Meta's health and wellness ad restrictions for med spas: what broke, and how to keep tracking and optimising

By Benjamin Chua·Published October 18, 2026·13 min read

A museum coat check hands you a numbered tag. The museum knows tag 42 has a coat. It does not know your name, why you came, or what's in the pockets. That is what your Meta tracking has to become. This browser booked a consult. Never this person has melasma and is asking about a wrinkle relaxer.

Most med spa owners found out about Meta's health and wellness restrictions the hard way. The Lead event went grey in Events Manager, the campaign that had been booking consults for a year went quiet, and nobody at the agency could explain why. This guide covers what Meta's terms actually say, what you can still send, how to rebuild the pixel and Conversions API so they carry no health facts, how to measure revenue when Meta can no longer see it, and the audiences that still work for retargeting. If your account itself has been shut off rather than restricted, start with Meta disabled your med spa ad account instead.

What did Meta actually change for health and wellness advertisers?

Two things, and they get mixed up. The first is a rule about the data you send. The second is a restriction Meta applies to your pixel on its own.

The rule is in the contracts you accepted when you installed the pixel and uploaded your first customer list. Meta's Business Tools Terms, effective 3 November 2025, say Business Tool data must not be data that "includes or is based on, directly or otherwise, health information, financial information, consumer report information" and "must not reflect, imply or be based on any category of information described in this Section 1.h". The same terms make you the controller of that data, so the responsibility for what reaches Meta sits with the clinic, not the platform. The Customer List Custom Audiences Terms, effective 3 December 2025, carry the same exclusion for "health information, financial information, consumer report information or other categories of sensitive information". A list exported from your EMR is health information by its nature. Everyone on it is a patient.

The restriction is separate. Since 2025 Meta has been sorting the websites that send it data into categories and limiting what sites in sensitive categories can share. Med spa sites often land in health and wellness automatically. Meta's own help article on data source categories could not be read for this guide, so we are not going to describe the levels as fact. Open Events Manager, select your pixel, look at Settings, and treat the labels you see there as the rules that apply to you. The path and the third-party description of the levels are in our guide to advertising injectables on Meta. What we can say from clinics we have looked at: when the restriction bites, the standard events a consult campaign optimises on stop arriving, URL parameters get stripped, and conversion audiences built on those events stop filling.

What data can a med spa still send to Meta?

Four working rules, none of them legal advice. Treat all patient-identifiable data as if HIPAA applies, even if you believe your clinic is not a covered entity. Never put diagnosis, condition, treatment history or prescription data into a pixel, the Conversions API, a custom audience or an offline conversion file. Track marketing actions only: clicked an ad, viewed a page, requested information, booked a consult. Keep protected health information in your EMR and booking system, and use Meta for ads and anonymous event optimisation, never for patient analytics.

“If a reasonable person could infer a specific medical condition about a specific person from the field, do not send it to Meta.”

How do you rebuild the pixel so it carries no health data?

Think of a parking garage ticket. It records time in, time out and the fee. It does not store who was in the car or where they came from. Your pixel needs to be that honest and that dumb. Two steps.

1. 1

   Step 1: restrict where the pixel fires

   Remove it from the patient portal and login, every medical history or intake form, and any results page. Keep it on the homepage and general content pages, treatment category overviews such as Injectables or Skin Tightening that carry no intake form, consult request landing pages, and the thanks, your consult is booked page.

2. 2

   Step 2: standardise on four generic events

   PageView on every public page from the base code. ViewContent on service and offer pages, for example any URL containing /services/. Lead on the request-info thank-you page. CompleteRegistration on the consult-booked confirmation page, with no medical history collected before it fires.

Event names matter more than they look. If your developer once named an event filler_consult_rosacea or passed a treatment_code parameter, rename it to the generic label and strip the parameter. Keep marketing context only: campaign ID, creative ID, landing page. If your events are still being blocked after the rebuild, the restriction is on the data source category, and the fix is the objective switch covered in why med spa Meta ads stop working, usually to leads or messages.

Does the Conversions API get around the restriction?

No. Treat CAPI as a server-side pixel with the same rules. The Business Tools Terms quoted above cover every Business Tool, and the data-source restriction applies to your website as a source, whichever route the data takes. CAPI is still worth setting up, because browser blockers and iOS lose a share of pixel events, and a server event for consult booked is more reliable. It just has to be as empty as the pixel.

