Consent management for medical practices
Consent management designed for medical practices. Block non-essential tracking, document patient choices, and keep connected systems aligned.
Non-essential tracking blocked until a choice is made.
The product
Every vendor in this category sells you a feeling. Consential produces a document: what was running on your site, what a patient chose, what changed since last month, and the date each of those was true. It arrives whether or not anyone on your team opens it.
Non-essential trackers stay dark until the visitor chooses. Consent Mode v2 signals go out in the right order.
Append-only at the database level. Corrections are new entries, never overwrites. Six-year retention.
Accessibility scanned against WCAG 2.1 AA. Live scripts compared to what your configuration declares. Policy age checked.
A dated report with your domain on it, showing what was found, what changed, and what it means. Nobody has to request it.
4,182GA4 · Ads · Meta · GTM1 — clarity.ms9 open · 14 closed2024-11-02 · 20 mochain verifiedAppend-only. Hash-chained daily. Retained six years.
Consent module
Non-essential scripts stay dark until a visitor takes an affirmative, granular opt-in action across Essential, Analytics, Marketing, and Communications. Google Consent Mode v2 compatible, so GA4, Meta Pixel, Google Ads, and GTM only fire once gatekeeping rules allow it.
Maintain documented, append-only consent records — nothing is edited or deleted after the fact, only added to.
Patients can view, update, or revoke consent by category anytime, without contacting the practice. Every change appends to the record — patient rights management, handled end to end.
Process
Set domains, scripts, and granular consent categories — Essential, Analytics, Marketing, Communications — plus state-level jurisdiction rules for CCPA, VCDPA, CPA, and CTDPA opt-out rights.
Add a lightweight, Google Consent Mode v2-compatible snippet to your site. Gatekeeping functionality blocks every non-essential script until a visitor acts.
Visitors see a clear banner and take an affirmative, granular opt-in action — accept, decline, or customize by category. Every choice is written to the append-only audit trail.
Approved tracking releases instantly, and HMAC-signed webhooks push the decision to GoHighLevel, your CRM, or any endpoint tied to your practice-scoped API key.
Google Consent Mode v2
Most practices cannot answer this. The one you are running was decided by whoever installed your tags, and it changes what Google sees and what your reporting is missing.
Read the breakdownScale
1 Location
Most common
2-3 Locations
4-5 Locations
Built for healthcare-sensitive environments
Built around HHS Office for Civil Rights (OCR) guidance on tracking technologies on covered-entity websites and apps — issued December 2022, with enforcement actions ongoing.
Data encrypted in transit (TLS 1.2+) and at rest (AES-256).
Granular permissions ensure the right access for the right people.
Append-only audit logs with secure, long-term retention.
Business Associate Agreements (BAA) available upon request.
Connected systems
Pricing
Consential.io runs on AWS HIPAA-eligible infrastructure, with audit logs retained six years to meet the HIPAA minimum. First rolling out across EFFVIT's own VMMG hair restoration and aesthetics client fleet.
Consent
$199/mo
One practice, one domain.
Most popular
Consent + Disabilities
$299/mo
Both compliance surfaces, one install.
Multi-location
Custom
Groups, networks, and several domains.
Important: Consential provides technical consent management infrastructure for healthcare websites. It is not legal advice, does not guarantee regulatory compliance, and does not replace a comprehensive HIPAA compliance program. Your attorney should review all consent language before deployment. See our full Risk Disclosure for details.
FAQ
Yes. Consential.io is built for HIPAA-covered practices, and a Business Associate Agreement is available at the practice level before you go live.
A cookie plugin styles a banner. Consential gates the scripts themselves — GA4, Meta Pixel, Google Ads, and GTM stay dark until a visitor takes an affirmative, granular action, and every decision writes to a database-level, append-only audit trail that can't be edited or deleted after the fact.
GoHighLevel is a first-class integration on the Professional tier. Every other CRM, ad platform, or internal tool connects through universal, HMAC-signed webhooks and a practice-scoped API key.
Yes. The consent layer detects visitor jurisdiction and applies the relevant opt-out framework — CCPA, VCDPA, CPA, or CTDPA — alongside your HIPAA-driven tracking controls. See how state privacy detection works.
Consent records are retained for the HIPAA minimum of six years, exactly as captured — nothing is rewritten or deleted. Your active tracking gate simply turns off.
In this phase, EFFVIT installs the consent layer for you — configuring domains, categories, and jurisdiction rules — rather than a self-serve signup. Most single-location practices are live within a few business days of kickoff.
Run a free live scan and see exactly which trackers fire before a patient consents — in about 15 seconds, no signup. Prefer a hand review? We'll do one too.