The world’s largest health appointments platform, Doctoralia, removed web trackers sending personal information to tech companies following an investigation by The Markup and Brazil’s Agência Pública.

Pixel Hunt

How TikTok and Google ended up with information about doctors’ appointments around the world

Doctoralia sent information about specialists and appointment dates to social media companies.

In an article published last month, the two publications showed how social media trackers logged potentially sensitive health information, like patient searches for specialties, appointment dates, and doctors’ names. The trackers then transmitted that data to companies including LinkedIn, TikTok, and Google.

Doctoralia serves millions of people across Latin America and Europe. The investigation found the trackers being used across domains in multiple countries, including Brazil, Colombia, and Mexico.

If a person looking for care in Sao Paulo, Brazil, booked an appointment with a psychologist, for example, the search and doctor’s name were sent to Google through an advertising platform. Appointment information, including the date and time, was also sent to LinkedIn when users in Colombia or Mexico searched for and booked care. Similar data was sent to TikTok as well.

Personal information like patient names wasn’t included in the data reviewed by the publications. But such trackers tie users to unique IDs, which can be linked to users’ social media profiles.

Privacy advocates point out that basic medical appointment data can be used to infer more sensitive information. If a person is searching for reproductive healthcare, for example, it could imply they’re pregnant or trying to conceive. Searches for a radiation specialist might suggest the person is a cancer patient.

Businesses place social media trackers on their websites to monitor their traffic and tailor advertisements to visitors. But the social media companies themselves also receive that information, and can use it to fuel their algorithms, allowing them to target ads to people with specific interests or characteristics.

The companies say transmitting personal information, including health data, violates their terms of use, but in practice, there have been many instances of companies receiving such sensitive data.

It’s not clear how long the trackers were used on Doctoralia domains. But as of last week, the trackers were either fully removed, or had been changed to no longer collect personal information, according to another review of the sites’ web traffic.

Arsenia Nikolaeva, a spokesperson for Doctoralia parent company DocPlanner, confirmed the changes in an emailed statement.

Following last month’s article, the company “conducted a thorough internal review of how advertising measurement technologies are used across our websites,” she said, and “did not identify anything that raises concerns about our users’ privacy.”

“Nevertheless, in order to give our users an extra layer of peace of mind, we are introducing additional measures” by “going above and beyond in order to address any concerns.” Nikolaeva declined to specify all of those measures, but the network traffic no longer showed sensitive data being sent.

“We want our users to feel completely confident using our services: if we can go above and beyond to provide that reassurance, we will,” she said.