# PII/ePHI for heat/click maps

**URL:** <https://community.piwik.pro/t/pii-ephi-for-heat-click-maps/3781>\
**Category:** Privacy\
**Created:** [March 10, 2024, 12:39am UTC](https://community.piwik.pro/t/pii-ephi-for-heat-click-maps/3781 "2024-03-10T00:39:05Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![chaitanya](https://avatars.discourse-cdn.com/v4/letter/c/848f3c/32.png) [@chaitanya](https://community.piwik.pro/u/chaitanya)\
**Post date:** [March 10, 2024, 12:39am UTC](https://community.piwik.pro/t/pii-ephi-for-heat-click-maps/3781/1 "2024-03-10T00:39:05Z")

</div>

Hi,

We are a healthcare app and display patient information.  
If I enable heat or click maps, will Piwik end up collecting PII/ePHI data?

Thanks.

---

<div class="post-metadata">

**Author:** ![gonerator](https://dub1.discourse-cdn.com/flex005/user_avatar/community.piwik.pro/gonerator/32/3549_2.png) [@gonerator](https://community.piwik.pro/u/gonerator)\
**Post date:** [March 10, 2024, 7:43pm UTC](https://community.piwik.pro/t/pii-ephi-for-heat-click-maps/3781/2 "2024-03-10T19:43:08Z")

</div>

hi @chaitanya! For Piwik PRO heatmaps/clickmaps, the data collected consists of unique JS paths for the elements clicked - you can see it in custom events report.

So basically, my answer is “no” but you have to consider whether maybe your code wouldn’t create such situations, for example if you have an element that is identified with some descriptive IDs or classes like, I don’t know, maybe some button for your brain scans can include some label like “#open\_brain\_scan” and then we could imagine this could be more specific… then this can be an issue.

The labels of clicked elements are not collected so you’re safe on front of people clicking some descriptive items like their name/surname or descriptions related to their health.

---

<div class="post-metadata">

**Author:** ![chaitanya](https://avatars.discourse-cdn.com/v4/letter/c/848f3c/32.png) [@chaitanya](https://community.piwik.pro/u/chaitanya)\
**Post date:** [March 10, 2024, 8:00pm UTC](https://community.piwik.pro/t/pii-ephi-for-heat-click-maps/3781/3 "2024-03-10T20:00:41Z")

</div>

Thank you, that is helpful. Through collected JS paths, we won’t be creating situations where we inadvertently log PII/ePHI.

---

<div class="post-metadata">

**Author:** ![anthonybartczak](https://dub1.discourse-cdn.com/flex005/user_avatar/community.piwik.pro/anthonybartczak/32/2430_2.png) [@anthonybartczak](https://community.piwik.pro/u/anthonybartczak)\
**Post date:** [March 11, 2024, 8:37am UTC](https://community.piwik.pro/t/pii-ephi-for-heat-click-maps/3781/4 "2024-03-11T08:37:49Z")

</div>

To add on top of what gonerator said, you might also verify whether things such as page URLs would be considered PHI/PII by your legal department or DPO. Every event in Piwik PRO includes the page URL on which this event happened, so perhaps there are certain sections of your app that expose such information in the URL (e.g. `https://example.com/surgeries/cataract-surgery`).

---

<div class="post-metadata">

**Author:** ![gonerator](https://dub1.discourse-cdn.com/flex005/user_avatar/community.piwik.pro/gonerator/32/3549_2.png) [@gonerator](https://community.piwik.pro/u/gonerator)\
**Post date:** [March 13, 2024, 10:32am UTC](https://community.piwik.pro/t/pii-ephi-for-heat-click-maps/3781/5 "2024-03-13T10:32:39Z")

</div>

good point! I forgot about most obvious thing which are URLs 😃 FYI @chaitanya