Consumer health data privacy policy

This policy is required by state consumer health data laws to be published separately from our general privacy policy. It applies to consumer health data, meaning information that identifies your past, present, or future physical or mental health status and is not otherwise covered by federal health privacy law.

How this interacts with HIPAA

Most information in MyWholeFile MD is protected health information that we hold as the Business Associate of your clinician’s practice. The Washington My Health My Data Act and similar statutes exempt information governed by HIPAA, so for most of what we hold, HIPAA and our Business Associate Agreement apply instead of this policy.

We publish this policy anyway, and apply its commitments to all health information we hold regardless of which statute governs it. We would rather hold a single high standard than sort your information into categories with different protections.

What consumer health data we collect

• Health records retrieved from clinicians you authorize: conditions, medications, allergies, laboratory results, vital signs, immunizations, procedures, encounters, and clinical notes
• Information you enter yourself, including uploaded documents and symptoms you record
• Information about which clinicians and practices you have connected, which can itself reveal health status

We do not collect precise location data, and we do not infer health conditions from your browsing, purchasing, or device behavior.

How we collect it

Only from sources you designate: your clinicians’ record systems after you authorize access, the practice that enrolled you, and your own direct entries. We do not buy health data, acquire it from data brokers, or derive it from advertising or tracking technology.

How we use it

To assemble and show you your record, to answer your questions about it, to supply it to an AI assistant you have connected, and to operate, secure, and support the service. Nothing else.

We do not sell consumer health data

We do not sell consumer health data, and we will not, under any circumstances. No exchange of health information for money or other valuable consideration takes place. Because we do not sell it, no valid authorization for sale will ever be sought from you, and there is no opt-out to configure, because there is nothing to opt out of.

Who we share it with

• The practice through which you enrolled, on whose behalf we act
• An AI assistant you connect, at your instruction and limited to the categories you approve. See our AI sharing disclosure.
• Service providers that operate the service on our behalf, each bound by a written agreement and, where applicable, a Business Associate Agreement. Each is named on our subprocessor page.
• Legal demands, only to the extent required, and with notice to you wherever we are permitted to give it

We do not share consumer health data with advertisers, data brokers, insurers, employers, or researchers.

Your rights

• To know what consumer health data we hold about you and with whom it has been shared, including a list of recipients
• To access a copy of it
• To withdraw consent to our collection and sharing of it
• To delete it
• To appeal if we refuse a request

Exercise these in the application or by emailing privacy@mywholefilemd.com. See export and deletion for details, including what deletion removes from backups and why audit logs are retained.

We respond within 45 days and may extend once by 45 days where reasonably necessary, with notice to you. Exercising these rights costs nothing and will never result in reduced service or a different price.

Appeals

If we decline a request, we will tell you why and how to appeal. Send appeals to privacy@mywholefilemd.com with “Appeal” in the subject line. If we deny your appeal, we will provide contact information for your state Attorney General so you can submit a complaint.

Data storage and transfers

Consumer health data is stored in the United States. We do not transfer it outside the United States.

Employee and contractor access

Access is restricted to personnel who need it to operate or support the service, granted at the minimum level required, logged in a tamper-evident audit trail, and bound by confidentiality obligations.

Changes

We will not make a material change to this policy affecting information already collected without notifying you and, where the law requires it, obtaining your consent.

Contact

Market Me LLC, Redondo Beach, CA, United States. privacy@mywholefilemd.com.