Ecommerce OS · Telehealth8 min readUpdated November 3, 2026

Server-Side Tracking for Telehealth Companies

What a telehealth brand can send to Meta, Google and TikTok: HIPAA and FTC rules, Meta's health restrictions, page zones and a server-side setup.

Nick Bonnassies, CMO at Tagada · checked against 16 sources

Article summary

TL;DR

For a telehealth brand, server-side tracking is how you control what reaches Meta, Google and TikTok, not a way to send more. Send generic commerce events from the checkout (purchase, value, currency), nothing about intake answers, treatments or conditions. Keep third-party pixels off the intake and patient portal. Meta can still restrict a health data source.

Meta's Business Tools Terms (effective November 3, 2025) ask advertisers not to share data that contains or is based on health information.
HHS's tracking bulletin (December 1, 2022, revised March 18, 2024) lost its part on unauthenticated pages in court on June 20, 2024; its rules for authenticated pages, such as portals, remain.
The FTC's first Health Breach Notification Rule case, against GoodRx (February 1, 2023), ended with a $1.5 million civil penalty for sharing health data with ad platforms.
Meta restricts health and wellness data sources in three levels, and "Conversions API does not bypass the data sharing rules", according to Stape (March 2026).
Meta recommends the Conversions API alongside the pixel, deduplicated by event name and event ID.

Want to go further? Ask

On this page

This guide is part of our playbook on the best ecommerce platform for telehealth companies. The general guide, for any store: what is server-side tracking?. Ad rules themselves are in Meta and TikTok ads for telehealth companies.

Why tracking is different for a telehealth brand

A supplement store worries about lost purchases. A telehealth brand also worries about what its tracking reveals.

The intake is health data
Every answer, and often the page URL itself, says what the patient is seeking.
Regulators have acted on it
The FTC's cases against GoodRx, BetterHelp and Cerebral all involved health data reaching ad platforms or third parties7 8 9.
Meta categorizes data sources
A domain read as health-related can lose detailed events, then purchase optimization3.
Browsers still lose events
Ad blockers and cross-domain funnels (landing page, intake, checkout) drop pixel events, as in any store.

The rules that apply

Which rule applies depends on who you are. HIPAA covers health plans, clearinghouses and providers that transmit health information electronically in standard transactions6. If HIPAA does not cover an entity, the FTC Act and the Health Breach Notification Rule do11.

Rule	What it says about tracking	Status
HHS bulletin on tracking technologies (HIPAA covered entities)	Tracking on authenticated pages needs a business associate agreement with the vendor; the part treating an IP address plus a visit to an unauthenticated health page as protected information was vacated	Bulletin of December 1, 2022, revised March 18, 2024; vacated in part June 20, 2024; HHS withdrew its appeal August 29, 20244 5
FTC Act and Health Breach Notification Rule (not covered by HIPAA)	The FTC has pursued sharing of health data with ad platforms without clear consent; the rule requires notice of breaches	GoodRx, $1.5 million (2023)7; BetterHelp, $7.8 million (2023)8; Cerebral, more than $7 million (2024)9
Meta Business Tools Terms	Don't share Business Tool data that contains or is based on health information	Effective November 3, 20252
FTC v. Hims & Hers	Alleged sharing of health data "with third-party advertising platforms such as Meta and Snap"	Complaint of July 29, 2026, case pending10

$1.5 million

GoodRx, FTC action on health data shared for advertising (2023)

$7.8 million

BetterHelp, FTC order on revealing consumers' data (2023)

More than $7 million

Cerebral, FTC proposed order on sensitive data (2024)

This is general information, not legal advice. Ask a health care lawyer which regime applies to each of your entities.

Meta's health and wellness restrictions

Meta categorizes the domains and apps that send it events. When a data source is categorized as health and wellness, Stape describes three levels3:

Level	What Meta limits	What still works
Mild	URL details after the domain (UTM parameters), custom parameters and extra event details	Standard events
Moderate	Standard events such as Lead, AddToCart and Purchase	Upper-funnel events
Severe	All event sharing from the site or app, in certain regions	Delivery without conversion signals

Source: Stape, March 20263. Meta's own help page (article 361948878201809) describes the categories; this table is a practitioner's summary.

The restrictions apply to the pixel and to the Conversions API3. Server-side tracking makes your data complete and controlled; it does not lift a category.

Watch out

Some vendors suggest renaming purchase events or moving the funnel to a "neutral" domain so Meta won't recognize it. That is a way around Meta's rules and its terms2, and it puts the ad account at risk. Send less, send it accurately, and let Meta classify you.

Split your pages into three zones

Zone	Pages	Browser pixels	Server events
1. General	Home, how it works, pricing, clinicians, FAQ	AllowedWith consent where required	PageView, Lead (generic)
2. Funnel	Intake quiz, eligibility, checkout	None from third parties	One generic event at payment, from the checkout
3. Authenticated	Patient portal, messages, refills, ID upload	None	None, unless a business associate agreement covers the vendor4

Fig. 1Three zones, three tracking rules

1. General: home, how it works, pricing, clinicians, FAQAllowed, with consent where requiredPageView, Lead (generic)
2. Funnel: intake quiz, eligibility, checkoutNone from third partiesOne generic event at payment, from the checkout
3. Authenticated: patient portal, messages, refills, ID uploadNoneNone, unless a business associate agreement covers the vendor

The further in, the less leaves the site.

