A popular healthcare booking platform, Doctoralia, which operates in Latin America and Europe, has been found to send data about users’ medical appointments to major social media companies like TikTok, Google, and LinkedIn. According to a joint investigation by The Markup and Agência Pública, a Brazilian investigative journalism group, the company’s websites transmit information about users’ searches for healthcare providers, including specialties and doctor names, as well as appointment details, to these platforms. The data is sent through online "trackers" that follow users’ activity across the web. These trackers begin working as soon as a user starts searching for a doctor, often before any personal details are entered. For example, if a user in Brazil searched for a gynecologist in São Paulo, the tracker would send information about that search to Google. If the user then booked an appointment, the name of the doctor, along with the date and time of the appointment, would be sent to the company. Similar tracking was observed in other countries, including Colombia and Mexico. In Bogotá, a search for a dermatologist would send that information to LinkedIn, and in Cartagena, a booked appointment with a psychologist would be sent to TikTok. This data sharing occurs across multiple platforms and countries, raising concerns about privacy. Doctoralia said it would review its online practices but emphasized that it does not monetize patient data. However, privacy experts argue that the information shared could reveal private health details. “Even without a diagnosis, the path someone takes in seeking care can indicate health issues that should remain private,” said a Brazilian gynecologist who uses Doctoralia, speaking anonymously. In Brazil, where strict privacy laws protect health data, experts warned that tracking users through unique IDs could lead to the creation of detailed profiles without users’ knowledge. Brazil’s General Data Protection Law (LGPD) requires companies to be transparent about how they use data and to allow users to opt out. Rafael Zanatta, co-director of Data Privacy Brazil, said the tracking could violate these rights. “There could be a massive violation of fundamental rights if users are being tracked through unique IDs,” he said. Meanwhile, Doctoralia’s parent company, Docplanner, said the trackers were used to monitor their own social media campaigns and not for selling data. The company said it would review its practices and protect user data. Social media companies, including Google, LinkedIn, and TikTok, claim they have policies against collecting sensitive information such as health data. However, previous investigations have shown that such data is frequently transmitted through online tracking tools known as "pixels." These tools, provided by companies like Meta (which owns Facebook and Instagram), allow businesses to track users’ behavior and target ads based on their online activity. While the companies claim they filter out sensitive data, critics argue that the system is not foolproof, and the practice has led to lawsuits and regulatory scrutiny in the U.S. and other regions.