Has anyone had any experience with visitor-recording solutions such as Hotjar or LuckyOrange? Were there any data-capture concerns? I work in the healthcare industry, and the idea of recording users viewing or entering sensitive data makes me really nervous. Are there any solutions that provide privacy settings for the recordings?

2 Answers 2


I'm the founder of Tamboo (https://gettamboo.com), which is a visitor recording solution much like HotJar or LuckyOrange.

Each type of visitor recording solution addresses privacy and security differently from the next, so it's important that you understand how privacy and security are handled by each provider you're considering.

As an example, Tamboo serves customers that operate in the e-commerce, marketing, and startup markets, so it has built-in filters to automatically mask the collection of any kind of credit card information (since that's a primary concern of our customers and it comes up all the time). In addition to that automatic masking, we also give our customers the ability to mask any form input or HTML display element which may contain sensitive data or information.

That being said, that functionality arose out of serving those specific markets, and was designed to help customers with their industry-specific privacy and security concerns.

When it comes to healthcare, I do know that (at least in the US), you have laws such as HIPPA which basically prevent you from collecting, storing, or sharing any kind of medical or personally identifiable information about a patient (or even a potential patient) without their expressed written consent.

Because of that, I would not recommend that you use a visitor recording tool - regardless of how great their privacy or security features are - if that tool could come into contact in any way with data or information that could be subject to HIPPA compliance.

To be 100% sure about what you can and cannot record, or even what kind of requirements your visitor recording provider would need to meet in order to be compliant on your behalf, I would actually recommend that you discuss the matter with whatever legal counsel you use to represent your HIPPA compliance concerns.


I think most solutions provide a way to ignore specific pages or fields from being tracked, the biggest problem is that you might send this sensitive data to a 3rd party.

If you are into a sensitive sector, it might be better to store the data yourself on your own servers using a self-hosted solution (like the one I'm working on, UXWizz).

Another privacy advantage of self-hosting is that you can see exactly how and what all the tracked data is (direct access to the database), compared to 3rd party services where you only see the data provided in their dashboard.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.