A minimal CAPI payload for a consult booking looks like this. Event name CompleteRegistration. Event time, the UNIX timestamp of the booking. Event source URL, your generic booking page, for example /book-consult. User data, hashed by your own server before it leaves, limited to email, phone and city or state. Custom data, two fields: event_source set to booking_system and appointment_type set to consult. Nothing else. No intake answers, no procedure codes, no free-text notes from the booking.

How do you measure revenue when Meta can't see it?

Build the report in your own CRM and let Meta be blind. This is the conservative mode, and we recommend it as the default for any clinic that has not had counsel sign off on anything else. Put UTM parameters on every booking link in every ad: utm_source, utm_campaign, utm_adset and utm_ad. Have your CRM store the first-touch UTM data and the revenue collected on every patient record. Then once a week, run one pivot: rows are campaigns, columns are consults, treatments and revenue.

Two formulas come out of that sheet. Cost per consult is ad spend divided by consults. MER, marketing efficiency ratio, is revenue divided by ad spend. Worked example with illustrative numbers: a campaign spends $4,000 in a month and produces 32 booked consults, so cost per consult is $125. Nineteen of those consults treat, at an average first ticket of $500, which is $9,500 in revenue and a MER of about 2.4. A second campaign spends the same $4,000 and books 48 consults at $83 each, but only 12 treat, for $6,000 and a MER of 1.5. Meta's dashboard would have told you to scale the second one. Your sheet tells you to scale the first. That is the whole point of doing this manually.

There is a second mode, and it only applies if your attorney is comfortable treating top-of-funnel marketing leads as general consumers rather than patients. In that case you can upload offline conversions for marketing leads only: people who came in through marketing pages, have not submitted any medical history, and gave explicit marketing consent. Export email, phone, city or state, event time, an event name such as ConsultBooked and a value, upload through Meta's offline conversions interface or an API connection from the CRM, and use it to sharpen optimisation and ROAS. Never export from the EMR or from any table that holds diagnosis codes or chart IDs. Get this mode approved in writing before you build it. The conservative mode costs you some optimisation signal and nothing else.

Why Meta lead forms are the safer place to collect interest

An on-platform lead form keeps the data inside Meta and your CRM, with no pixel event on your site to restrict. For a clinic whose Lead event has been blocked, this is often the fastest way back to a campaign that can optimise. Set the objective to Leads. Optimise for the Leads event to begin with, and only move to Conversion Leads once your CRM can automatically send back a yes or no qualified flag. Pick the higher intent form type, which adds a review step and filters out the accidental taps.

The questions are where clinics get into trouble. Ask about interest and timing. Never ask anything medical. Three that work: what are you most interested in, with a multi-select of wrinkle relaxers, fillers, skin rejuvenation, body contouring and not sure; when are you hoping to book, with this month, one to three months, or just researching; and how did you hear about us. Target adults in your drive radius, no narrower demographic slicing in the example set-up. Once the lead lands, the 7-minute callback is what turns the form into a consult.

“We only ask non-medical questions in ad forms. Any medical intake happens later, inside our own system, never in Meta. Ads are for interest. Charts are for care.”

How do you retarget when patient lists are off the table?

A building lobby log reads visitor 17, arrived 10:02, going to suite 500. Security records that someone came, when, and which door they used. Nobody logs why. Your retargeting pools are that log. Build them from behaviour Meta already measures on its own platform, which keeps them large and keeps the clinic out of the data-sharing question entirely.

• People who watched 50 percent or more of your videos, with the window set to 365 days so the pool keeps growing.
• People who opened a lead form and did not submit it.
• People who visited general pages: home, about, gallery, pricing. Only if those events still arrive for your pixel.
• People who engaged with the Instagram profile: messaged, saved, liked, followed.
• A weekly rule: every new reel or ad is added to one engagement audience the day it goes live.

Avoid any audience defined by a diagnosis or an implied medical status, and any lookalike seeded from an EMR export or a patient list. If the account already holds old patient email audiences, the working rule is to pause them, delete them, and rebuild from engagement. Any lookalike built on top of them goes too. Engagement audiences only grow if you keep publishing, which is why the clinics that come through the restriction best are the ones with a steady supply of injector-led video. Our free 12-month content plan is built to keep that supply going from one filming day.

