Tracking & privacy scan

41/100

High risk

7 trackers load on your public pages. 3 of them can see health details, mostly from page addresses and titles that name a condition. All three are fixable this week, without pausing ads.

Trackers on your site

Tracker	Pages	Sees health details
Meta Pixel	15 of 15	Yes Intake page addresses, contact details
TikTok Pixel	4 of 15	Some Checkout product names
Google Analytics 4	15 of 15	Yes Page titles on treatment pages
Google Tag Manager	15 of 15	No Loader only
Hotjar	6 of 15	No Masked inputs
Klaviyo	15 of 15	No Email signup only
Stripe.js	2 of 15	No Payments

Findings and fixes

High
Meta Pixel fires on the intake flow.
Each page view sends the page address, and /weight-loss/intake names the condition being treated.
Fix: remove the pixel from intake and send approved patients server-side instead, with the site's root address only.
High
Contact details ride along with pixel events.
Advanced Matching attaches email and phone to intake events in the browser.
Fix: turn off automatic Advanced Matching; send hashed identifiers server-side only for business outcomes.
High
GA4 receives page titles from treatment pages.
Titles like "Semaglutide for weight loss" are sent with every page view.
Fix: remove GA4 from intake and treatment pages, or replace it with first-party analytics that keep data in-house.
Medium
A TikTok pixel loads on checkout.
Checkout carries product names that imply a treatment.
Fix: remove it from checkout until a server-side signal with neutral event names is in place.

What a clean signal looks like

After the fixes, Meta receives a neutral event for each approved patient, built server-side:

{
  "event_name": "Qualified",
  "action_source": "website",
  "event_source_url": "https://northwindhealth.com/",
  "user_data": { "em": ["a61715c5a34c…"], "external_id": ["aff4784ce1c7…"] },
  "custom_data": { "value": 289, "currency": "USD" }
}

Want these fixed before your next campaign? Signalhouse can have them done this week.

Book a call with Signalhouse