How TikTok and Google ended up with information about doctors’ appointments around the world

* Doctoralia sent medical appointment information, including specialties and doctor names, to social media companies including TikTok, Google, and LinkedIn.
* Reviews of Doctoralia websites involved examining network traffic between Doctoralia domains and social media sites.
* Online trackers followed visitors in Brazil, Colombia, and Mexico from the start of their healthcare searches.
* Searches for specialists were sent to Google marketing platforms; provider names and appointment details were sent to LinkedIn.
* Information on appointments was shared with TikTok for users in Bogotá and Mexico.
* Doctoralia stated it does not monetize patient data but will conduct a review of its online practices.
* Experts suggest the path taken in seeking medical care can provide clues about health issues.
* Brazil has a comprehensive national privacy law, the General Data Protection Law.
* The Federal Council of Medicine stated that booking an appointment does not involve medical confidentiality.
* The National Supplementary Health Agency stated that sought specialties and appointment information may reveal aspects of a person’s health.

The situation reveals a significant tension between commercial data practices, established privacy laws, and the expectation of medical confidentiality in the digital sphere. The mechanism of tracking, using seemingly innocuous searches to infer sensitive health interests, shifts privacy concerns from explicit diagnoses to behavioral patterns, which is where legal protections often lag behind technological capabilities. The reliance on network traffic analysis—even before personal identifiers were explicitly entered—suggests that the *context* of a search constitutes sensitive data that should be protected. The contradiction exists between corporations' self-assertions regarding not monetizing patient data and the documented flow of this information, which operates within a regulatory patchwork across Latin America where national laws like Brazil’s GDPR mandate transparency and protection for health data. This points to a systemic gap: technical infrastructure is deployed outside the scope of explicit legal consent or established medical confidentiality norms, creating an environment where behavioral inferences are harvested as commercial assets. The potential impact lies in normalizing the expectation that the pursuit of healthcare itself is publicly trackable and monetizable by third parties, regardless of stated internal policies.
Bridge Questions:
What specific regulatory mechanisms need to be implemented across Latin American jurisdictions to effectively govern tracking based on contextual health searches? How can legal frameworks be adapted to protect behavioral data derived from medical intent, separate from explicit diagnoses? What measures can ensure that the general expectation of privacy surrounding healthcare remains legally enforceable against commercial data harvesting practices?