About
Consential is compliance infrastructure for medical and aesthetic practices. It holds non-essential tracking until a patient decides, writes that decision to a record nobody can edit afterwards, including us, and reports every month on what the website actually did. That is the whole product. The list of things we have deliberately not built is longer than the list of things we have.
Last reviewed 27 July 2026 · changes to this page are dated, not silent
Consential is early, and a number of practices signed is not evidence of anything a buyer should care about. These are things that exist today and that you can open and check yourself.
01 — WHERE THIS CAME FROM
We built a tracking scanner before we built anything else, to answer one narrow question about medical practice websites: what leaves the browser before the patient has agreed to anything? Not what the privacy policy says. What the network tab shows.
The answer came back the same almost everywhere. Google Analytics, Meta Pixel and Google Ads, all firing within the first few seconds of the page loading, on pages where somebody was reading about a procedure or filling in a consultation form. Often there was a cookie banner sitting on top of it. The banner was decorative — the tags had already fired behind it, and nothing anywhere stored what the visitor clicked.
A banner that appears after the tags have fired is not a consent gate. It is a picture of one.
That gap is the entire reason this company exists. HHS and OCR have published guidance on online tracking technologies, parts of it have since been litigated, and a practice can read three law-firm alerts and come away with three different answers. We are not going to settle that argument for you. What we will do is describe precisely what your website did, in a document with a date on it, and leave the legal conclusion to your counsel.
The scanner that started all of this is still free and still public. It takes about fifteen seconds and does not ask for an email before it shows you the result: analyze.consential.io.
02 — WHAT IT RUNS ON
A consent record is worth exactly what its integrity is worth. If the vendor can rewrite it, it proves nothing, and a practice handing it to an investigator has handed over a spreadsheet. So the constraints below are enforced by the database and the network, not by our good intentions.
UPDATE and DELETE are revoked at the database permission
level on the consent table. Our own application account cannot alter a row it wrote
a second ago. Neither can we.The full architecture, the encryption posture, what we store, and an explicit list of what we do not claim are all written out on the security page.
03 — WHAT DECIDES WHAT GETS BUILT
These are not values in the poster sense. Each one has been used to reject something a customer asked for, which is the only test of whether a principle is real.
01 — Autonomy
No feature may require the practice, their webmaster or their developer to do something for the product to function. Install, run, document, report. A feature that depends on a human remembering is a to-do list, not a product — and a to-do list is what generates the support conversations that quietly eat a small company.
02 — Restraint
When a patient makes a choice, we write the choice, the time, the version of the policy they were shown, and a random visitor id. We do not write a name, an email address, a phone number, a raw IP address, the page they were on, or anything about why they were there. The record proves consent. It is not a profile, and it must never become one.
03 — Equal weight
Accept and decline carry the same visual weight in our consent box. The colours are yours to set; that balance is not. It is the one thing that separates asking a patient a question from steering them, and in a healthcare setting a nudge is not a neutral design choice.
04 — Evidence over assurance
We do not sell certainty, and we could not deliver it if we tried. We sell the document you would want in front of you if somebody asked what your website was doing in March. Certainty is not a thing software can give you here — a record of what actually happened is.
04 — POSITIONS WE HAVE TAKEN
Permanently rejected
An overlay is a script that repaints a page for visitors who press a button. It is the easiest thing in this category to sell and the easiest to demonstrate. It also does not change what the page is — and the people it claims to serve have said so, loudly, for years. We report what is broken, name the element and the rule, and do not pretend a widget fixed it.
Published, dated
consential.io scored 79 out of 100, grade B when we last measured it on 25 July 2026, using the same accessibility engine we sell. The failures are colour-contrast defects in our own shared stylesheet, and they are written down rather than quietly fixed first. A compliance vendor that will not publish its own score is telling you something. See the module.
House rule
No comparison tables, no "versus" pages, and no partner badges from the platforms we integrate with. A logo on our site would imply somebody reviewed and approved us. Nobody has. Where other companies' marks appear, they mean we can gate the tag — not that the owner endorses anything.
Enforced in code
Every statutory figure in our reports is quoted from the statute rather than paraphrased, because paraphrasing a damages provision gets it wrong. Every one is a maximum or a pleading floor, never a prediction of what you would pay. Where language is still awaiting review by healthcare counsel, the page says so instead of hoping you don't ask. Risk disclosure.
05 — SCOPE
Said plainly here so nobody has to infer it from a footer disclaimer.
Not a law firmWe describe what your website does. Whether that creates a legal problem for your practice is a question for your own counsel, and we will not answer it for you.
Not an insurance productNothing here indemnifies you. If a claim arrives, what Consential gives you is the documentation, not the defence.
Not a marketing agencyWe build and run software. We do not buy your media, write your ads, or manage your website, and we are never going to compete with the people who do.
Not a guaranteeUsing Consential does not make a practice compliant with HIPAA or with any state law, and no honest vendor can sell you that. It strengthens the position you would be arguing from.
You will learn more about whether any of this matters to your practice in fifteen seconds of evidence about your own domain than in a demo. The report names every request that leaves the browser before a patient is asked, and prices each finding under your own state's law. No signup, and the result appears before anything asks for an email.
Questions about the product, pricing or an install go to contact, and setup answers live in the FAQ. Whichever one you pick, a person reads it.