From the zone table above. Zone 3: HHS bulletin, as summarized by Morrison Foerster, July 18, 2024.

Retargeting follows the same zones: audiences from zone 1 only, never from an intake step. More in abandoned cart recovery for telehealth companies.

What to send, and what never to send

Send from the server	Never send
Event name and event ID, shared with the pixel1	Intake answers, symptoms, conditions
Order value and currency	Treatment or product names that describe a condition
Hashed email and phone, where consented	URLs or query strings with health terms
Click IDs captured on the landing page (fbclid, gclid, ttclid)	The clinician's decision, case status, refill events
A generic product ID or plan tier	Custom parameters that imply a health status

Two choices matter most for telehealth:

Name products neutrally in what you send: "Plan A, monthly" rather than a treatment name.
Don't send clinical milestones (approved, prescribed, shipped) as ad events. A "prescription approved" event tells the platform something medical about a person.

Setup

Map every page to zone 1, 2 or 3, and remove third-party pixels from zones 2 and 3.
Rename products and URLs that read like a diagnosis, before you send anything.
Send the purchase from the system that takes the payment, server-side, to Meta's Conversions API and to Google's and TikTok's equivalents.
Use the same event name and event ID in any browser event and the server event, so Meta deduplicates them1.
Hash contact data and send it only where the patient consented.
Document what you send and why, for your lawyer and for any vendor review.

Decide what leaves the site before you send anything.

Check that it works

Check	How	Healthy sign
NoPixel on zones 2 and 3	Browser network tab, tag audit	NoRequests to ad domains from intake or portal
Deduplication	Events Manager, event overview	Browser and server events merged, not doubled
Coverage	Ad platform purchases vs. paid orders, same days	A small, stable gap
Restriction status	Events Manager, data source settings	NoNew limitation3
Payload	A test event's fields	NoProduct name, URL or parameter that reveals a condition

With clean data, attribution becomes possible: ad attribution for telehealth companies.

How Tagada helps

Purchase events sent from the checkout server

The Tagada checkout sends server-side events to Meta (Conversions API) from the place the payment happens, and TagadaPay drops into the store you run: "Already on Shopify, WooCommerce, ClickFunnels or BigCommerce? Drop TagadaPay in."16 In the docs12 13:

No pixels needed on checkout or thank-you pages: with Meta configured, the server sends Conversions API events on paid orders.
Purchase events are deduplicated, with the same event ID as the browser event, so a refresh doesn't count twice.
Pixels are bound page by page on the funnel canvas, so you decide which pages fire them.
Click IDs (gclid, fbclid, ttclid and others) are captured at checkout into the customer record.

Building the whole telehealth brand? With Tagada Rx, "Tagada never persists PHI": intake answers pass to the clinical network, Tagada keeps only routing data such as IDs, statuses and timestamps, and notification emails are content-free14. US patients only, by selection15.

Start free

Purchase events sent from the checkout server

Updated on November 3, 2026

Nick Bonnassies

CMO at Tagada

CMO at Tagada. Before Tagada, Nick built direct-to-consumer brands that generated over $115M in sales, raised over $25M in crowdfunding and sold two of them. He also works as a fractional CMO on marketing operations and AI systems.

Frequently asked questions

Is the Meta pixel HIPAA compliant?

A tool isn't compliant or not; how you use it is. If HIPAA covers you, a pixel on authenticated pages such as a patient portal needs a business associate agreement with the vendor. Meta's own terms ask you not to send health data at all. Keep pixels off intake and portal pages.

Does the Conversions API make tracking HIPAA compliant?

No. It lets you choose the fields you send, which makes compliance possible, not automatic. What matters is what the event contains: no intake answers, treatment names or condition URLs. Meta's health restrictions also apply to server events.

Why is Meta restricting my telehealth events?

Meta categorizes data sources, and a telehealth domain is often read as health and wellness. Depending on the level, Meta strips URL details and custom parameters, blocks events like Purchase, or blocks all events in some regions. Check your data source settings in Events Manager.

Can I put tracking pixels on my intake quiz?

Avoid it. What a patient answers or clicks in an intake is health information, and the FTC's cases against GoodRx, BetterHelp and Cerebral involved this kind of data reaching ad platforms or third parties. Send one generic event at payment, from the server, instead.

What happened to the HHS guidance on tracking technologies?

On June 20, 2024, a federal court in Texas vacated the part that treated an IP address plus a visit to an unauthenticated health page as protected information. HHS withdrew its appeal on August 29, 2024. The rest, including authenticated pages, still applies.

Sources

Checked November 3, 2026

Tagada

Send paid orders to ad platforms, never intake answers

Funnels, one-click upsells, subscription billing and payment routing, on one customer record.

Start free See pricing

01Create your free account
02Connect your store or build a checkout
03Launch funnels, upsells and subscriptions