Doctoralia, a healthcare booking platform used across Latin America and Europe, sent specialist searches and booked-appointment details to Google, TikTok, and LinkedIn, a September 14 cross-border network-traffic review by The Markup and Agência Pública found. The transmitted fields included doctors’ names and, in tested booking flows, appointment dates and times.
People looking for a doctor were followed by embedded trackers as they searched and booked care; the trackers began sending information before a visitor entered a name or email address, often alongside identifiers that platforms say can be tied to browsing or social-media profiles. Docplanner says the tools measured Doctoralia’s own social-media campaigns, and that it neither sells personal data nor receives payment from platforms for it.
Doctoralia works much like Zocdoc in the US: patients search nearby providers by specialty, select a clinician, and book a visit. But the investigation found that the search and booking path itself became advertising-platform data. A gynecology search may not spell out a diagnosis, but it says rather more than most people would expect a marketing pixel to know.
“Even without a stated diagnosis, the path taken in seeking medical care can itself provide clues about health issues that should remain private to the patient.”
, A Brazilian gynecologist who uses Doctoralia, speaking to Agência Pública and The Markup on condition of anonymity
The appointment-search and booking fields sent to platforms
The reporters inspected network traffic on Doctoralia domains in Brazil, Colombia, Mexico, and other markets. In São Paulo, a search for a gynecologist sent specialty and provider-search information to Google through its marketing platform; completing a booking also transmitted the doctor’s name and the appointment’s date and time. The Markup and Agência Pública documented those flows in their traffic logs.
The pattern was not confined to Google or Brazil. The review found that a Cartagena user booking a dermatologist sent the provider name and appointment date and time to LinkedIn. In Bogotá, booking a psychologist, dermatologist, or another doctor sent appointment information to TikTok; the reporting found comparable TikTok transmissions in Mexico.
| Tested flow | Platform that received data |
|---|---|
| São Paulo specialist search and booking | |
| Cartagena dermatologist booking | |
| Bogotá doctor booking | TikTok |
| Mexico doctor booking | TikTok |
That is a more consequential exposure than the usual “website analytics” euphemism suggests. A tracker does not need access to a clinical record to learn that someone sought reproductive care, dermatology, or psychological support, and that they reached the point of making an appointment. It is the same basic privacy failure seen in the Hims & Hers health-data privacy case: sensitive behavior becomes useful advertising data because a consumer service embedded third-party tracking code where it did not belong.
The review does not establish that every Doctoralia user, country, or present-day site configuration had the same tracker flows. It also does not show that Google, TikTok, or LinkedIn used any particular person’s transmitted information. But it documents the transfer itself, which is the part a patient has no practical way to inspect while trying to book care.
Brazilian regulators disagreed over how to classify it. Brazil’s National Supplementary Health Agency said booking information may reveal health-related aspects, while the Federal Council of Medicine argued that merely seeking a specialist does not involve sensitive data. That narrower definition misses the point: a diagnosis is not the only fact someone can reasonably expect to keep out of an advertising system.
Doctoralia’s own earlier language now looks difficult to square with the observed traffic. In a January 6, 2020, post for health professionals, the company said it “never” shared or transferred patient data and said neither Doctoralia nor others could access calendar data. The 2026 review found third-party transmission of fields from the appointment path, not evidence that those platforms could read the underlying calendar. Still, “we did not hand over the calendar” is a distinctly thinner promise than “we never share patient data.”
Docplanner spokesperson Arsenia Nikolaeva told the reporters that the trackers were used to measure Doctoralia’s social-media campaigns. The company said it was conducting a technical and legal review, was not paid by the platforms for the information, and does not operate a commercial data product or sell personal data. That remains Doctoralia’s account of why the trackers were there; the independent evidence is the network traffic showing what left the site.
The company has real pressure to make its marketing work. Docplanner reported reaching EBITDA profitability for two consecutive quarters in the second half of 2025, alongside 20% to 30% foreign-exchange-adjusted revenue growth in recent quarters. Separately, business reporting said Colombia was its only market not locally EBITDA-profitable in 2025. Those are company-reported performance figures, but they explain why campaign measurement is not some harmless technical afterthought.
Patients cannot meaningfully consent to a bargain they cannot see: search for a doctor, make an appointment, and quietly feed the ad-tech machinery behind the page. As shared online information can also reach Google Search has shown in another context, information does not need to be deliberately published to become exposed; a supposedly peripheral product decision can do the job.
Doctoralia says it is reviewing the setup. Until the company says which trackers were removed, from which country domains, and when, people booking care have only the traffic logs, not a privacy promise, to go on.
Key Takeaways
- Doctoralia tracker traffic was observed sending specialist-search and booked-appointment information to Google, TikTok, and LinkedIn.
- The reviewed booking flows included doctors’ names and, in some cases, appointment dates and times.
- The tests covered Doctoralia domains in Brazil, Colombia, Mexico, and other markets.
- Docplanner says its trackers measured its own campaigns and that it does not sell personal data.
- The investigation documented third-party transmissions, not third-party access to Doctoralia’s underlying appointment calendar.
Further Reading
- How TikTok and Google ended up with information about doctors’ appointments around the world, The Markup and Agência Pública’s cross-border investigation of Doctoralia tracker traffic.
- ¿Cómo le afecta el Reglamento General de Protección de Datos (RGPD)?, Doctoralia’s 2020 statement on patient-data sharing and calendar access.
- DocPlanner osiągnął rentowność i patrzy w stronę giełdy. Nie w Warszawie, Reporting on Docplanner’s 2025 profitability and market performance.
- Docplanner alcanza la rentabilidad y consolida su apuesta por la inteligencia artificial en salud, Reporting on Docplanner’s revenue growth and EBITDA profitability.