A marketing pixel on a symptom pageis not a marketing decision.
ConsentCenter keeps website tracking choices, communication preferences and privacy requests separate, each with its own record.
- GDPR Article 9(1)
- GDPR Article 9(2)(a)
- ePrivacy Directive Article 5(3)
Your website knows something your website should not know.
The page title said it out loud.
A third-party tag on a condition page sends the URL, and the URL is the diagnosis. Nobody chose to share that. It happened because the tag was added for conversion tracking and nobody asked what the page was about.
Where this goes wrong first.
The page itself is the sensitive part
On most sites a tracked URL is harmless. On yours it can reveal why someone is reading. Generic tag advice does not account for that, and most tag setups were written with generic advice.
Public site and authenticated app share one setup
The marketing site and the patient portal have different sensitivities and often the same analytics configuration, because one of them was set up first.
Contact preference is not one switch
Appointment reminders, test results and marketing are different things to be contacted about. Letting someone opt out of marketing should not put them at risk of missing the other two.
What you are actually buying.
Separate website tracking choices from identified communication preferences.
Keep preference updates aligned across connected engagement systems.
Manage access, correction and deletion requests with defined ownership.
How it works
Separate
Model choices by channel and purpose so each can be handled appropriately.
Control
Apply the current preference in the systems responsible for communication and data use.
Respond
Verify, assign, fulfil and document privacy rights requests through one workflow.
What the text actually says.
- GDPR Article 9(1)
- Processing data concerning health is prohibited unless a specific exception applies, such as the person’s explicit consent.
- GDPR Article 9(2)(a)
- Where consent is the exception relied on for health data, that consent must be explicit — a higher bar than ordinary consent.
- ePrivacy Directive Article 5(3)
- Storing or accessing information on someone’s device requires prior consent unless it is strictly necessary for the service they requested.
Paraphrased for brevity and provided for orientation, not as legal advice. Which obligations apply to your organisation is a question for your own counsel, and ConsentCenter does not determine it for you.
The products that apply
Cookie Consent
Hold optional trackers on public pages where the URL itself is revealing.
View productUniversal Consent & Preference Management
Keep clinical, administrative and marketing contact as separate purposes.
View productDSAR & Privacy Rights
Run access and deletion requests with verification and clear ownership.
View product
Frequently asked questions
No. These capabilities cover digital privacy choices, communication preferences and privacy rights workflows — not clinical consent or medical decision-making.
Yes, and that separation is the main reason to model purposes individually rather than as one contactable flag.
Yes. Teams can start with the privacy workflow they need and connect additional products later.
No product can do that, and we are not going to claim it. Which regimes apply to you, and what they require, is a question for your own counsel and compliance team. What ConsentCenter provides is the operational machinery — the choices, the enforcement and the record.
Bring us the healthcare & health tech version of this problem.
Show us the consent question you cannot currently answer — the choice that did not propagate, the record you could not reproduce — and we will walk through exactly how ConsentCenter handles it.