Frequently asked questions.

Ghost Metrics is HIPAA-compliant website and product analytics built for healthcare. You get real-time visitors, audiences, funnels, heatmaps, and more, engineered so protected health information never enters the analytics pipeline.

You get the same depth of insight, but we sign a BAA and strip PHI at the edge. Google explicitly will not sign a BAA, which makes Google Analytics non-compliant on any page that may touch PHI.

Hospitals and health systems, clinics and private practices, behavioral and dental practices, pharmacies: any healthcare organization that needs real analytics without putting patient data at risk.

Yes. Compliance is built into the data pipeline rather than bolted on: PHI is filtered out before it is ever stored, and we sign a Business Associate Agreement with every customer.

Yes, on every plan. We sign a BAA with every organization we work with, so you are covered from day one. Our standard agreement is ready to sign; minor redlines are available on Premium and custom terms on Enterprise.

Any data that can tie a visit to a person in a health context: IP addresses, certain URLs and page titles, query strings, and form fields. We filter and hash these at the edge before anything is stored.

Entirely within US-based infrastructure, encrypted with AES-256 at rest and TLS 1.2+ in transit.

Yes. We have a SOC 2 Type II report from an independent auditor, in addition to our HIPAA posture.

Real-time visitors, audience segments, custom events, conversions and goals, funnels, cohorts, heatmaps, A/B tests, and media analytics: a complete suite, not a stripped-down privacy tool.

Yes. Heatmaps and session replay are included, with automatic masking of every input so recordings never capture PHI.

Yes. Map the full path to a booked visit, find the drop-off, and measure goals, all without exposing sensitive data.

Yes. A Reporting API and data export let you pull clean, compliant data into your warehouse or BI tool.

Paste one lightweight script into your site, or use our Google Tag Manager template. There is no PHI configuration to maintain. Redaction is automatic.

No. The tracker loads asynchronously, so it never blocks rendering or hurts your Core Web Vitals.

Yes. Most teams swap a single snippet and keep their existing event names. Our team can help map your current setup.

Yes, there is a dedicated GTM template for a no-code install.

Plans start at $299/mo, with Enterprise priced custom. See the pricing page for the full breakdown. A signed BAA is included on every plan.

We do not offer a free tier, but you can book a demo and our team will get you set up and walk through evaluation options.

Yes. Reach out to our team to upgrade or downgrade, and we will move you to the right plan.

Yes, reach out and we will tailor a plan for larger health systems and nonprofit organizations.

AES-256 at rest and TLS 1.2+ in transit, hosted entirely within US-based infrastructure.

Only authorized members of your team, through role-based access controls, and every access is recorded in a granular audit log.

Yes. You can export or permanently delete your data at any time through the Reporting API or a request to our team.