Sample technical evidence report

sample-orthopedic-clinic.example

Critical initial-load tracker evidence with no consent controls detected. In plain terms: Google and Hotjar Ltd. (Contentsquare) received data about visitors on 3 patient-facing pages, including which pages they viewed. No cookie consent controls were detected on the pages we scanned. Your web developer or marketing agency can change this; the steps are in the remediation playbook below. 4 tracker/tag-manager stacks completed on initial load while no obvious consent controls were detected, with page-context evidence across 3 pages.

Download PDF Export CSV Open scanned site

2 ad/analytics companies receiving data from sample-orthopedic-clinic.example.

Everything above is yours free, fix steps included. Most offices forward it to whoever runs their site. If you'd rather not manage that: we send your web vendor the fix list, answer their questions directly, and re-scan the moment they say it's done so you get a dated certificate proving it instead of their word for it. Then weekly, so if anything comes back after a site update, you know before anyone else does.

Verify the fix and keep watch · $99/mo

Browser-executed scan completed on 4 selected pages. Runtime network requests and rendered page text were included.

Scan verdictCritical reviewhigh coverage

Patient-facing pages scanned3In a real browser, with full runtime evidence

Pages with initial-load tracker requests3Requests completed on initial load while no obvious consent controls were detected

Ad/analytics companies receiving data24 tracking products, including Google Ads / DoubleClick, Google Analytics 4, and Session replay (Hotjar, Clarity, FullStory, etc.)

Highest-priority pages to review2Start here: patient-intent pages with the strongest evidence

Executive Summary

3 patient-facing pages had adjudicated review evidence.
Marquee tracker status: Google Ads / DoubleClick, Google Analytics 4, and Session replay (Hotjar, Clarity, FullStory, etc.) directly observed; GTM container contents still need vendor confirmation.

Verdict: Critical review. The report emphasizes adjudicated evidence, page context, and coverage confidence instead of a public numeric score.

Coverage: 4/4 pages reportable; 4 with full runtime evidence; 0 static-only; 0 blocked or non-reportable. Coverage confidence: high. We scanned this preview selection, prioritizing patient-action, treatment, billing/contact, portal/form, occupational-service, and health-education paths. 3 pages were classified as patient-facing/reportable; this is not a full-site inventory.

Highest-priority pages

Schedule orthopedic appointment

https://sample-orthopedic-clinic.example/appointments

Critical review

Knee pain treatment options

https://sample-orthopedic-clinic.example/conditions/knee-pain

High review

Priority Review Queue

Broad tag-manager or privacy-platform review may apply across the scan. Start with these pages because adjudicated tracker-review evidence appears there.

RankPageWhy this page firstVendors / evidencePriority

1Schedule orthopedic appointmenthttps://sample-orthopedic-clinic.example/appointmentsBooking or scheduling route · Google Ads / DoubleClick, Google Analytics 4, and Google Tag Manager fired at page load (+ more stacks) · cookies, page URL, and page title capturedGoogle Ads / DoubleClick, Google Analytics 4, Google Tag Manager, HotjarCritical review

2Knee pain treatment optionshttps://sample-orthopedic-clinic.example/conditions/knee-painGoogle Ads / DoubleClick and Google Analytics 4 fired at page load · Treatment/service page · cookies, page URL, and page title capturedGoogle Ads / DoubleClick, Google Analytics 4High review

Marquee Advertising and Analytics Trackers

Whether the highest-concern ad and analytics trackers were directly observed in this scan. Absence does not by itself mean a tag is unconfigured or that the site is compliant.

Meta / Facebook PixelNot observed

Google Ads / DoubleClickObserved

Google Analytics 4Observed

TikTok PixelNot observed

LinkedIn Insight TagNot observed

Microsoft / Bing UETNot observed

Session replay (Hotjar, Clarity, FullStory, etc.)Observed

Pages With Review Evidence

Page groupReview evidenceFirst passHighest priorityExamples

Patient workflow - scheduling1/11Critical reviewSchedule orthopedic appointment

Treatment/service1/11High reviewKnee pain treatment options

Provider/location1/10High reviewDr. Smith orthopedic provider profile

General business0/10No tracker issueCareers

Confirmed Tracker and Tag-Manager Evidence

These vendors are classified as advertising, analytics, tag-manager, session-replay, or chat technology. Review them first on patient-intent pages.

