Cookies and pixel on the HOF clinic website

Almost every clinic website loads small trackers without anyone having decided it: the map icon, the embedded video, the analytics tool, the chat button and the ad platform's pixel. On an orofacial harmonization (HOF) website, this has an aggravating factor: someone browsing "lip filler" or "treatment for under-eye hollows" reveals an interest tied to their own health and appearance.

This guide explains, in management language, what cookies and pixels are, how the LGPD applies, how to set up notice and consent without breaking the site and what should never go to ad platforms. It does not replace legal advice: the final setup depends on the tools you use and should be validated by whoever handles privacy and digital law.

What are cookies and what is the pixel?

Cookies are files the browser stores at the site's request. Some are necessary (remembering the language, keeping the session) and some are optional (measuring audience, remembering the visitor on other sites, personalizing ads).

A pixel is a piece of code installed by the ad platform that signals when a visitor arrived at the site, viewed a page or clicked a button. The platform uses this to measure campaigns and build audiences.

The table is not legal advice: it helps you map what exists on the site and talk with the person responsible.

Why does this matter more in healthcare?

Health data is considered sensitive under the LGPD (sensitive personal data), and processing it calls for greater care. A page like "harmonization clinic to treat sagging skin" visited by an identifiable person and sent to a platform can be read as information about a condition or an intention to be treated.

There are three practical risks:

• Collecting more than necessary, if the pixel stores more than the clinic realizes.
• Lack of transparency, when the visitor does not know they are being tracked.
• Reuse for other purposes, such as building lookalike audiences from data the visitor did not expect to share.

How do you build the cookie notice?

A good notice has little text and covers the essentials:

1. What we use: necessary cookies and, if any, analytics and marketing ones.
2. What for: making the site work, measuring visits, improving ads.
3. A real choice: buttons to accept, refuse and customize, with equal prominence.
4. Where to learn more: a link to the privacy policy and the cookie policy.
5. How to change the choice later: a permanent link in the footer.

Should the pixel fire before or after consent?

The safe guidance is: the marketing pixel only fires after consent. This requires the site to be set up for it. Whoever installs the pixel directly in the code, without a tag manager, usually fires the tracking on the first visit, before any choice. Ask whoever maintains the site to:

• list all the third-party tools that load;
• separate the necessary ones from the optional ones;
• block the optional ones until the visitor chooses;
• record the choice so it can be proven later, if needed.

Test it yourself: open the site in an incognito window, accept nothing and check, in the browser's developer tools, what loaded. If optional tracking is already active, the notice is just decoration.

What does the site's privacy policy need to say?

Besides identifying the clinic, the policy should clarify which data is collected, for what, for how long, with whom it is shared and how the data subject exercises their rights (access, correction, deletion). Use the clinic privacy policy template as a starting point and adapt it. The text must reflect the reality of the site: a policy that says "we do not share data" on a site with an ad pixel is a problem.

If the site has a contact or booking form, include the data use notice there, at the point of collection, and ask only for what is necessary. See landing page for an HOF clinic and a website for an HOF clinic.

Remarketing: when is the risk worth it?

Remarketing shows ads to people who visited the site. It is a common practice, but it touches the most sensitive privacy points. Before using it, ask:

• Did the visitor consent to this use?
• Does the list include pages that reveal interest in a specific treatment?
• Can the clinic honor the request of a person who wants out?
• Does the ad shown expose something about the person to third parties who see the same screen?

See the full topic in remarketing for an HOF clinic and the LGPD. For the full set of precautions in marketing, see LGPD in the clinic's marketing.

How do you organize the work in one week?

If you hire an agency or a freelancer, put the responsibility in writing: what will be installed, who maintains it, how the advance blocking will be done. In case of a leak or misuse, the handling follows the logic of a security incident, with analysis of the case and of the applicable obligations. For the organizational side, see data security at an HOF clinic and data protection officer at the clinic.

The goal is not to give up measurement, but to measure without exposing. A clinic that explains clearly what it uses and lets people choose gives the visitor the same message as the consulting room: here, what is yours is treated with care.