Compliance isn't a promise. It's a paper trail.

It sits in front of every non-essential script on your practice website. GA4, Meta Pixel, Google Ads, GTM, call tracking — all held on load. Nothing fires until a visitor takes an affirmative, granular action on the consent banner. Every decision is written to a database-level, append-only audit trail with a timestamp, and the consent state is signalled to Google Consent Mode v2 so your measurement stays intact.

A cookie plugin styles a banner. Consential gates the scripts themselves — GA4, Meta Pixel, Google Ads, and GTM stay dark until a visitor takes an affirmative, granular action, and every decision writes to a database-level, append-only audit trail that can't be edited or deleted after the fact.

Consent records are written once and never rewritten. A record can't be edited or deleted after the fact — including by us. If a visitor changes their mind, that becomes a new record rather than an overwrite of the old one, so the history reads as a timestamped sequence of decisions instead of a single current-state field somebody could have changed last week.

Yes. The consent layer detects visitor jurisdiction and applies the relevant opt-out framework — CCPA, VCDPA, CPA, or CTDPA — alongside your HIPAA-driven tracking controls. See how state privacy detection works.

A branded page where a visitor can view what they consented to, change any category, or revoke everything. Every change writes to the same append-only trail as the original banner decision, so the record stays continuous.

No. No tool can. Compliance is your practice's responsibility. Consential provides consent infrastructure and a defensible, timestamped history of what your site did and when — that supports your compliance posture, but it isn't a substitute for a compliance program or for counsel.

No. Consential is compliance tooling, not a law firm. Your attorney should review your consent language and category definitions before you go live. For questions about your practice's obligations, consult qualified healthcare counsel.

No. Consential does not indemnify your practice. What it provides is a documented, timestamped record showing your site held trackers until a visitor made a choice. Regulators and settlement negotiations weigh demonstrated good-faith effort, and that record is what demonstrates it.

No. Your EHR, your BAAs, your training, your policies, and your risk assessment are all still yours to run. Consential covers one specific surface: the website's tracking and consent layer, which is the piece most practices have no controls on at all.

Your EHR is covered. Your payment processor is covered. But your website's consent layer, the cookies it drops, the trackers it loads, and how it handles form data all create potential exposure — and that's the surface HHS OCR guidance on online tracking technologies is aimed at. Most generic consent tools don't account for any of it.

No — and be skeptical of any vendor who says otherwise. Consential is built for practices that operate under HIPAA and is designed with those considerations in mind, but compliance itself remains the sole responsibility of your practice. What Consential provides is the tooling and the evidence trail that supports your posture.

Every default in Consential was set knowing the sites it protects collect health-adjacent information. A consultation request form asking about hair loss is not the same as a shoe store contact form. A before-and-after gallery has consent implications a generic portfolio page doesn't. The defaults, the categories, and the documentation reflect that.

Yes. Consential.io is built for HIPAA-covered practices, and a Business Associate Agreement is available at the practice level before you go live. Read the BAA.

Tools like CookieYes and Termly were built for any website on the internet. They don't know what PHI is, and they don't treat a medical practice's data collection as different from an online store's. Consential is purpose-built for medical and aesthetic practices — the defaults, the category definitions, and the audit trail are designed for the HIPAA-regulated environment you already operate in.

One lightweight snippet in your site header. WordPress has a plugin. GoHighLevel and Next.js take a single code snippet. In the current phase, EFFVIT installs and configures it for you rather than handing you a self-serve signup.

In this phase, EFFVIT installs the consent layer for you — configuring domains, categories, and jurisdiction rules — rather than a self-serve signup. Most single-location practices are live within a few business days of kickoff.

WordPress, GoHighLevel, and Next.js have first-class installation paths. Anything that lets you add a script tag to the page header can run the consent layer.

The gate is live immediately. Non-essential scripts are held on load, visitors see your banner, and every decision starts writing to the audit trail. From there it runs on its own — you review the dashboard when you want to, not because the system needs you to.

GoHighLevel is a first-class integration on the Professional tier. Every other CRM, ad platform, or internal tool connects through universal, HMAC-signed webhooks and a practice-scoped API key.

Anything that loads as a script or pixel: GA4, Google Ads, GTM, Meta Pixel and Conversions API, TikTok, LinkedIn, Microsoft Ads, the major DSPs, and call-tracking platforms like CallRail and CallTrackingMetrics. See the full integrations list.

Starter is $149/mo for a single domain, one location. Professional is $199/mo and adds GoHighLevel integration, HMAC-signed webhooks, a branded preference center, and compliance exports. Enterprise is custom-priced for multi-location groups and networks. See the full breakdown.

Starter covers one domain with the consent widget, the append-only audit log, the compliance dashboard, and the patient preference center. Professional adds the downstream half: GoHighLevel sync, universal HMAC-signed webhooks to any endpoint, a branded preference center, and compliance exports.

No. Installation and configuration are included — in this phase EFFVIT does the install as part of onboarding.

Billing is monthly today. Annual billing with a discount is planned.

Consent records are retained for the HIPAA minimum of six years, exactly as captured — nothing is rewritten or deleted. Your active tracking gate simply turns off.

Pricing is per domain. If your locations share one website, one subscription covers it. If each location runs its own site, each needs its own — and multi-location groups are what the Enterprise tier and its rollup view exist for.

Technical configuration about your website — the scripts, pixels, cookies, and categories in play — plus each visitor's consent decision: what was granted or withheld, in which categories, with a timestamp. It does not collect, access, or store patient records, health information, or the contents of your practice's form submissions.

No. Consential governs the tracking layer. It never touches your EHR, your medical records, or the body of a form submission.

On AWS, using HIPAA-eligible services under AWS's Business Associate Addendum via AWS Artifact. Data is encrypted in transit and at rest, and each practice's records are scoped to that practice. See the privacy policy.

Yes. Compliance exports are included on the Professional tier, and a visitor can download their own consent record from the preference center at any time. It's your documentation — you should be able to take it with you.

It's built specifically for medical and aesthetic practices — hair restoration, plastic surgery, dermatology, med spa, cosmetic dental, and similar. The HIPAA-conscious defaults and category definitions are designed for that audience. If your practice operates under HIPAA and has a website that collects information from visitors, it was built for you.

Yes. Consential came out of EFFVIT's own agency work across a medical client fleet, and the Enterprise tier includes a white-label option, multi-location rollup, and practice-scoped API keys. Start on the partners page.

Only for the initial install, and often not even then, since EFFVIT handles it in this phase. After that there's nothing to maintain, update, or patch on your end.

Run the free scan. It shows you exactly which trackers fire on your site before a visitor consents to anything — about 15 seconds, no signup. If the answer is “none,” you don't need us. Scan your site.

Email support is included with every subscription. For installation or configuration issues, we work the problem directly rather than routing you through a ticket queue. Contact us.

Yes. Colors, copy, button labels, and consent categories are all configurable, and the preference center can be branded to your practice. Consential ships with HIPAA-conscious defaults that work for most practices out of the box.

Send it over and we'll add it. The gate works on script and pixel patterns, so a tracker we haven't catalogued yet is a configuration fix, not a rebuild. One honest limitation: a script injected into the page by other JavaScript after the page has already rendered is harder to intercept than one present in the page source, so those cases get handled individually.