Med-spa analytics field-exclusion checklist
Review proposed field definitions without sending data or installing tracking.
No signup. Enter reference codes, add records and download a CSV. Entries stay in the browser tab. Filled fields do not establish completion, approval or compliance.
| Proposed generic URL or event field | Business reporting purpose | Proposed analytics destination | Proposed exclusion or review action | Implementation review source reference | Field-review owner | Internal review date | Next field check |
|---|---|---|---|---|---|---|---|
| Generic campaign code | Compare defined campaign inquiry totals | Proposed aggregate reporting | Inspect nonpersonal label and path | Tag-review-reference-17 | Website-review-role | 2026-10-18 | Review the approved event definition before a separate release |
| Free-text appointment reason | Proposed extra report detail | Destination scope unresolved | Keep private content outside the proposed analytics payload | Privacy-review-role | 2026-10-19 | Obtain qualified field and destination review without using real answers |
- Fictional examples. Enter generic field names and internal task references, not personal or clinical information.
- Filled fields need qualified source review and establish no privacy clearance, consent or approval.
- No message, data transfer, clinical decision or website change occurs.
- Reload clears edits. Download only to approved business storage.
Your website editor wants to know which campaign generated a consultation request. Adding the form's free-text answer to an event label would make a more detailed report, but sends information beyond the campaign source. Inspect each proposed field and destination before allowing the analytics service to receive the payload.
The worksheet uses generic fields, purposes, destinations and evidence questions. Its examples are fictional. Enter no real URL containing personal information and no actual form answers. The tool adds no tracking code and sends nothing to analytics. Use the checklist with your approved website and privacy review rather than treating filled fields as implementation.
Use with this guide
Inspect available website evidence
Review findings without assuming privacy certification.
Track actual nonclinical stages
Keep aggregate outcomes separate from form content.
Review field purpose and access
Assign a qualified destination review.
Build med-spa website answers for consultation logistics
Explain the location, request process and next scheduling step your front desk supports. Leave personal treatment questions to the approved clinical route.
Browse the complete medical spa guides and worksheets.
Choose a source label without personal content
Use a stable, nonpersonal campaign code under the proposed reporting definition. Do not include names, email addresses, phone numbers or private intake information in source labels. Google Analytics guidance addresses avoiding personal information in URLs and other collected fields. Keep the campaign definition in an authorized business record outside the public worksheet.
Inspect the complete proposed path, query parameters, page title and event fields. A confirmation URL containing private answers presents a question beyond the initial landing page. An ordinary-looking tag name does not establish its values are appropriate. Review the actual intended payload using fictional test data through the approved process.
Sources for this section: Google Analytics: Avoid personal information in URLs, fields and events
Review health-related data flows separately
HHS online-tracking guidance concerns regulated entities and protected health information. Its page includes a partial-vacatur notice concerning certain unauthenticated-page guidance. Do not translate the guidance into every public visit being PHI, or every public page being outside review. The qualified reviewer needs the actual information, vendor, proposed use and applicable scope.
A cookie banner alone does not review the data flow. Keep public campaign reporting separate from private intake, scheduling and portal content. Do not put symptoms or appointment reasons into source tags to improve attribution. The worksheet provides an evidence handoff, not a legal permission test or a certification of the tracking design.
Sources for this section: HHS: Online tracking guidance and the partial-vacatur qualification · HHS: Privacy Rule scope, covered entities and business associates
Read the proposed field decision
The first fictional row shows a generic campaign code with an implementation-review reference. The second names a free-text appointment-reason field but lacks source evidence. It contains no real answer. Obtain qualified field and destination review before describing the proposal as reviewed, and keep private content outside the proposed analytics payload.
Filling the exclusion checklist does not change the website. Record the proposed action, supporting source and responsible implementation owner. Inspect the confirmation URL and test payload with fictional data through the controlled process. Retain what the approved test established rather than assuming a task label proves the field was excluded in production.
Keep the booking outcome in the right record
A form action does not establish a booked consultation, attendance or treatment suitability. Count actual business outcomes through authorized reporting without mixing private appointment details into general campaign URLs. Keep the event definition beside the source totals. Later scheduling confirmation needs its own proper record rather than a renamed analytics event.
HubSpot documents task owners, due dates and associated records. Use equivalent fields to assign the technical or content question to the authorized editor. This is a task-management example, not a claim BlueFinch uses or integrates HubSpot. Closing the review task does not prove the proposed website change was released or its data flow verified.
Sources for this section: HubSpot: Task owners, due dates and associated records
Use website findings within their scope
BlueFinch's website audit organizes supported technical and content findings, source dates and collection gaps. It is not a privacy certification, penetration test or complete implementation record. Reviewing an audit does not automatically change another website. Confirm the actual collection status before presenting a finding as a finished review or resolved issue.
Download the field-exclusion worksheet for the editor and responsible reviewer. Start with the unsupported free-text field and inspect its proposed event definition without real answers. Resolve the source question through the authorized process, then verify any approved release separately. Keep nonpersonal campaign source tags distinct from private consultation intake and scheduling records.
Sources for this section: BlueFinch: Website findings, collection status and publishing limits
Primary sources
BlueFinch last reviewed these sources on October 4, 2026. Payment rules and state requirements can change.
- Google Analytics: Avoid personal information in URLs, fields and events
- HHS: Online tracking guidance and the partial-vacatur qualification
- HHS: Privacy Rule scope, covered entities and business associates
- HubSpot: Task owners, due dates and associated records
- BlueFinch: Website findings, collection status and publishing limits
Use this page for general business information. It is not legal, tax, or accounting advice.