Review 4 evidence findings

Google Analytics 4

Google - confirmed tracker - high confidence

Analytics

Google LLC. Observed on 3 reportable pages, including 3 patient-facing pages.

Highest-priority page: Schedule orthopedic appointment

Browser runtime request completed.Requests observed when no obvious controls were detected by the scanner.

Evidence fields: query parameter names, cookie names, referrer, page URL context, page title context. Raw values redacted.

Review URL, title, referrer, query-string, and event-parameter handling; confirm approved vendor terms and retention settings.

GET beacon www.google-analytics.com; query names: dl, dt, tid, v; referrer observed; page URL context observed. Evidence hash: sample_ga4-a.
GET beacon www.google-analytics.com; query names: dl, dt, tid, v; referrer observed; page URL context observed. Evidence hash: sample_ga4-k.

Classification basis: verified path signature (path:/g/collect)

Google Ads / DoubleClick

Google - confirmed tracker - high confidence

Advertising

Google LLC. Observed on 2 reportable pages, including 2 patient-facing pages.

Highest-priority page: Schedule orthopedic appointment

Browser runtime request completed.Requests observed when no obvious controls were detected by the scanner.

Evidence fields: query parameter names, cookie names, referrer, page URL context. Raw values redacted.

Review first. Remove or path-restrict from patient-action, treatment, portal, billing, contact, and appointment pages unless privacy review approves the configuration.

GET xhr googleads.g.doubleclick.net; query names: label, url; referrer observed; page URL context observed. Evidence hash: sample_ads-a.
GET fetch googleads.g.doubleclick.net; query names: frm, url; referrer observed; page URL context observed. Evidence hash: sample_ads-k.

Classification basis: verified path signature (path:/pagead)

Hotjar

Hotjar - confirmed tracker - medium confidence

Session Replay

Hotjar Ltd. (Contentsquare). Observed on 1 reportable page, including 1 patient-facing page.

Highest-priority page: Schedule orthopedic appointment

Browser runtime request completed.Requests observed when no obvious controls were detected by the scanner.

Evidence fields: referrer. Raw values redacted.

Disable on patient-facing flows unless masking, vendor terms, and privacy review approve the implementation.

GET script static.hotjar.com; referrer observed. Evidence hash: sample_hotja.

Classification basis: verified vendor-domain mapping (host:hotjar.com)

Google Tag Manager

Google - tag-manager container - high confidence

Tag Manager

Google LLC. Observed on 2 reportable pages, including 2 patient-facing pages.

Highest-priority page: Schedule orthopedic appointment

Browser runtime request completed.Requests observed when no obvious controls were detected by the scanner.

Evidence fields: query parameter names, referrer. Raw values redacted.

Audit triggers, exceptions, consent settings, and path-based firing rules before changing individual tags.

GET script www.googletagmanager.com; query names: id; referrer observed. Evidence hash: sample_gtm-a.
GET script www.googletagmanager.com; query names: id; referrer observed. Evidence hash: sample_gtm-p.

Classification basis: verified path signature (path:/gtm.js)

Patient Workflow Vendors

These vendors appear connected to appointment, intake, portal, billing, payment, or form workflows. They are not automatically tracker findings, but they are core vendor-review evidence.

Review 1 evidence finding

Patient portal vendor

Patient portal vendor - patient workflow - medium confidence

Patient Portal

Observed on 1 reportable page, including 1 patient-facing page.

Workflow link observed on 1 scanned page; locality could not be confirmed.

Most relevant workflow page: Schedule orthopedic appointment

Runtime request evidence observed.Link or embedded-flow evidence was observed; no request timing was captured for this observation.

Evidence fields: destination URL, link label, source page. Raw values redacted.

Confirm this patient workflow vendor is approved and verify whether the link is page-local, sitewide navigation, or a shared template component.

external link patientportal.example.com. Evidence hash: 24c4586b9806.

Classification basis: same-scan canonical vendor merge

Other Third-Party Technologies Observed

These are review-only observations such as accessibility widgets, media, maps, and other known utility vendors.

