Industries · Healthcare
Third-party tracking on health-related pages has produced some of the most expensive privacy failures of the last five years. The first honest step is not a banner — it is finding out exactly what your pages load before anyone agrees to anything.
Said first, because it matters
We do not sign business associate agreements, we do not handle protected health information, and nothing on this page should be read as saying otherwise. What UserGuard does is narrower and still useful: it shows you, with hard evidence, what third-party tags your public pages load, holds the non-essential ones until a visitor agrees, and keeps a record of what each visitor chose.
If your site touches health information, treat the tag inventory as a risk register rather than a compliance checkbox — and take the specific questions to counsel and to your privacy officer, not to a settings page.
Where the risk concentrates
An ad pixel on a symptom page, a condition page, a provider-search result or an appointment form is the pattern that has drawn regulatory attention and litigation. The evidence-first scan tells you which pages carry which tags, before consent, so the conversation starts from a list rather than an assumption.
Most US state privacy laws run on opt-out for targeted advertising but require opt-in consent for sensitive data, and health information is sensitive nearly everywhere. UserGuard’s default for an unplaceable visitor is the strictest treatment, not the most permissive — a deliberate choice to fail closed.
In prior-consent mode nothing non-essential runs before a visitor agrees, via Consent Mode v2 default-denied signals plus script gating. One documented exception: if our configuration is unreachable, scripts you marked by hand stay held and auto-detected ones are released — so an outage of ours cannot take your site down with it.
Health information has to reach people who need it, including on a bad day. The consent banner is built to be keyboard operable and screen-reader compatible at WCAG 2.1 AA, and the accessibility widget adds visitor presentation controls — as a supplement to conformance work in your own markup, never a substitute.
What you get, precisely
The scanner loads your pages in a real browser with no consent given and captures what fires: Set-Cookie headers, HTTP-only cookies, document.cookie values, scripts, pixels, iframes, storage keys. Cookies enter your inventory only on hard evidence; everything else is disclosed separately as what it actually is. Nothing is discarded, and nothing is guessed.
AI drafts categories, risk flags and plain-language descriptions, and every suggestion waits for a person’s approval before it publishes. On a health site that human gate is the point, not a formality.
Every visitor decision is stored against the site, the exact banner version on screen, the region, the language shown, and the timestamp — and exports as CSV when someone asks you to demonstrate it.
Coverage
Region-aware behaviour, automatic Global Privacy Control honouring, opt-out records.
See how → GDPR + ePrivacyNothing non-essential before consent, and Article 7(1) records to demonstrate it.
See how → WCAG 2.1 AA · ADA · EAAAn operable consent surface and visitor controls, with the honest line about what a widget cannot do.
See how →UserGuard is not a HIPAA compliance solution and does not offer business associate agreements. This page is general information, not legal advice. Whether any particular tag, page or practice creates exposure for your organisation is a question for qualified counsel and your privacy officer.
Start today
Create an account, drop one script on a site, and the first scan verifies your cookies in minutes. Honest consent UX, consent analytics and accessibility controls, from $10 a site. Thirty days to get your money back if it is not right.
