Healthcare

Healthcare & HIPAA

Updated October 13, 2026

Health and wellness brands need ad platforms to learn from conversions without exposing their patients' health information. Signalry is built so that health data stays out of advertising platforms by default.

How Signalry protects health information

  • Every property is classified. Each data field in your event catalog is labeled as regular data, personal information (PII) or protected health information (PHI). Signalry suggests the label when you create the field, and you can review it.
  • PHI never goes to ad platforms. Fields labeled PHI (for example medications, conditions, lab panels or appointment details) are blocked from advertising destinations. The block is on by default.
  • Only what you declare is sent. Each destination receives only the properties you allow for that event. Anything else stays in Signalry.
  • Identifiers are hashed. Email addresses and phone numbers are hashed with SHA-256 before they reach Meta, Google, TikTok or other platforms.
  • A healthcare starting point. The telehealth catalog template comes with clinical events whose sensitive fields are already marked PHI.
  • Visibility and control. Every delivery is logged with what was sent, where and what the platform answered. Each customer's data is isolated, platform credentials are encrypted at rest, and all traffic uses TLS.

HIPAA and your responsibilities

HIPAA applies to covered entities (such as healthcare providers and health plans) and to the business associates that handle protected health information for them. The U.S. Department of Health and Human Services has warned that tracking technologies on healthcare websites and apps can disclose protected health information to third parties.

  • You decide which events and fields you send to Signalry and which destinations receive them.
  • Review the PHI labels in your catalog before you turn on any advertising destination.
  • Do not send PHI to advertising platforms. Most of them do not sign Business Associate Agreements and prohibit health information in their terms.

Business Associate Agreements (BAA). If you are a HIPAA covered entity or business associate and need to send protected health information to Signalry, contact us before you start. We will review your use case and tell you whether we can sign a BAA for it. Until a BAA is signed, do not send protected health information to Signalry.

This page describes how Signalry works. It is not legal advice. Talk to your compliance team or legal counsel about your obligations.