There is a particular kind of website that asks you to trust it with the next hour of your body. You type a city. You pick a specialty. You pick a name. You pick a Thursday at 3:40. The confirmation email feels like the private part of the errand.

On Doctoralia, that errand was not private.

You Booked a Gynecologist. Google and TikTok Got the Appointment.

The Markup and Brazil’s Agência Pública spent time in the network tab of Doctoralia sites across Latin America. From almost the first search, embedded trackers started talking to Google, LinkedIn, and TikTok. A search for a gynecologist in São Paulo sent the specialty into Google’s marketing stack. Finish the booking and the doctor’s name, plus the date and time, went out too. Book a dermatologist in Cartagena and LinkedIn received the provider and the slot. Book in Bogotá — psychologist, dermatologist, whoever — and TikTok got the appointment.

Nobody had to type an email for that to start. The trackers tied the session to unique IDs that ad platforms are built to stitch onto a profile. You can call that “measurement.” The packet still says: this browser looked for this kind of doctor, with this person, at this hour.

The company line and the payload are not the same document

Docplanner, the Spanish-headquartered parent that runs Doctoralia across a string of countries from Turkey to Chile, did not shrug. Spokesperson Arsenia Nikolaeva said the questions were being taken seriously, that a technical and legal review was underway, and that the group remains committed to protecting personal data in every market. The company also said it does not monetize patient data, is not paid by the platforms for the feed, and uses the tags to watch its own social campaigns — not to run a commercial data product.

Believe the intent if you want. Intent does not rewrite the request. If the tag is on the booking confirmation and the confirmation includes specialty, clinician, and time, those fields left the clinic website and arrived at a company whose business is building audiences. “Internal use only” describes why marketing bought the pixel. It does not describe what the pixel transmitted.

Google said it has long-standing rules against collecting private health information or advertising from sensitive categories, and that it gives customers tools to avoid collecting health data. LinkedIn said its policies prohibit putting the Insight Tag on pages that collect sensitive data, and that it does not want that data. TikTok did not answer. Those policies are real. They are also the policies that keep showing up next to forensic logs in Pixel Hunt stories. Covered California. State insurance exchanges. Now a booking platform with millions of users in Europe and Latin America. The platforms write the rule. The customer implements the tag. The patient never meets either memo.

A specialty is not a diagnosis. It is close enough to regulate.

This is the argument health platforms reach for, and Brazil’s Federal Council of Medicine apparently reached for a version of it: booking is not a medical act, and looking for a specialist is not sensitive data. That is a category error dressed as clinical precision.

Google’s Health-Data Policy Met a Booking Pixel. The Pixel Won.

You do not need the ICD-10 code to know what a Tuesday gynecology slot, a Friday psychologist slot, or a same-week oncologist search is doing on an ad graph. Brazil’s National Supplementary Health Agency said the quiet part: the specialty and the other booking details can reveal aspects of a person’s health. Chiara de Teffé, a digital-law professor, pointed at the LGPD’s extra protection for behavioral information that reveals or lets you infer health. Rafael Zanatta at Data Privacy Brasil talked about permanent tracking on unique IDs and profiles people never agreed to. An anonymized gynecologist quoted in the investigation put it in the language patients actually use. Even without a stated diagnosis, the path you take looking for care can give away what should have stayed between you and the clinic.

Inference is the product. Ad tech does not need your chart. It needs a stable identifier and a reliable hint. “Searched gynecology in São Paulo, booked Dr. X for Thursday” is a hint with a calendar attached.

The map of the pixels is a map of who gets a real choice

The same corporate group does not treat every country the same way, which is the most honest paragraph in the investigation.

On the Spanish site, testers did not see the same outbound health payload. On the German site, a banner let people turn tracking cookies off. In the Latin American markets the reporters lived in — Brazil, Colombia, Mexico — a pop-up announced cookies and did not immediately offer a way to stop them. Tracking started before anyone entered a name.

