KLM-SEC Security

PHI stays home. Ad platforms get a signal.

Kalman sits between your telehealth stack and the ad platforms: Meta and Google Ads at launch. Health information comes in so we can work out who became a patient. It stops at the PHI firewall. What leaves is a neutral event, hashed identifiers and a value.

  • Allowlist, not blocklist
  • Hashed identifiers
  • Outbound audit log
  • BAA on every plan

01 / The PHI firewall

Five steps, on every event.

  1. 01 · Receive

    Your telehealth stack sends events to Kalman over server-to-server webhooks. Nothing passes through a browser pixel.

  2. 02 · Strip

    An allowlist decides what may leave. Every outbound field must be explicitly allowed. Anything else is dropped by default.

  3. 03 · Hash

    Identifiers like email and phone are SHA-256 hashed before they're sent, as Meta's Conversions API and Google Ads expect.

  4. 04 · Send

    Meta and Google Ads receive a neutral event name and a value. No condition, medication, intake answer or revealing URL.

  5. 05 · Log

    Every outbound event is recorded, so you can see exactly what was sent, and when.

02 / Data flow

Where your data goes. And where it doesn't.

03 / Compliance

The paperwork, plainly.

What we commit to, in writing, for every customer.

HIPAA
HIPAA-compliant
Business Associate Agreement
Signed with every customer, on every plan, before any data flows
Encryption
TLS 1.2+ in transit, AES-256 at rest
Access control
Least-privilege, role-based access with SSO and MFA. Every access is logged.
Data retention
PHI is used only to match conversions and is deleted after 30 days. The outbound event log is kept for 12 months.
Audits & certifications
Independent HIPAA risk assessment before general availability

04 / Questions

What legal usually asks.

Do Meta or Google ever see what someone is being treated for?

No. Conditions, medications, intake answers and URLs that reveal a condition are never sent. They receive a neutral event name like "Qualified", hashed identifiers and a value.

Do we remove the Meta pixel?

Kalman replaces the browser pixel with a first-party tag and server-to-server webhooks, so health context in the browser isn't exposed to a third-party script.

Can Kalman replace GA4 on our intake and checkout pages?

Yes. Google Analytics isn't covered by Google's BAA, so it shouldn't collect health information. Kalman's HIPAA-compliant analytics measures those pages instead, and Google Ads gets conversions built on approved patients, with PHI stripped first.

Why an allowlist instead of a blocklist?

A blocklist only stops what someone remembered to list. An allowlist sends only fields that were explicitly approved. A new field in your intake form stays inside Kalman until someone decides otherwise.

Will you sign a BAA?

Yes. We sign a BAA with every customer, on every plan, before any data flows.

Questions from your legal team?

Send them over. We'll answer in writing.

Get a free signal audit Email us