Information for Washington Residents
If the processing of Personal Information about you is considered consumer health information subject to the Washington My Health My Data Act (“MHMDA”), you have certain additional rights with respect to that information. MHMDA protects consumer health data that is not protected under HIPAA. This section of the Privacy Policy applies to personal information defined as “consumer health data” subject to MHMDA, which is personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status.
Consumer Health Data We Collect
As described in the “Information We Collect” section of this Privacy Policy, the data we collect depends on how you interact with us, the services you use, and the choices you make. Because consumer health data is defined very broadly, many of the categories of data we collect are or could be considered consumer health data. Consumer health data can include:
- information about your health-related conditions, symptoms, status, diagnoses, testing (including tests, diagnostics, or other interventions), or treatments. We may collect such information through your navigation of our website, surveys or other communication with you.
- measurements of bodily functions, vital signs, or characteristics, including photographs, which may also be considered biometric information under the MHMDA.
- information that could identify your attempt to seek health care services or information, including services that allow you to assess, measure, improve, or learn about your or another person’s health.
- other information that may be used to infer or derive data related to the above or other health information.
Sources of Consumer Health Data
As described further in the “Information We Collect” section of this Privacy Policy, we collect Personal Information (which may include consumer health data) directly from you, from your interactions with our services, from third parties, and from publicly available sources.
Why We Collect and Use Consumer Health Data
We collect and use consumer health data for the purposes described in the “How We Use Information We Collect” section of this Privacy Policy. Primarily, we collect and use consumer health data as reasonably necessary to provide you with the products or services you have requested or authorized. This may include delivering and operating the products or services and their features, personalization of certain product features, ensuring the secure and reliable operation of the services and the systems that support them, troubleshooting and improving the services, and other essential business operations that support the provision of the products (such as analyzing our performance, meeting our legal obligations, developing our workforce, and conducting research and development). We may use consumer health data for other purposes for which we give you choices and/or obtain your consent as required by law – for example, for advertising or marketing purposes.
Our Sharing of Consumer Health Data
We may share each of the categories of consumer health data described above for the purposes described in the “How We Share Information We Collect” section of this Privacy Policy. In particular, we may share Personal Information, including consumer health data, with your consent or as reasonably necessary to complete any transaction or provide any products or services you have requested or authorized, as described in the previous section above.
Third Parties With Which We Share Consumer Health Data
As necessary for the purposes described above, we share consumer health data with the following categories of third parties:
- Service providers. Vendors or agents (“processors”) working on our behalf may access consumer health data for the purposes described above. For example, companies we’ve hired to provide customer service support or assist in protecting and securing our systems may need access to data to provide those functions.
- Parties to a corporate transaction. We may disclose consumer health data as part of a corporate transaction or proceeding such as a merger, financing, acquisition, bankruptcy, dissolution, or a transfer, divestiture, or sale of all or a portion of our business or assets.
- Government agencies. We will disclose consumer health data to law enforcement or other government agencies when we believe doing so is necessary to comply with applicable law or respond to valid legal process.
- Other third parties. In certain circumstances, it may be necessary to provide data to other third parties, for example, to comply with the law or to protect our rights or those of our customers.
- Other users and individuals. If you use our services to interact with other users of the service or other recipients of communications, such as a provider, we will share data, including consumer health data, as directed by you and your interactions.
How to Exercise Your Rights
MHMDA, if applicable, provides certain rights with respect to consumer health data, including rights to access, delete, or withdraw consent relating to such data, subject to certain exceptions. You can request to exercise such rights using the various tools and mechanisms described in this Privacy Policy. If your request to exercise a right under the MHMDA is denied, you may appeal that decision by contacting us as described in the “Contact Us” section of this Privacy Policy, or you may raise a concern or lodge a complaint with the Washington Attorney General at https://www.atg.wa.gov/file-complaint