Provena
Ad attribution that shows which ads make money, built for HIPAA and GDPR.
Performance marketers need to know which ads, campaigns and channels bring in revenue. The tools that answer this track visitors aggressively and send page addresses, IPs and emails to ad platforms, which clinics and health brands cannot do under HIPAA and EU businesses cannot do under GDPR without consent. Provena gives them the same attribution with a privacy firewall in front: consent first, personal and health data stripped before storage, conversions sent back to ad platforms only as hashes for visitors who said yes, plus the consent ledger, data request tools and audit log a regulated business needs.
- Stage
- Working demo with two workspaces
- Launch market
- EU clinics and shops, then US healthcare
- Revenue
- Monthly subscription by tracked events
- Price
- Planned EUR 149 to 890 a month
- Buyer
- Marketing leads, clinic owners, agencies
- Stack
- Node.js · SQLite
The problem
- Google, Meta and TikTok each claim the same sale, so budgets go to the wrong campaigns.
- Tracking pixels on health sites disclose protected health information, and US hospitals have paid millions over the Meta pixel.
- In the EU half the visitors decline cookies, and ordinary tools then lose them completely.
The product
A small first-party tag records visits, ad clicks and conversions. Before anything is stored, the privacy firewall removes emails, phones, CPR and social security numbers, record ids, card numbers and, in HIPAA mode, health topics from every URL, and shortens the IP address. Visitors who decline are counted cookieless one day at a time. The attribution engine compares six models and shows revenue, spend and ROAS per channel and campaign. Conversions go back to ad platforms only with marketing consent, hashed, and never with identifiers in HIPAA mode without a BAA.
- The customer adds one script tag and calls track() where a sale or booking happens.
- Their own cookie banner passes the visitor's choice to Provena.
- Ad spend is imported from Google, Meta and TikTok.
- Marketing reads journeys, campaign ROAS and model comparisons in the dashboard.
- Compliance staff use the consent ledger, data requests and audit log.
Who pays and why
Business model
| Revenue line | Price | Notes |
|---|---|---|
| Starter | EUR 149 a month (planned) | Up to 250,000 events, 3 ad platforms, GDPR toolkit. |
| Growth | EUR 449 a month (planned) | Up to 2 million events, server-side API, call, print and QR tracking. |
| Clinic (HIPAA) | EUR 890 a month (planned) | Everything in Growth, HIPAA mode, signed BAA, health-topic redaction. |
Market and targets
Attribution software is an established category with US tools charging hundreds to thousands of dollars a month, but most of it is unusable for regulated buyers since US regulators said in 2022 and 2024 that tracking technologies on health pages can disclose PHI. Europe adds GDPR consent rules for every advertiser. Health and EU advertisers are a large group that today either flies blind or takes legal risk.
Targets and prices are planning assumptions.
Go-to-market
Demo and pilots
- Live demo with clinic and shop workspaces (done)
- Three pilot clinics and two EU shops on free setup
- Real Google, Meta and TikTok conversion API connections
Agency channel
- Partner program for performance agencies
- Multi-client view and white label reports
- Ad spend import via the platforms' APIs
US healthcare
- US hosting region and BAA template reviewed by counsel
- Independent security assessment
- HIPAA landing pages and case studies
Channels
| Performance agencies | One agency runs ads for many clinics and shops and chooses the tools. |
|---|---|
| Clinic networks and associations | Groups of clinics share marketing and compliance concerns. |
| Search and content | People search for HIPAA compliant tracking and GDPR compliant attribution. |
Competition
| Alternative today | Why we win |
|---|---|
| Classic attribution tools | Strong attribution, but built on tracking that regulated buyers cannot use. |
| Ad platform reporting | Free, but each platform grades its own homework. |
| Privacy analytics tools | Respect privacy, but do not tie revenue to ads or send conversions back. |
What we measure
- Tracked events per customer
- Share of events cleaned by the firewall
- Consent rate and matched conversions sent
- Trial to paid conversion and monthly churn
Status and roadmap
- Consent-first tag with cookieless fallback and daily rotating salt
- Privacy firewall with HIPAA health-topic redaction
- Six attribution models, ROAS per channel and campaign, CSV export
- Journey timelines, live event view
- Consent ledger, access and erasure requests, hash-chained audit log, retention purge
- Simulated conversion sync to Google, Meta and TikTok with logged payloads
- Test site with the real tag, PWA dashboard, two demo workspaces reset nightly
- Real conversion API connections to Google, Meta and TikTok
- Ad spend import from the platforms
- Customer signup, billing and team roles
- Call tracking numbers and offline sales import
Risks
| Risk | How we handle it |
|---|---|
| Regulators read HIPAA strictly | No identifiers leave Provena in HIPAA mode, a BAA is offered, and the setup is reviewed by counsel before US launch. |
| Ad platforms change their APIs | Sync is a separate layer per platform, and attribution works even without it. |
| Fewer journeys when visitors decline | Cookieless counting keeps visits and same-day conversions, and models are shown with that limit made clear. |
Want a product like this?
We build version one of products like Provena from about $3,000: web app, admin panel, mobile app and API, live on your own domain. Then we can host and maintain it for $500 a month.