No additional third-party technologies were observed beyond the confirmed tracker/workflow evidence.

Grouped Page Evidence

Pages with the same vendor and runtime-evidence pattern are grouped so repeated sitewide behavior is easier to review.

Review 3 grouped evidence patterns

Schedule orthopedic appointment

1 page shares this evidence pattern. Common review vendors: Google Ads / DoubleClick, Google Analytics 4, Google Tag Manager, and 1 more. Patient workflow vendors: Patient portal vendor. 4 representative runtime samples shown.

Critical review

Advertising or conversion tracking was observed on a patient-action page.
No obvious consent banner text was detected in the collected page evidence.
Session replay or behavior capture was observed on a patient-facing page.
These requests were observed when no obvious consent controls were detected by the scanner.

Pages in group

Schedule orthopedic appointment

https://sample-orthopedic-clinic.example/appointments

Critical review

Knee pain treatment options

1 page shares this evidence pattern. Common review vendors: Google Ads / DoubleClick and Google Analytics 4. 2 representative runtime samples shown.

High review

Advertising or conversion tracking was observed on a treatment or condition page.
No obvious consent banner text was detected in the collected page evidence.
These requests were observed when no obvious consent controls were detected by the scanner.

Pages in group

Knee pain treatment options

https://sample-orthopedic-clinic.example/conditions/knee-pain

High review

Dr. Smith orthopedic provider profile

1 page shares this evidence pattern. Common review vendors: Google Analytics 4 and Google Tag Manager. 2 representative runtime samples shown.

High review

No obvious consent banner text was detected in the collected page evidence.
These requests were observed when no obvious consent controls were detected by the scanner.
This page uses analytics or tag-management technology that should be reviewed for configuration and vendor handling.

Pages in group

Dr. Smith orthopedic provider profile

https://sample-orthopedic-clinic.example/providers/dr-smith

High review

Evidence Depth

Runtime request metadata was captured with raw values redacted. The report shows field names, hosts, paths, timing, and transmission-status evidence.

Runtime requestsObserved

Method/resourceObserved

Query namesObserved

Cookie namesObserved

Body field namesNot observed

ReferrerObserved

InitiatorNot captured

Raw valuesRedacted

Consent and Timing Evidence

No obvious cookie or privacy controls were detected in the collected page evidence. Tracker requests completed on initial load on 3 pages.

No obvious controls detectedInitial-load requests; no controls detected

No reportable patient-facing page exposed both visible Accept and Reject controls for a complete differential. No Accept-versus-Reject claim is made.

Consent differential not run

Methodology: Initial-load browser observation only; the scanner did not complete an Accept-versus-Reject differential.

What To Do Now

One playbook per finding. Hand each to the owner listed; every playbook ends with how to verify the fix with a re-scan.

Review 5 remediation playbooks

Gate Google Tag Manager behind consent and path rules

Applies to: Google Tag Manager | Owner: Developer + marketing/agency

Export the container and list every tag, trigger, and built-in variable so nothing is reviewed from memory.
Turn on consent mode (in Google Tag Manager: Admin > Container Settings > Enable consent overview) and set required consent state for every marketing and analytics tag.
Add blocking triggers for patient-intent paths (appointment, portal, billing, contact, intake, treatment pages) to every advertising tag, or move those tags to an allowlist of non-sensitive paths. In this audit that includes: /appointments, /conditions/knee-pain.
Delete unused or unknown tags; if nobody can say who added a tag and why, it should not run on a healthcare site.
Publish the container as a new version with a change note referencing this report, so the change history documents the review.

Verify: Re-scan after publishing. The report should show the tag manager present but no marketing/analytics requests completing on patient-intent pages before consent action.

Reconfigure Google Analytics for a healthcare property

Applies to: Google Analytics 4 | Owner: Developer + marketing/agency

Turn off Google signals and ads personalization (GA4: Admin > Data Settings > Data Collection) so analytics traffic stops feeding advertising audiences.
Set data retention to the minimum (2 months) and disable granular location/device data if not used.
Redact URL query parameters and confirm no page paths embed patient context (names, conditions, appointment types) that would flow into hit payloads.
Exclude patient-action paths (portal, booking, billing, intake) from collection with consent-mode defaults or tag-level path exceptions. In this audit that includes: /appointments, /conditions/knee-pain.
If the practice needs analytics on sensitive paths, evaluate a healthcare-configured proxy/CDP layer as the sole egress instead of direct collection.