That split is not a technical accident. It is what a company looks like when one headquarters lives under the GDPR and the growth engine lives under enforcement that is slower, newer, or easier to lawyer. The LGPD is not a soft statute. It wants transparency, a way out, and special handling for sensitive data. Failure can bring the Autoridade Nacional de Proteção de Dados into the room. Mexico and Colombia are patchier. None of those regimes asked for a booking flow that phones TikTok.

Docplanner likes to tell doctors their data is encrypted, never sold, never shared with other specialists. The consumer-facing privacy theater on some Doctoralia pages still recites that the company does not sell or share patient data with third parties. Pixels are sharing. They are sharing with parties whose entire model is third-party. If your public sentence is “we never share” and your HTML includes an Insight Tag on the appointment page, the public sentence is the problem.

This is not a one-off sloppy tag

The Markup has been running this playbook long enough that the industry can no longer pretend surprise. Health insurance marketplaces in the United States sent pregnancy, disability, and prescription details through the same families of tags. Lawsuits followed. Tags came down. The lesson that should have traveled with the CMS and the media team is simple: do not put a conversion pixel on a page whose URL or DOM contains a medical fact.

Doctoralia is not a state exchange. It is something more ordinary and, in some ways, more intimate. It is the Zocdoc-shaped front door for people who do not want to call a receptionist and announce a specialty in a waiting room. Docplanner says on the order of 100 million people use the wider network and tens of millions of appointments move through it in a month. Even a “campaign measurement” tag at that volume is a health-data pipe.

Marketing teams love the last-click story. Which ad made the patient book. Which campaign in which city. That story can be told with aggregated, delayed, non-specialized events. It does not require shipping the clinician’s name and the timestamp of a psychology visit to a short-video company. If your analytics vendor cannot measure a conversion without the specialty string, you have the wrong vendor — or you have a growth target that ate the DPIA.

What “acting appropriately after the review” has to mean

Nikolaeva’s statement bought time. Fair. A global tag audit across thirteen countries is not a weekend. The acceptable end of that audit is not a blog post about taking privacy seriously. It is a list.

Pull every marketing tag off search, profile, and booking pages unless a lawyer who has read the LGPD and the GDPR will initial the payload. If a tag stays, strip specialty, clinician identity, appointment time, location at the clinic level, and any unique ID that can be joined to a social profile. Hashing the doctor’s name and still sending the specialty is not clever. The specialty was the sensitive part.

Give Latin American visitors the same reject control Germany already had. A banner that only says “we use cookies” is not consent for health-adjacent behavioral data. Record the choice. Honor it before the first search fires.

Tell patients, in the jurisdictions that already received the traffic, what left and who received it. “A small number of marketing partners” is how this story stays ugly. Name the platforms. Say whether the data can be deleted on those platforms. Say whether the company asked Google, LinkedIn, and TikTok to purge the events. Then publish whether they agreed.

Doctors on the network should get a notice that is not written like a product update. Their names went out next to a slot. Some of them practice in fields where that pairing is not an inconvenience. It is a safety issue.

Regulators do not need a new theory. Brazil already has the sensitive-data chapter. The EU already has the health-data chapter and a tracker regime that Spanish and German pages appear to have taken more seriously. The interesting filing is not “is a specialty health data.” It is “why did the same parent company ship it in Bogotá and not in Madrid.”

The patient was never in the media plan

People use Doctoralia because calling the clinic still feels like announcing something. The site is supposed to be the quieter door. Putting an ad graph on that door is not a glitch in the culture of growth. It is the culture of growth. Measure the funnel. Optimize the campaign. Forget that the funnel is a person looking up a psychologist at 11 p.m.

Google and LinkedIn will keep saying they forbid this. They should enforce the forbid on the customer that keeps sending it, not only in the policy center. TikTok should answer the phone. Docplanner should finish the review with pages that no longer phone home when someone books care.

Until then, the honest product description is shorter than the privacy page. Search for a doctor. Book the hour. Assume three advertising companies already know which kind of doctor, and when.