Healthcare app marketing: grow while respecting privacy rules

In 2023 the FTC charged that BetterHelp, an online therapy service, shared health data for advertising. According to the FTC, that included emails, IP addresses and health questionnaire answers, sent to Facebook, Snapchat, Criteo and Pinterest. The final order, approved in July 2023, made it pay $7.8 million and banned it from sharing health data for advertising (FTC).

That's the core problem for healthcare app marketing. The default growth stack can leak the exact data the law protects. This playbook is part of our growth playbooks by business type.

This is not legal advice. Have a privacy lawyer review your setup before you change tracking or launch campaigns.

What stage is your health app at?#

Healthcare app marketing is the work of winning and keeping paying users for a health, fitness or care app while keeping health data out of ad and analytics tools.

Bands by net MRR are my rule of thumb, not a standard.

The five healthcare app marketing moves that matter most#

Do these in order.

1. Map what every pixel and SDK sends#

What to do: List every tag, pixel and SDK in your app and site. Record what each sends: event names, URLs, parameters and user IDs. Look hardest at quizzes, logged-in screens and checkout.

Why: Health data leaks through small details, like a URL such as /plans/anxiety. GoodRx is the warning. In 2019 it uploaded email addresses, phone numbers and ad IDs of users who bought certain medications to Facebook. It then targeted them with health ads (FTC). In 2023 the FTC sought a $1.5 million civil penalty, its first action under the Health Breach Notification Rule.

Cost: 10–20 hours, or an outside privacy audit. Time to revenue: none directly. It protects revenue you have.

2. Know which rules apply, then get consent right#

What to do: Work out which law covers you. Make your privacy notice match what your tools do. Ask for clear consent before any sharing the app doesn't need.

• HIPAA tracking guidance. HHS says tracking tools on logged-in pages "generally have access to PHI," and so does a covered entity's app. In June 2024 a Texas court vacated one part: linking an IP address to a visit to a public health page (HHS). HHS later withdrew its appeal (Morrison Foerster).
• FTC rule for apps. The amended rule took effect July 29, 2024, and covers most health apps outside HIPAA. The FTC's guide lists penalties of up to $51,744 per violation, adjusted for inflation yearly (FTC).
• Washington. The law reaches businesses that target Washington consumers. It covers health inferences, and private parties can sue (Washington AG).

Cost: legal review plus a consent screen. Time to revenue: none directly.

3. Grow through app store search and content#

What to do: Rewrite your store title, subtitle and keywords around the problem you solve. Build custom product pages for each use case. Publish expert-reviewed articles on topics people search.

Why: These channels need no personal data. Apple says about 65% of downloads happen after a search on the App Store, based on 2022 data (Apple Ads). Apple now allows up to 70 custom product pages, which can show in keyword search (Apple Developer). The full list is in our app store optimization checklist for 2026.

Cost: 10–20 hours, then a few hours a week. Time to revenue: 2–6 weeks for store changes; content takes months.

4. Run ads that don't need health data#

What to do: Lean on search keywords, contextual placements and broad audiences. Let your creative do the sorting, not a list of patients.

Why: Google treats health as a sensitive category. Customer Match, your data segments and lookalike segments aren't supported for it. Predefined Google audiences, such as in-market and affinity, are still allowed (Google Ads policy). Meta began new limits for health and wellness advertisers in January 2025. The default setup blocks custom parameters and URL paths after the domain. Stricter tiers limit lower-funnel events, according to a Cardinal Digital Marketing summary of Meta's notice.

Keep conversions plain. A generic subscribe event with a value is enough to bid on. Send it from your server with an allow-list of fields, so no page URL slips through.

Cost: media budget, plus about a week of engineering for server-side events. Time to revenue: 4–8 weeks for a fair read on each campaign.

5. Measure payers in your own systems#

What to do: Join ad click, install and payment on your own server, under your own user ID. Never send ad platforms health answers.

Why: Ad tools that see little report little. The method is in our subscription app growth playbook. For web flows, pick a small set of key events with no health detail, as in GA4 key events for SaaS.

Cost: a few days of setup. Time to revenue: your first clean read comes after one trial length plus two weeks.

What should a health app measure in revenue?#

In RevenueCat's 2026 data, 82.1% of Health & Fitness trial starts happen on day 0 (RevenueCat). You can read trial intent within a day, without detailed in-app tracking.

What to stop doing#

Stop running ad pixels on logged-in screens and health quizzes. These pages hold the most sensitive answers. The cost of continuing is legal exposure on every page view.

Stop putting conditions in event names and URLs. A /plans/depression path leaks health data even when no form field does. Every week you wait adds data you can't recall.

Stop uploading user lists to build audiences. That's what turned GoodRx into an FTC case. You take on risk for little reach.

Stop retargeting by condition. An ad that follows someone from your "IBS diet" page says something about them. BetterHelp's order bans it from sharing personal data for retargeting (FTC).

Stop treating ad platform conversions as revenue. Under health limits they miss sales. Cut on their numbers alone and you'll cut campaigns that work.

How to do this in Kratly#

Kratly works with campaign and payment data. Never send it health data. Don't connect it to pages or systems that hold PHI. Check with your lawyer before you connect any tool, Kratly included.

1. Connect Google Ads and Meta Ads. Kratly reads spend and results by campaign. It needs no audience lists or health answers.
2. Connect Stripe for web checkout, and website tracking on public pages only. Keep tracking off logged-in screens and intake forms. Keep conditions out of paths and UTM tags.
3. See cost per paying subscriber by campaign. Kratly ties each payment amount to the campaign that brought the user.
4. Approve changes. Kratly suggests budget moves toward campaigns that bring payers. You approve each one, and every change is logged and reversible.

Want a first step with no user data? Run the free app store audit. It reads only your public store page.