Verify: Re-scan and confirm collect requests to google-analytics.com/analytics.google.com no longer fire on patient-intent pages before consent action.

Scope Google Ads / DoubleClick conversion tracking

Applies to: Google Ads / DoubleClick | Owner: Marketing/agency

Inventory every conversion action in Google Ads and identify which pages fire them; healthcare conversion tracking should measure campaign landing outcomes, not patient behavior.
Move conversion tags off patient-action, treatment, and portal pages; measure with location or phone-call conversions instead where possible. In this audit that includes: /appointments, /conditions/knee-pain.
Disable enhanced conversions unless counsel has approved hashed contact data flowing to Google.
If Google signals or GA4-linked audiences drive the DoubleClick requests, unlink or disable audience sharing for this property.

Verify: Re-scan and confirm no doubleclick.net or googleadservices.com requests complete on patient-intent pages.

Remove session replay from patient-facing pages (Hotjar)

Applies to: Hotjar | Owner: Developer + privacy officer

Treat session replay as a high-priority review: it can capture mouse movement, page context, and form interactions. Hotjar suppresses input values by default, but visible text and allowed-field configuration can still expose sensitive context, so verify the implementation rather than assuming every field is masked.
Remove the replay script from every page that can carry patient context (forms, portal, booking, billing, symptom content). For most clinics this means removing it entirely.
If a limited use case remains (e.g. anonymous marketing landing pages), enable the vendor's strictest privacy mode: mask all inputs, suppress text, and block recording on excluded paths.
Ask the vendor to delete historical recordings that may contain patient interactions, and document the request.

Verify: Re-scan and confirm no replay vendor requests complete anywhere on the site.

Install a consent management platform with actual blocking

Applies to: Sitewide | Owner: Developer + privacy officer

Choose a CMP that blocks tags before consent (not a banner that only displays text); confirm it integrates with your tag manager's consent mode.
Configure default-deny for advertising and analytics categories; strictly necessary only before an affirmative choice.
Wire the tag manager's consent settings to the CMP signals so every marketing tag requires the corresponding consent state.
Test the reject path: with all consent declined, no marketing or analytics request should fire on any page.

Verify: Re-scan and confirm the consent controls are detected and no tracker requests complete before affirmative consent action.

Developer checklist

Audit tag-manager triggers, exceptions, consent settings, and path-based firing rules before changing individual tags.
Disable session replay on patient-facing pages, or document masking, vendor terms, and privacy/compliance approval before leaving it enabled.

Who owns what

Marketing / agency: Identify which campaigns, conversion goals, and tag-manager triggers require patient-facing placement.
Developer: Audit GTM triggers and rebuild conversion tracking around non-sensitive events.
Privacy / compliance: Decide whether vendor terms, authorization language, policy updates, or remediation documentation are needed.

If an agency or vendor runs your site, ask them

Are advertising or conversion tags intentionally firing on appointment, contact, billing, pricing, membership, or treatment pages?
Which analytics properties receive URL, title, referrer, event, or custom-parameter data from patient-facing pages?
Which tag-manager triggers, exceptions, and consent settings control firing on patient-intent paths?
Does the tag-manager container include any unpublished Meta, remarketing, or conversion tags?
Is there documented privacy/compliance review for these technologies on patient-facing pages?

Clinic Pixel Audit provides technical website evidence and operational guidance. It is not legal advice. Review findings with counsel, your privacy officer, or your compliance lead.

Questions about a finding, or fixing this on behalf of the practice? Email support@clinicpixelaudit.com and we'll help.

Next step

Keep fixes from drifting.

Send this to your developer or agency as a work order. If they push back or have questions, put us on the thread and we will handle the technical back-and-forth, then verify the fix landed.

Verify the fix and keep watch · $99/mo Download PDF Export CSV for review

The one-time audit covers your 25 highest-risk pages with PDF/CSV evidence and remediation playbooks. Add weekly monitoring afterwards to keep the audit current in a dated compliance file.