The Markup
· collected 2026-09-14 · by Colin Lecher and Aline Melo, for Agência Pública
Healthcare appointment site Doctoralia, which serves millions of people in Latin America and Europe,
asserted
which → serve → America
The Markup and Agência Pública, an investigative journalism nonprofit in Brazil, reviewed multiple website domains operated by the company, which provides services similar to those ZocDoc offers in the United States, letting people looking for healthcare easily search for a variety of providers in the area, then book appointments.
asserted
people → review → appointments
As part of a series on web tracking, the review looked at network traffic between Doctoralia domains in multiple countries and popular social media sites.
asserted
review → look → countries
According to the traffic logs, embedded online trackers followed visitors in Brazil, Colombia, Mexico, and other countries from nearly the second they started to search for care, then sent that data to the tech industry for advertising purposes.
uncertain
they → accord → purposes
If a visitor searched for a gynecologist based in Sao Paolo, Brazil, for example, the website sent searches for provider specialties and other information to Google through its marketing platform.
asserted
website → search → platform
If a visitor continued through to book an appointment, name and other information on the doctor, as well as the date and time of the appointment, was sent to the company.
asserted
name → continue → company
Similar data was shared across other countries with other tech giants as well, according to the review.
uncertain
data → share → review
As in Brazil, searches for specialists in Colombia were sent to social media companies.
asserted
searches → send → companies
If a user in Cartagena, for example, booked an appointment with a dermatologist, the provider’s name, as well as the data and time of the appointment, were sent to LinkedIn.
asserted
name → book → LinkedIn
The same happened with searches for any other specialists.
asserted
same → happen → specialists
If a web user in Bogotá booked an appointment with a doctor through Doctoralia, whether a psychologist, dermatologist, or other care provider, information on that appointment was also shared with TikTok.
asserted
information → book → TikTok
The same happened for users in Mexico.
asserted
same → happen → Mexico
Doctoralia said it would conduct a detailed review of its online practices but noted it does not monetize patient data.
asserted
it → say → data
Still, experts said the information sharing violates privacy expectations and possibly Brazilian law.
“Even without a stated diagnosis, the path taken in seeking medical care can itself provide clues about health issues that should remain private to the patient,” said a Brazilian gynecologist who uses Doctoralia and spoke to Pública and The Markup on condition of anonymity.
uncertain
who → say → anonymity
For example, a search for gynecology, obstetrics or reproductive care may be related to trying to conceive, a possible pregnancy, infertility, choosing a contraceptive method or concern after a risky sexual encounter, the gynecologist added.
uncertain
gynecologist → relate → encounter
In the doctor’s view, even though inference is not the same as diagnosis, the expectation of confidentiality in the relationship between patient and professional should also apply in the digital environment.
asserted
expectation → apply → environment
“When someone looks for a doctor, a test or a clinic, they are looking for care, guidance, help,” he said.
asserted
he → look → help
The tracking on Doctoralia started before any personal information such as email addresses or names was entered, but the trackers often tied users to unique IDs.
asserted
trackers → start → IDs
Social media companies say they can tie users’ social media profiles to browsing behavior through such identifiers.
asserted
they → say → identifiers
The tracking also happened across providers and borders in Latin America, with some experts telling The Markup and Pública that government agencies may want to scrutinize the practices.
uncertain
agencies → happen → practices
In Brazil, for example, a law provides for stringent privacy rights, especially for healthcare data.
asserted
law → provide → data
The BreakdownPixel Hunt
This is how you stop data trackers from sucking up your health data
The Markup and CalMatters found multiple ways consumers can block the trackers quietly sending your data to tech companies, including those used on state-run health exchange websites.
asserted
consumers → stop → websites
“Obviously there is a risk here of permanent tracking based on unique IDs and building profiles that people are not aware of,” said Rafael Zanatta, co-director of Data Privacy Brazil, an advocacy organization.
asserted
Zanatta → be → Brazil
Chiara de Teffé, a professor of digital law at the Federal University of Rio de Janeiro, said the protections provided by Brazil’s General Data Protection Law are not limited to diagnoses and medical records.
asserted
protections → say → diagnoses
“Behavioral information may receive enhanced protection when, because of its context and the way it is processed, it reveals or allows inferences about aspects of someone’s health,” she says.
uncertain
she → receive → health
Brazil’s Federal Council of Medicine, the agency in charge of regulating and licensing medical professionals, meanwhile, told Pública and The Markup that “booking an appointment does not involve medical confidentiality” and “there is no sensitive data of any kind when a patient seeks a specialist.”
asserted
patient → regulate → specialist
But the country’s National Supplementary Health Agency, which regulates private insurance, said “the medical specialty sought and other appointment-booking information may reveal aspects of a person’s health.”
uncertain
specialty → regulate → health
Arsenia Nikolaeva, a spokesperson for Doctoralia parent company Docplanner, said in a statement that the trackers were used to monitor the company’s own social media campaigns and that Doctoralia “does not use these tools to sell personal data or to operate a commercial data product” and isn’t paid by social media companies for data.
asserted
Doctoralia → say → data
But the company said it would review its practices.
asserted
it → say → practices
“We take the questions raised very seriously and are conducting a detailed technical and legal review of the matters described, including the relevant technical configurations,” Nikolaeva said in an email.
asserted
Nikolaeva → take → email
“We remain committed to protecting personal data across all the markets in which we operate, and to acting appropriately based on the outcome of that review.
asserted
we → remain → review
The social media companies say they have rules against sending sensitive information, including health data, through their trackers.
asserted
they → say → trackers
In practice, however, businesses have frequently been caught sending such information.
asserted
businesses → catch → information
Sofie Diskin, a spokesperson for Google, said the company has “strict, long-standing policies against collecting private health information or advertising based on sensitive information” and provides customers with tools to help them avoid collecting health data.
asserted
them → say → data
A spokesperson for LinkedIn, Brionna Ruff, said the company’s policies “prohibit installation” of its signature tracker, the Insight Tag, on pages that collect sensitive data, and that the company doesn’t want such data.
TikTok didn’t respond to a request for comment.
asserted
TikTok → say → comment
Despite the tech companies’ policies, however, healthcare businesses have frequently been caught transmitting sensitive data, leading to regulatory scrutiny and a wave of lawsuits in the United States.
asserted
businesses → catch → States
Since 2022, The Markup has been reporting on the pervasive use of “pixels,” tracking technology that social media companies use to follow web users.
asserted
companies → report → users
Across the internet, invisible trackers embedded on websites report information on web users to major social media companies.
asserted
trackers → embed → companies
Companies like Meta, Facebook and Instagram’s parent company, freely offer the code for pixels to businesses and organizations, who place it on their sites.
asserted
who → offer → sites
That code can then log data on visitors and transmit it back to the companies.
asserted
code → log → companies
…and 33 more, not listed.