Which tracking stack should your med spa run?

The five mistakes that cost the most

1. 1

   Pixel still firing on medical history pages

   Compliance exposure plus health data flowing to Meta. Audit every URL that holds a patient form or portal and remove the pixel code from those templates within 24 hours.

2. 2

   An EMR or patient list uploaded as a custom audience

   The highest regulatory and reputational risk on this page. Stop every sync from the EMR, delete the audiences and their lookalikes, and rebuild from video views, page engagement and top-of-funnel lead lists only.

3. 3

   Event names and parameters that reveal conditions

   Policy violations and blocked events. Rename to the generic labels, strip condition, diagnosis and treatment_code parameters, and keep only campaign and creative context.

4. 4

   Optimising for cheap leads instead of booked consults

   A bloated pipeline and a desk full of no-shows. Set the optimisation event to CompleteRegistration, qualify internally before anyone sees the calendar, and fire the conversion on qualified bookings only.

5. 5

   Relying on the website pixel alone for retargeting

   Small, unstable pools that collapse the day an event is restricted. Build 365-day video viewer, Instagram engager and form opener audiences and feed them weekly.

What the playbooks say about tracking you can trust

The reason to do all this properly is budget confidence. Hormozi's value equation puts perceived likelihood of achievement and time delay at the centre of what people pay for ($100M Offers, p. 59). Tracking that tells you which ad produced which consult shrinks both for the owner: you know what works and you can add budget to it this week instead of guessing for a quarter. The clinic that can say we track every ad to every consult scales with more confidence than the one reading a dashboard it does not trust (p. 65).

Two more ideas apply. In a regulated niche you do not dangle aggressive promises, you engineer low-risk mechanics and keep any exposure capped (p. 126). Sending no health data to Meta is that mechanic. And simple beats clever: one main conversion event, clean data and a report you can read earns the right to scale, and the fancy attribution layer comes later if at all (p. 69). When the pixel is limited, the Acquisition.com Lead Nurture playbook's argument gets stronger: more of the budget goes into warming the people who have already watched your videos and engaged with your profile, so more of the audience you already have books, instead of chasing cheaper cold clicks (Lead Nurture playbook, p. 1).

Tracking is the floor, the injector is the ceiling

Every clinic that fixes its tracking ends up at the same place: the pixel is clean, the sheet is honest, and the thing that moves cost per consult is the creative. Engagement audiences only exist if there is something to engage with. Our flagship client, a plastic surgeon in Melbourne, books most of her consults from people who watched her explain treatments on camera for weeks before they enquired. Those people are in a 365-day video audience no restriction can touch.

Strip the pixel and build the sheet this week. Then get the injector on camera, because the warm audience you build that way is the one Meta will still let you reach.

Where this comes from

• Meta Business Tools Terms (effective 3 November 2025) and Customer List Custom Audiences Terms (effective 3 December 2025), both fetched 18 October 2026, for the health information exclusions quoted above.
• Meta's Health and Wellness advertising standard, fetched 18 October 2026, change log dated 22 July 2026, for the 18+ targeting, before-and-after and statements-of-inferiority quotes.
• Meta's help article on data source categories and the About Prohibited Information page could not be read for this guide. The description of what happens when a pixel is restricted comes from clinic accounts we have looked at and the third-party coverage linked in our injectables advertising guide. Check Events Manager for the labels that apply to you.
• The value equation, risk control and simplicity points are from $100M Offers, with page numbers cited inline via Acquisition.com's advisor. The nurture point is from the Acquisition.com Lead Nurture playbook.
• The four-event schema, the CAPI field list, the 50 percent video view threshold, the 365-day window, the 24-hour removal target and the decision table are our working rules, not published standards.
• Every dollar figure ($4,000 spend, 32 and 48 consults, $500 ticket, MER 2.4 and 1.5) is illustrative. Run the same pivot on your own numbers.
• Nothing here is legal advice. HIPAA status, state board rules and whether any offline upload is acceptable are questions for your counsel.

Questions owners ask

Written by Benjamin Chua

Founder of Trueframe and Med Spa Launch. Nine years building video systems for founders and clinics, including a Melbourne plastic surgeon whose account went from 12,043 to 36,236 followers in ten weeks.