Did the site get found?
Impressions, clicks, and average position come from Google Search Console and Bing Webmaster Tools. They need no tag on the site at all, and the owner cannot inflate them.
Kalydron · Guide
Privacy by default
Cookieless analytics for medical and therapy websites.
A clinic needs to know whether the site works. It does not need to know who visited. Here is how to measure one without collecting the other, and why the usual analytics tag is the wrong tool for a healthcare site.
What Pulse records for one visit
Recorded
- The page path
- The site or assistant that sent the visit (its origin, never the full URL)
- A visitor token hashed with a salt that changes every day
- Device class and country
- Coarse time-on-page and scroll buckets, reported once on exit
- The domain of an outbound click
Never recorded
- Cookies or local storage
- IP address or browser fingerprint
- Names, emails, or anything typed into a form
- Anything that links Tuesday’s visit to Wednesday’s
Region and city are recorded only for sites whose owner chose that precision. The script is public: @kalydron/pulse on npm.
The problem
The default tag was built for advertisers.
Google Analytics is free because it is part of an advertising system. It sets cookies, assigns a client ID that persists for months, and is designed to share signals with the ad platform. On a store, that is a tradeoff. On a page that describes a treatment for depression, it is a liability.
Regulators have said as much. The FTC's 2023 actions against BetterHelp and GoodRx were about health companies passing visitor data to advertising platforms. HHS has published guidance on tracking technologies on healthcare sites; a federal court narrowed part of it in 2024, but the direction is not in doubt: a page about a condition, a treatment, or a provider is sensitive, and the burden of showing what was collected sits with the site owner. This is not legal advice. It is the reason we do not put the tag on a medical site.
A consent banner is not a fix. It is an admission that the site collects something worth consenting to, and most visitors click it away without reading. A practice that wants to be trusted at two in the morning should not open with a negotiation.
What you need to know
Three questions, and none of them need a name.
Where did visits come from?
Google, Bing, a directory, a referral, or an AI assistant. That is a referrer, not a person. Pulse files ChatGPT, Claude, Perplexity, and Gemini as their own bucket, so the number everyone is asking about is on the front page.
Did anyone act?
Tap-to-call, a callback request, an email link. Pulse counts the intent and keeps none of the content. What someone wrote in the form goes to the practice, never to analytics.
How it works
One script, about a kilobyte, and a hash that forgets.
Pulse is one deferred script tag. When a page loads, it sends the path, the referring site, and the event to our collector. Nothing is stored in the browser: no cookie, no local storage, no fingerprint.
On the server, the visit gets a token: a hash of the day, the site, the visitor's address and browser, and a secret salt. The address itself is not stored. The salt changes every day, so the same person on two different days is two different visitors to us. That is the whole design. It is enough to count unique visitors within a day and not enough to follow anyone across a week.
Time on page and scroll depth are reported once, when the visitor leaves, as coarse buckets: under ten seconds, read past halfway. Enough to tell whether a page is being read, not enough to reconstruct a session.
The whole thing is public. The script is published as @kalydron/pulse on npm and the source is on GitHub, so a compliance officer can read exactly what leaves the page.
What it cannot do
Limits, and why they are the point.
Pulse cannot show a user journey across days, build a demographic profile, create a retargeting audience, or attribute a visit to an ad beyond what the referrer and a click ID say. If a growth plan needs to retarget people who read about trauma therapy, the analytics tool is not the problem with that plan.
It also cannot see inside an assistant. When ChatGPT names your practice and the person does not click, nobody has that number. What Pulse sees is the visit that follows a click, which is the part that turns into a call.
If you already run Google Analytics
Two honest options.
Remove it
If nobody at the practice opens the reports, and in our experience nobody does, the tag is pure exposure. Search Console keeps the search numbers; Pulse keeps the rest.
Keep it and add Pulse alongside
GA files a visit from ChatGPT under referral, next to every other link on the internet, and only counts it after a consent click. Pulse counts it as what it is, with no click. Run both for a month and compare.
See it on a real site
Ask for the dashboard.
Tell me what you run and I'll show you what Pulse records for a site like yours, query by query.