, terminate or limit your access. Where your services fall is a question for Klaviyo or an attorney.
What can we still send Klaviyo? Can we sync bookings or treatments?
Klaviyo allows other non-sensitive data relating to end customers(opens in a new tab) and bars health information, PHI included, without saying which data count as non-sensitive. HIPAA's definition of health information reaches what a provider creates or receives about a person's past, present, or future physical or mental health(opens in a new tab) or their care. Whether your bookings or treatment history belong in Klaviyo is a question for your attorney. Hippo sends Klaviyo none of it.
Klaviyo's script is on our site. Do we keep it?
Not its tracking. We take Klaviyo's onsite tracking off your pages along with the ad tags. Whenever a browser Klaviyo can identify visits your site, it records the address of the page visited, and its tracking cookies collect behavioral data that is not required(opens in a new tab) for your site to function. Your Klaviyo account stays yours to run under Klaviyo's rules, and Hippo sends Klaviyo nothing in place of the tracking. On a walkthrough we go through what Klaviyo's script runs on your pages.
Does Hippo send our conversions or contacts to Klaviyo?
No. Hippo sends Klaviyo nothing and takes nothing from it. Klaviyo's policy bars health information, and Klaviyo makes the businesses that build integrations with it responsible for ensuring their integrations do not reasonably enable a customer's violation. Hippo's part is your ad conversions: it sends Google Ads and Meta the conversions you choose, under neutral names, with no protected health information.
What do Google Ads and Meta receive?
The conversions you choose, each under a name that implies no condition, treatment or service. Google Ads and Meta are outside the BAA you sign with Hippo, so Hippo prevents protected health information from reaching them in the conversions it sends: names, emails, phone numbers, dates of birth and IP addresses come off first. URL paths stay out of the conversion, and so does anything typed into a form. Meta's terms bar data based on health information(opens in a new tab) and event names that imply it(opens in a new tab), and Google bars conversions related to health from enhanced conversions(opens in a new tab). Each platform's rules are on our Google Ads(opens in a new tab) and Meta(opens in a new tab) pages.
Our agency runs our ads and our Klaviyo account. Who sets this up?
We do. Whoever controls your domain adds a DNS record for your Hippo subdomain. We install Hippo and take the ad tags and Klaviyo's onsite tracking off your pages, then connect Hippo to your Google Ads and Meta accounts. Your agency keeps running the campaigns, sees the conversions arrive in Google Ads and Meta's Events Manager, and keeps running your Klaviyo account under Klaviyo's rules.
Meta restricted our events. Can Hippo get them back?
No. Hippo cannot lift a category Meta has assigned or restore an event Meta blocks, and it never renames an event to get past a restriction. Meta can restrict certain mid and lower funnel standard events(opens in a new tab) on sites it puts in its health and wellness category, and under data restrictions, custom events stay blocked until you review(opens in a new tab) and confirm them. Hippo still records your bookings, calls and forms by campaign, whatever Meta blocks.
Should we talk to a lawyer about Klaviyo and our tracking?
Yes, if you want to know how these laws apply to your business. This page describes Klaviyo's terms, laws and court cases for general information and is not legal advice. Hippo handles the tracking; an attorney can advise you on your obligations. Hippolytics is not affiliated with, endorsed by or sponsored by Klaviyo.
Hippo by industry
Therapists & Group Practices
See which campaigns bring new clients.
Addiction Treatment & Recovery
Connect campaign spend to intake inquiries.
Ketamine Clinics
Measure consultation bookings by campaign.
Telehealth
Understand what drives online bookings.
Pharmacy
See which campaigns bring transfers and refills.
Mens Health
Compare acquisition across your campaigns.
Womens Health & Fertility
See which campaigns drive consultations.
Dental
Know your cost per booked patient.
Med Spas
See which promotions get booked.
Dermatology
Connect campaign spend to appointments.
Eye Care & LASIK
See which campaigns book consultations.
Imaging & Radiology
Measure calls and booking inquiries.
Primary Care & Multi Specialty Groups
See which campaigns bring new patients.
Urgent Care
See which campaigns bring walk-ins and online check-ins.
Labs & at Home Testing
Understand which campaigns drive inquiries.
Medicare & ACA Agencies
See which campaigns bring quote requests and calls.
Hospitals & Health Systems
Connect campaigns to appointment inquiries.
Consumer Apps & Devices
See which campaigns bring trials, subscriptions and orders.