OrcLink
Menu
Start free

For healthcare marketers: clinics, practices and telehealth

Learn which ads bring patients in, without sending health data to ad platforms.

Answer yes to the healthcare question at sign-up and HIPAA mode is on. OrcLink stores no page paths and sends generic event names. Sends stay off until the workspace owner records in the app that a BAA is signed, and the BAA takes effect only when both parties sign it.

Start freeHow it works

Sound familiar?

Ad pixels can leak what a page says about a patient.

  • Ad pixels on a clinic site can send page addresses that reveal a condition.
  • Without conversion data, ad platforms optimise for clicks, not for booked patients.
  • Legal asks what leaves your site, and nobody can show them a list.

How it works

Track bookings without sending health data, in three steps

  1. Step 1: Say yes at sign-up

    Answer yes to "Is this workspace for a healthcare business?". HIPAA mode and strict consent mode (no visitor cookie) switch on.

  2. Step 2: Capture bookings and calls

    Mark your booking forms and add tracking numbers. Email and phone are kept only as hashes; a call keeps the last 4 digits of the caller’s number.

  3. Step 3: Get the BAA signed by both parties, then send

    The workspace owner records the BAA in Conversions, Compliance, and you ask us to countersign it: it takes effect only when both parties sign. By default each batch then waits for your approval. Every send is logged.

At sign-up you tell us if you are a healthcare business. Only then does HIPAA mode switch on. In HIPAA mode no ad-platform upload, CRM write-back or outbound webhook leaves until a BAA is recorded (a webhook also needs one for its endpoint; a BAA takes effect only when both parties sign it), and GA4 events stay off. A workspace where nobody answered the question, and a client workspace an agency creates, start in HIPAA mode until the workspace owner turns it off in Conversions, Compliance.

Proof you can check

What OrcLink does, exactly

  • A filter runs on the final body of every upload and drops URLs, page titles, referrers, IP addresses, names and raw emails or phones. Each removal is logged.
  • In HIPAA mode, Pinterest, Snapchat, X, Amazon Ads, StackAdapt and The Trade Desk are blocked. The other platforms get generic event names, and some lower-funnel events are blocked.
  • Call transcription, AI call scoring and storing full caller numbers are never on in HIPAA mode.
  • Retention is 24 months by default. Once HIPAA mode is set for the workspace it is 90 days, or 12 or 24 months with a typed confirmation, and never without a limit.

What you get

Learn what works and keep health data in

HIPAA mode

Controls that keep identifying and health details out of what OrcLink stores and sends.

  • HIPAA mode

    Built

    Hashes only, no page paths, generic event names. Sends stay off until the workspace owner records in the app that a BAA is signed; the BAA takes effect only when both parties sign it.

    How it works: HIPAA mode→

  • Approval before upload

    Built

    By default each upload waits in a batch for an owner or admin to approve. Health data is stripped and every send is written to an audit log.

    How it works: Approval before upload→

  • Strict consent mode

    Built

    Click-level attribution with no visitor cookie and no fingerprint.

    How it works: Strict consent mode→

  • Consent manager support

    Built

    The tracking script follows CookieYes, OneTrust, Cookiebot, Google Consent Mode v2 and IAB TCF: load your consent manager first and the script writes nothing until the visitor answers. Link redirects and the Shopify pixel do not wait for a consent banner.

    How it works: Consent manager support→

Leads and calls, with less risk

See which ads bring bookings and calls. Recording stays locked without a telephony BAA.

  • Form capture

    Built

    On the forms you mark, reads the first email and phone field (never the message) and hashes them on arrival.

    How it works: Form capture→

  • Dynamic number insertion

    Built, not yet tested live

    Each visitor sees a number from your pool, so the call joins their visit, their click and their keyword.

    Included from the Small planHow it works: Dynamic number insertion→

  • Call recording

    Built, not yet tested live

    Off by default. Locked in HIPAA mode unless a telephony BAA is in place.

    How it works: Call recording→

  • CRM stage sync

    Built, not yet tested live

    Reads lead, deal and won stages from Salesforce, HubSpot, GoHighLevel, Pipedrive, Zoho, Dynamics 365, ActiveCampaign, Capsule, Insightly, SugarCRM and monday.com.

    How it works: CRM stage sync→

Control what is kept

Set retention, answer a person’s request, and honour browser privacy signals.

Coming soon: EU and UK data region. Not available in this release.

See every feature and its status

Plans

Start free. Pay for more visits when you grow.

  • Free

    Free, no card

    • 1,000 visits a month
    • 25 links
    • No call tracking numbers

  • Small

    Paid monthly or yearly

    • 10,000 visits a month
    • Unlimited links
    • Call tracking: 3 numbers and 250 call minutes included a month; more billed per number and per minute
    • Adds Google Sheets export

  • Medium

    Paid monthly or yearly

    • 50,000 visits a month
    • Unlimited links
    • Call tracking: 10 numbers and 1,000 call minutes included a month; more billed per number and per minute
    • Adds Segments, Data-driven attribution, Impression attribution, Warehouse export, Event streams (SNS, SQS)

  • Large

    Paid monthly or yearly

    • 100,000 visits a month
    • Unlimited links
    • Call tracking: 25 numbers and 3,000 call minutes included a month; more billed per number and per minute

  • Advanced

    Paid monthly or yearly

    • No visit limit
    • Unlimited links
    • Call tracking: 50 numbers and 10,000 call minutes included a month; more billed per number and per minute
    • Adds Marketing mix modelling, Media planner, AI agents

Every plan includes: Revenue tracking, Geo-routing, A/B testing, Bio pages, QR codes, Immortal links (never expire), Fallback URLs, Data export, Basic analytics.

A visit is a human site session or link click; crawlers, AI agents and test traffic are not counted. You see the price of a paid plan in Settings, Billing before you pay.

Call tracking above the included numbers and minutes is billed per number and per minute, at the rates shown in Settings, Billing. Phone numbers and call minutes are billed by Twilio on the workspace's own Twilio account; OrcLink's call tracking add-on is a platform fee on top of that.

Data-driven and impression attribution are modelled and not causal. The marketing mix model and the media planner give a rough, directional estimate.

  • No card to start

    The Free plan asks for a name, an email and a password. Nothing else.

  • Tracking never waits on billing

    Capture, link clicks, calls and incoming leads and sales do not check your plan. A billing error never switches off a feature that works.

  • Over your limit? Nothing is held back

    Tracking, reports and every export keep working. After 14 days over the visit limit, you cannot add some new setup until you upgrade or the month turns.

  • Cancel in the app

    Cancel from Settings in the app. Your links keep redirecting after you cancel.

  • Your data stays yours

    Export at any time: CSV, the open API, webhooks, or a warehouse on plans that include it.

Start in HIPAA mode, free

Create a free account, add the script, connect one source, and see results from your own data.

Start free

  1. 1. Create your account

    Name, email and password. You start on the Free plan, and tell us if you are a healthcare business.

  2. 2. Pick your setup

    A short setup asks for your store and makes a first tracked link. No store? Pick "No store" and go straight to installing the script.

  3. 3. Install the script and connect sources

    Add /t.js to your site, then connect your CRM, store, payments, forms or calls from the dashboard.