Consumer Health Data Privacy Policy

1.About this policy

This Consumer Health Data Privacy Policy applies to “consumer health data” as defined by Washington’s My Health My Data Act, Nevada’s consumer health data privacy law (Senate Bill 370), and the consumer health data provisions of the Connecticut Data Privacy Act. It supplements our Privacy Policy, which also applies.

Consumer health data is personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. This policy doesn’t apply to protected health information governed by HIPAA, which is covered by the Notice of Privacy Practices of [Medical group name] or the pharmacy that provides your care.

2.Consumer health data we collect

Depending on how you use the Services, we may collect:

• health conditions, symptoms, goals, and medical history you share with us;
• medications, prescriptions, and treatments you use, request, or purchase;
• measurements and vital signs, such as height, weight, and blood pressure;
• lab and diagnostic test results;
• sexual and reproductive health information, such as information about erectile dysfunction or pregnancy plans;
• photos you provide for your care, such as photos of your scalp or hairline;
• information that identifies you as seeking health care, such as the treatments you view, request, or purchase; and
• inferences about your health drawn from the information above.

3.Where it comes from

• directly from you, when you complete a visit or contact us;
• automatically, when you use the Services; and
• from the clinicians, pharmacies, and laboratories involved in your care, and from service providers that support the Services.

4.How we use it

We collect and use consumer health data to provide the products and services you request, and as otherwise permitted with your consent, including to:

• connect you with clinicians and support your visits, prescriptions, and ongoing care;
• process payments, fill and ship orders, and provide customer support;
• send you messages about your care, orders, and account;
• maintain, secure, and improve the Services; and
• detect and prevent fraud, comply with the law, and protect the rights and safety of our patients and others.

5.How we share it

We share consumer health data only as needed to provide the services you request, with your consent, or as required by law. Categories of recipients include:

• [Medical group name] and its clinicians, who provide your care;
• pharmacies, laboratories, and shipping carriers that fill, test, and deliver your orders;
• service providers that process information on our behalf, such as hosting, customer support, payment processing, and communications providers;
• government authorities and others, when required by law or legal process; and
• a successor entity, in connection with a merger, acquisition, or sale of assets.

We do not sell consumer health data, and we do not share it with advertising partners.

6.Your rights

Depending on where you live, you have the right to:

• confirm whether we collect, share, or sell your consumer health data;
• access your consumer health data, including a list of the third parties and affiliates with which we’ve shared it, and how to reach them;
• withdraw your consent to our collection and sharing of your consumer health data;
• have your consumer health data deleted; and
• correct inaccurate consumer health data, where available.

Withdrawing consent or deleting your information may mean we can no longer provide some Services. We may need to keep certain information to comply with law, such as medical and pharmacy record retention requirements.

7.How to exercise your rights

Email [privacy email address] with the subject line “Consumer health data request” and tell us which right you’d like to exercise and the state you live in. We’ll verify your identity, usually by confirming information associated with your account, and we will never ask for your password.

We’ll respond within 45 days. If we need more time, we’ll tell you why, and may extend that period once by up to 45 additional days where the law allows. We won’t charge you or discriminate against you for exercising your rights.

Appeals

If we decline your request, you may appeal by replying to our decision within a reasonable time. We’ll respond to your appeal in writing and explain our reasons. If your appeal is denied, you may contact the Washington State Attorney General, the Nevada Attorney General, or the Connecticut Attorney General, depending on where you live.

8.Changes to this policy

We may update this policy from time to time. If we make material changes, we’ll notify you before they take effect and, where required, ask for your consent. The “Last updated” date shows when it last changed.

9.Contact us

Email [privacy email address] or write to [COED RX legal entity name], Attn: Privacy, [Mailing address].