HIPAA-Compliant Analytics & Conversion Tracking for Mental Health Practices
Someone researching therapy is trusting your website before they trust you. The pixels behind your ads report who read the anxiety page and who filled the intake form — minusPHI keeps your campaigns working and keeps that story private.
The exposure
The most sensitive browsing on the internet.
Reading /trauma-therapy is a disclosure. Your website shouldn’t repeat it.
A visitor who reads your depression-treatment page, checks your rates, then starts an intake form has told your website more than they’ve told most people in their life. A tracking pixel forwards that trail to ad platforms with identity attached — email, phone, IP.
Regulators have already fined online-therapy platforms for exactly this, and mental-health data sits at the top of every state privacy law’s sensitive list. Cash-pay or insurance, HIPAA or not — this is the category where a leak costs trust fastest.
What’s said here is confidential. Browsing should be too.
The fix
De-identified before it ever leaves your website.
The session request still counts toward your campaign. The person behind it stays anonymous.
What keeps working
Everything you advertise with today — untouched.
Therapy keywords are among the most expensive clicks in healthcare — attribution keeps working. Conversions arrive with the click ID attached and nothing about the person.
Psychology Today, Instagram, Facebook — traffic from every source shows up in your analytics exactly as it does today, de-identified before any platform sees it.
Phone taps, contact forms and scheduling clicks are detected automatically. Client portals and intake pages are suppressed entirely — nothing is sent from them at all.
Beyond compliance
Confidentiality can’t stop at the office door.
A practice built on trust, down to the website.
Your whole profession runs on one promise.
Therapy works because people believe what they share stays in the room. A pixel that logs who visited the trauma-therapy page breaks that promise before the first session — and prospective clients increasingly know to ask about it.
minusPHI lets you put the answer in writing: browsing on our website is not shared with advertisers. Ever.
- A plain-language log of what was sent, hidden, or blocked
- Sensitive pages suppressed automatically — nothing sent at all
- Visitor "do not sell" signals honored, with receipts
Questions
The honest answers.
We’re cash-pay and not HIPAA-covered — does this still matter?
Yes. The FTC’s $7.8M BetterHelp action was about ad-pixel sharing, and HIPAA never entered the case. State privacy laws treat mental-health browsing as sensitive data regardless of how you bill — the exposure comes from the pixel, not your billing model.
Will our ads still optimize?
Yes — for what matters. Campaigns optimize on conversion events, delivered server-side with the ad-click ID attached, so attribution keeps working. What you give up is visitor retargeting, because that inherently requires handing platforms the browsing data this product exists to protect.
What about our client portal and intake forms?
Nothing is sent from portals, intake forms, scheduling flows or condition pages — those are suppressed entirely, not scrubbed. Marketing traffic shows up in your analytics; care activity reports to no one.
What does setup look like?
About five minutes: paste one script tag into WordPress, Squarespace, Wix, Webflow or a custom site. Conversions are detected automatically, and your first exposure report arrives the same day. No developer required.
Make the website as confidential as the sessions.
Start free — no credit cardFull protection is free for 14 days, then $99/month per website · Cancel anytime