What your website shares,
and what we do about it.

A website visit can send information to more than your clinic.

When someone opens your website, their browser downloads the page. It may also load tools installed by your developer, agency, booking provider or marketing team. Some of those tools contact Google, Meta or another company directly from the visitor's browser.

An advertising pixel or analytics tag is a small piece of code that helps measure visits, bookings or advertising results. Depending on its configuration, its requests can include the address of the page being viewed, the page title, an event such as a booking action, or browser identifiers. The exact information varies by tool and setup.

Knowing a tool is installed is only the starting point.

You may deliberately use Google Ads to attract new patients. The separate question is whether its tag runs only where you intend it to, and what it receives from each page. A tag set to run across the whole site can also run on sensitive service pages or booking journeys.

A tag manager is the tool often used to switch these tags on and off. A consent banner is the interface asking visitors for a choice. Seeing either on your website does not, on its own, show what your browser actually sends before or after that choice.

A page address can reveal something a visitor considers private.

A visit to a general homepage provides different context from a visit to a page about fertility treatment, trauma support, mental health or an assessment. The page address itself can indicate what a person is looking for. An enquiry is not the only point at which information can leave the website.

Without checking, you may continue sharing more than you intended. You may also be unable to give a patient, practice manager or privacy adviser a clear answer about what is sent and who receives it. Advertising reports and a working website do not answer those questions.

This is an active issue in Australian healthcare.

On 24 June 2026, the Office of the Australian Information Commissioner published findings about privacy breaches at Medmate and Monash IVF involving sensitive information collected through third-party tracking pixels. It also published a separate report on inspections of 50 health service provider websites.

Those findings concern specific organisations and circumstances. They do not mean every pixel on every health website is unlawful. They do make it important to know how your own implementation behaves, rather than relying on what you believe was installed.

Your privacy or legal advisers assess your obligations. Vantage supplies technical evidence about your website. We are independent and are not endorsed by the OAIC.

We detect the tracking, verify the evidence and help fix what should change.

Our work is a technical check of your website, followed by practical changes where you want them and ongoing checks if you need them. It is not just a list of tools or a general privacy information session.

You receive something your practice and your developer can both use.

The audit report explains important findings in plain English and includes the technical evidence needed to review them. You can share it with your agency, developer and privacy advisers.

A map of observed tracking

Detected tools, third-party destinations and the pages where requests were observed.

Evidence for important findings

The page checked, the request destination, the visible information sent and the conditions of the capture.

A clear explanation of the concern

Why a finding matters in that page's context, what is confirmed and what remains uncertain.

Practical next steps

Which settings to review, narrow or remove, and what needs re-testing after a change.

If remediation is agreed, you also receive the results of the follow-up checks so you can see what changed. An audit identifies and recommends changes; making those changes is a separate piece of work agreed with you.

Fixing the problem does not have to mean switching off your marketing.

For example, an advertising tag may be useful on a general campaign landing page but need review on an assessment page. A tag-manager rule might be changed so it no longer runs everywhere. An old campaign pixel may no longer have any useful purpose.

Depending on the findings, we may recommend page exclusions, narrower triggers, revised events, removal of redundant tools or changes to how tags respond to consent choices. We agree the changes before work begins and test the behaviour before and after.

Tracking changes can affect conversion reporting, audience building or campaign optimisation. We explain those trade-offs and involve the people responsible for your advertising. No technical change can guarantee that advertising performance will stay exactly the same.

You do not have to replace your agency. They can implement our recommendations, or we can help with the agreed work. Testing the result is part of checking that the change did what it was meant to do.

A website can change after an audit. So can its tracking.

A new marketing campaign, plugin, booking integration or developer update can introduce a tag or change where it runs. A tag you removed can return when an older configuration is republished. A one-off audit cannot tell you what happens months later.

Monitoring compares later checks with the earlier findings. It helps you spot changes so they can be reviewed, rather than assuming the previous fix still holds. The value is an ongoing record of observed behaviour and a reason to investigate unexpected changes.

Monitoring is not a guarantee that every change will be detected immediately. Its coverage depends on the agreed pages, journeys, conditions and checking schedule.

We show what we can prove, and explain what we cannot.

• A capture is evidence of observed behaviour. It shows what happened on the checked pages under the recorded conditions. Different consent choices, browsers, locations or user journeys may behave differently.
• A third-party request is not automatically a legal breach. Its purpose, information, consent and wider circumstances need assessment. Vantage does not provide legal advice or a compliance certification.
• Browser checks have limits. They do not show everything that happens inside a vendor's systems or every transfer between servers. A clean browser capture is not proof that no other sharing exists.
• We do not need real patient records to check public pages. If a journey needs access or test data, we agree how to handle that safely before reviewing it.

If you need legal interpretation, give the evidence to your legal or privacy adviser. The OAIC also publishes guidance on tracking pixels and privacy obligations.

Start with your website address. We agree the work before you commit.

Initial Website Tracking Audits start at A$149. We confirm which pages and journeys need checking and the total price before the audit begins. Remediation and monitoring are scoped and quoted separately.

1. Send an enquiry. Tell us your website address and any tool, page or recent change you are concerned about. You do not need to identify the technical problem yourself.
2. We confirm the scope and price. We agree what will be checked, what you will receive and any access needed. Do not send passwords or patient information in the enquiry form.
3. You decide whether to proceed. Sending an enquiry does not authorise work, payment or changes to your website.