Email marketing profiles can reveal health information through list membership, segments, form activity, website tracking, tags, and message content. The published options below have sharply different product boundaries; the two unresolved email vendors remain drafts and are not included.
| Vendor | BAA | Plan or arrangement | Verdict |
|---|---|---|---|
| Constant Contact | Yes | Eligible account with standard BAA | Conditional |
| HubSpot | Yes | Enterprise with Sensitive Data enabled | Conditional |
| Klaviyo | No | Terms prohibit health data | No |
Conditional: two different levels of permitted use
Constant Contact publishes a deliberately narrow healthcare path. Its standard BAA permits basic contact and relationship context but excludes sensitive PHI, so it is better understood as generic outreach than a clinical database. HubSpot permits PHI only for Enterprise customers who enable Sensitive Data, accept the BAA, flag the correct properties, and stay within the published covered-service list. Those are not interchangeable designs. In both products, review list sources, field names, forms, email subjects, replies, exports, site tracking, automation, AI, and integrations. A BAA for the account does not justify diagnosis-based advertising or copying EHR data into every marketing feature.
No: Klaviyo prohibits health data
Klaviyo’s official privacy guidance and Acceptable Use Policy prohibit health and other sensitive personal data. That restriction reaches more than an obvious diagnosis field. A treatment-specific segment, booking event, profile tag, form submission, site-tracking event, or message reply can disclose health context. Consent does not override the vendor’s terms, and general privacy controls do not create a BAA. Medical practices should keep Klaviyo profiles, events, segments, forms, tracking, support, and integrations outside the patient-data flow. If an unrelated retail business uses Klaviyo, separate its accounts, data sources, domains, API keys, and tracking from the healthcare organization so patient information cannot enter through synchronization.
Choosing among them
Define the communication purpose before choosing software. Generic educational outreach may need only a minimal relationship list; richer CRM workflows need field-level classification and tighter administration. Keep clinical communication in an approved patient channel. Read the individual vendor reviews and confirm that the contracted plan, BAA, and actual features match the planned data flow.
