The Blog
Field notes on compliance-first growth.
Meta ads for health & wellness, privacy-compliant tracking, and what actually works in regulated categories — from the team running the accounts.
Regulated Markets · Meta Ads
Meta Keeps Restricting Health & Wellness Advertisers. Here's the Playbook We Run.
Meta's data restrictions don't pause your campaigns — they quietly remove your optimization signal. The five moves that keep restricted accounts alive.
· Jason Garrett · 8 min read
Regulated Markets · Meta Ads · AI
Meta's AI Features Are On by Default. Here's What We Actually Enable for Health & Wellness Accounts.
AI pixel enrichment activated by default in May. Our portfolio configurations by account type — and the two failure modes we design against.
· Jason Garrett · 7 min read
Resource Cluster
Meta Ad Restrictions
Meta's health & wellness classification blocks conversion events and strips your data. What triggers it, how to get out, and who can fix it.
Start Here
Need help with Meta's health & wellness ad restrictions?
What getting help actually involves — tracking audits, compliant rebuilds, and whether to bring in an agency.
How-To
How to get Meta's health & wellness category removed
Yes, it can be removed — after remediation. The tier check, the cleanup sequence, and the appeal that works.
Playbook
The 2026 restriction playbook
The five-step process we run to keep restricted health accounts optimizing.
Creative
Why Meta keeps rejecting your health ads
The four triggers that fail policy review, and how to tell a creative problem from a tracking problem.
Hiring
Need a HIPAA-compliant marketing agency?
The four PHI leak points any agency should be able to name, and what to ask before you sign.
Resource Cluster
HIPAA-Compliant Tracking
A living guide to which marketing and analytics tools can run on a healthcare site — and how to configure the ones that can. Start with the overview, then jump to the tool you're evaluating. Not legal advice.
Start Here · Living Guide
The State of HIPAA-Compliant Marketing Tracking
Can healthcare marketers use GA4, the Meta pixel, or retargeting in 2026? A plain-English, continuously updated guide to the OCR guidance, AHA v. Becerra, state laws, FTC enforcement, and pixel litigation.
New · Playbook
How to Run Meta Ads for a Telehealth Company Without Violating HIPAA
The full build: server-side CAPI behind a PHI-scrubbing gateway, targeting without patient data, creative that clears both reviewers, and ROAS measurement with nothing to apologize for.
Playbook
Google Ads for a Healthcare Clinic
Scrubbed conversions, offline import, intent-and-geo targeting, compliant call tracking.
Playbook
Measure ROAS Without Sending PHI
Scrubbed signals, geo-lift experiments, first-party attribution, and MMM you own.
Audit Guide
Healthcare Pixel Audit Checklist
Find PHI-leaking pixels page by page — the method we run before a rebuild.
Does HIPAA Apply to My Website?
Start hereMore than you think — a plain-English guide by business type.
Google Analytics (GA4)
NoGoogle won't sign a BAA — and IP anonymization doesn't fix it.
Meta (Facebook) Pixel
NoThe single most litigated tracking tool in healthcare.
TikTok Pixel
NoNo BAA, and the same client-side leak as the Meta pixel.
Hotjar & Session Recording
NoRecordings capture form entries that become PHI on health sites.
Klaviyo
NoNo BAA — what that means for health email/SMS, and the alternatives.
Meta Conversions API (CAPI)
With setupThe compliant path for Meta ads — behind a PHI-scrubbing gateway.
Google Tag Manager
With setupA delivery truck — server-side GTM is the compliant backbone.
Google Ads Conversion Tracking
With setupNot by default — compliant via server-side, scrubbed imports.
CAPI + Google Offline Conversions
Field guideWhat you can send to each platform without sending PHI, field by field.
Google vs. Meta Health Rules
ExplainerWhy Google keeps health conversions out of enhanced conversions and Customer Match.
CallRail
Yes, with BAAOn the Healthcare plan with a signed BAA — watch the integrations.
HubSpot
Yes, with BAAOn Enterprise with a BAA and sensitive-data features enabled.
Mixpanel & Amplitude
Yes, with BAABoth offer BAAs on qualifying plans — compliance lives in the setup.
Legal Status · Q&A
The law behind the tracking questions
Plain-English answers on the regulations driving healthcare pixel risk — who they bind, what changed, and what to do. Not legal advice.
Is an IP Address PHI?
Alone, no. Paired with a health page, it can be — and Becerra narrowed that, didn't erase it.
Does MHMDA Apply to My Marketing?
Broader than HIPAA, opt-in consent, and a private right of action.
FTC & Non-Covered Brands
The regulator for everyone HIPAA doesn't cover. GoodRx paid without a HIPAA case.
What Is CIPA?
California's wiretap law, now a pixel demand-letter machine.
Is My Wellness Brand Subject to HIPAA?
Usually not — but the FTC and state laws still bind you.
Do I Need a BAA for My Tools?
Yes for any tool that gets PHI — and the best ones won't sign.
Vertical & Lifecycle Playbooks
Playbooks by channel and vertical
Medspa & Aesthetics Ad Tracking
Part retail, part medical — split the tracking and respect the medical half.
Behavioral Health Marketing
The highest-sensitivity category — and the strictest build.
Patient Email & SMS Under HIPAA
The split-stack pattern: BAA-covered platform, authorization, careful content.
FTC-Safe Ad Tracking for Wellness
Outside HIPAA, not outside the law. Don't be the next GoodRx.
Published elsewhere
Guest articles and contributed pieces by our founder.
Ours Privacy · March 2026
Meta Platform Restrictions Explained: What Core Setup Actually Means
The full technical breakdown of Meta's three restriction tiers, how the categorization engine works, and the six-step compliance playbook. ↗
Curve · May 2026
Five Questions to Answer Before Turning On Meta's New AI Features
The decision framework for Meta's in-platform agent and AI pixel enrichment, question by question. ↗
Growth in a regulated category?
We run compliance-first paid acquisition for health & wellness, healthtech, and fintech brands.
Book a Consultation