Washington Consumer Health Data Privacy Policy

Categories of consumer health data we collect

This policy applies to consumer health data covered by Washington’s My Health My Data Act. Some information handled for health-care providers is exempt from that law but remains protected by health-care privacy law and the practice’s Notice of Privacy Practices.

• Identifiers and contact information connected or reasonably connectable to health interests or services.
• Information about conditions, symptoms, treatment interests, providers, appointments, care, medications, diagnoses, reproductive or sexual health, and behavioral health that you choose to provide or that is inferred from your request.
• Insurance, coverage, payment and service information connected to health care.
• Communications, support requests, directory searches and waitlist information that reveal a health interest.
• Limited device, IP-address, security and usage events connected to use of a health service. We do not collect precise location for geofencing health-care facilities.

Purposes and sources

We collect these categories to provide the service you request, connect you with a provider, schedule and support care, administer coverage and payment workflows you choose, communicate with you, secure the platform, prevent fraud and comply with law.

Sources include you or an authorized representative; your provider or practice; insurers, clearinghouses and payment processors involved in a workflow you request; communications and support interactions; and the device and browser used to reach EttaCare.

Categories shared and recipients

Depending on the service requested, the categories above may be shared only as necessary with the provider or practice you choose; cloud hosting and identity processors; payment processors; clearinghouses, insurers and other coverage participants; communications processors; recipients you authorize; and authorities when law permits or requires disclosure.

EttaCare has no affiliates with which it shares consumer health data. The current named processors are listed on our Subprocessors page. EttaCare does not sell consumer health data. It does not use a geofence around in-person health-care facilities to identify or track consumers or collect consumer health data.

Collection and sharing consent are separate

Where consent is required for collection, EttaCare presents a collection request that identifies the categories and purposes before collection. That acceptance is not consent to optional sharing.

Optional sharing that requires consent is disabled at launch. Before enabling it, EttaCare must present a separate request identifying the data categories, specific purposes, recipient categories and withdrawal method. No generic collection acceptance opens that path.

Your rights and how to exercise them

You may ask whether EttaCare is collecting, sharing or selling your consumer health data; access the data; obtain the list and contact mechanism for recipients; withdraw consent for future collection or sharing; or request deletion. You may submit a request through your existing authenticated account or email Noah Rappaport at noah@ettacare.com. If you do not have an account, you will not be required to create one, but EttaCare may request information reasonably needed to authenticate you.

EttaCare responds without undue delay and within 45 days. When reasonably necessary, it may extend once for up to 45 additional days and will explain the extension during the first period. Eligible access is free up to twice per year. Backup deletion may be delayed for no more than six months after authentication. A refusal will include a reason and an appeal method; appeals receive a written response within 45 days and a denied appeal includes a way to contact the Washington Attorney General.

Withdrawing consent stops future activity covered by that consent. It does not undo prior processing or override records that applicable law permits or requires a health-care provider to retain. EttaCare will not discriminate against you for exercising these rights.

Changes to this policy

Before collecting, using or sharing an additional category of consumer health data, or using it for an additional purpose, EttaCare will update this policy and obtain affirmative consent when required. Processor instructions must remain consistent with this policy.