Industries · Healthcare
Third-party tracking on health-related pages has produced some of the most expensive privacy failures of the last five years. Start by finding out exactly what your pages load before anyone agrees to anything, then think about the banner.
Knee pain: causes and treatment
When to see a specialist
Before consent
Please read this first
We do not sign business associate agreements, we do not handle protected health information, and nothing on this page should be read as saying otherwise. What UserGuard does is narrower and still useful: it shows you, with hard evidence, what third-party tags your public pages load, holds the non-essential ones until a visitor agrees, and keeps a record of what each visitor chose.
If your site touches health information, use the tag inventory as a risk register and don’t treat it as a compliance checkbox. Take the specific questions to counsel and to your privacy officer.
Where the risk concentrates
An ad pixel on a symptom page, a condition page, a provider-search result or an appointment form is the pattern that has drawn regulatory attention and litigation. The evidence-first scan tells you which pages carry which tags before consent, so you can start the conversation with a list in front of you.
Most US state privacy laws use opt-out for targeted advertising but require opt-in consent for sensitive data, and health information is sensitive nearly everywhere. If UserGuard can’t place a visitor, its default is the strictest treatment, so it fails closed.
In prior-consent mode nothing non-essential runs before a visitor agrees, using Consent Mode v2 default-denied signals plus script gating. There are three exceptions to know about. If our configuration is unreachable, scripts you marked by hand stay held and auto-detected ones are released, so an outage of ours can’t take your site down with it. If you turn on Advanced consent mode, Google’s tags load before a choice, with their signals denied. And Speak Local’s tracker isn’t held: until a visitor allows analytics, it counts visits without storing anything.
Health information has to reach the people who need it, including on a bad day. The consent banner is built to be keyboard operable and screen-reader compatible at WCAG 2.1 AA, and the accessibility widget adds presentation controls for visitors. The widget supplements conformance work in your own markup and never replaces it.
What you get
The scanner loads your pages in a real browser with no consent given and captures what fires: Set-Cookie headers, HTTP-only cookies, document.cookie values, scripts, pixels, iframes and storage keys. A cookie only goes in your inventory when there’s hard evidence for it, and everything else is disclosed separately. We don’t discard anything, and we don’t guess.
AI drafts categories, risk flags and plain-language descriptions, and every suggestion waits for a person’s approval before it publishes. On a health site that approval step matters, so treat it as more than a formality.
Every visitor decision is stored against the site, the exact banner version on screen, the region, the language shown and the timestamp. You can export it as CSV when someone asks you to demonstrate it.
Coverage
Behavior that adapts by country, automatic Global Privacy Control honoring and opt-out records.
See how → GDPR + ePrivacyNothing non-essential fires before consent, and you have Article 7(1) records to demonstrate it.
See how → WCAG 2.1 AA · ADA · EAAYou get an operable consent banner and visitor controls, and we’re clear about what a widget can’t do.
See how →UserGuard is not a HIPAA compliance solution and does not offer business associate agreements. This page is general information, not legal advice. Whether any particular tag, page or practice creates exposure for your organization is a question for qualified counsel and your privacy officer.
Start today
Create an account, add one line of code, and the first scan runs in minutes. If it isn’t right, you have thirty days to get your money back.
