Washington Consumer Health Data Privacy Policy
Contents
1. Scope of this policy
This policy is provided by Bidwell Health LLC under the Washington My Health My Data Act, chapter 19.373 RCW. It applies to Washington residents and to consumer health data collected in Washington. It covers only consumer health data as that term is defined by the Act.
Health care information we collect, use, or disclose as your treating health care provider is governed by chapter 70.02 RCW, is exempt from the Act, and is not covered by this policy. That information is described in our Privacy Policy and our Notice of Privacy Practices.
2. Categories of consumer health data we collect, and why
Section 1 explains that the clinical record we create when we treat you is health care information under chapter 70.02 RCW and information protected under HIPAA, and is therefore exempt from the Act and outside this policy. What is left, and what this policy covers, is narrow.
Information indicating that you sought a particular health care service. When you view a page on our site that is named for a condition, or begin a visit for one, that activity can indicate the type of care you were looking for, and our website analytics provider receives the address of the page you viewed. Collected to understand which services people look for and how far they get. Health-related information you send us outside a visit. If you email or message us about a health matter before you are a patient, that message is not part of a clinical record and is covered by this policy. Collected to answer you.
We do not use consumer health data for advertising. We do not sell consumer health data. We run no advertising trackers, no advertising pixel, no tag manager, and no session recording software. We do not keep what you entered if you begin a visit and do not finish it.
3. Sources of consumer health data
Directly from you, through our intake forms, patient portal, and messages you send us; From your device when you use our website, limited to browser type, operating system, IP address, and pages visited; From the pharmacy you select, where it responds to us about your prescription.
4. How we share consumer health data
The categories of consumer health data we share are the page addresses and activity described in section 2, which our website analytics provider receives. We share no other category of consumer health data covered by this policy.
Bidwell Health LLC has no affiliates, so we share consumer health data with no affiliate. Our cloud infrastructure, hosting, database, transactional email, and electronic prescribing providers act as processors on our behalf under contract, which the Act treats as something other than sharing with a third party, and they may use what they receive only to perform the service we engaged them for. Our website analytics provider receives the page address you viewed, your browser type, and your approximate location. It receives no name, no email address, and nothing you enter into a visit, and it sets no cookies and builds no cross-site profile.
Separately, and outside this policy because it is exempt health care information, your pharmacy receives your prescription and legal or regulatory authorities receive information when the law requires it, including under a court order or subpoena. We do not sell your consumer health data and we will not do so without your separate written authorization.
5. Your rights
Under RCW 19.373.040 you have the right to:
Confirm and access. Confirm whether we collect, share, or sell your consumer health data, and access that data, including a list of all third parties and affiliates with whom we have shared it and a way to contact each of them; Withdraw consent. Withdraw your consent to our collection and sharing of your consumer health data; Delete. Request deletion of your consumer health data.
To exercise any of these rights, email privacy@bidwellhealth.com with the subject line Washington Health Data Request. We will respond without undue delay and in all cases within 45 days. We may extend once by a further 45 days where reasonably necessary, and we will tell you within the first 45 days if we do, along with the reason.
6. Deletion, and the one limit on it
When you ask us to delete consumer health data covered by the Act, we will delete it from our records and from archived and backup systems. Deletion from backups can take longer than deletion from active systems, and the Act allows that, but it will not take more than six months from the date we authenticate your request. We will notify all affiliates, processors, contractors, and other third parties that received the data and to whom the Act requires us to send your deletion request.
There is one limit we cannot waive. If we have provided you with clinical care, the resulting medical record is health care information under chapter 70.02 RCW and information protected under HIPAA. The Act exempts it, and a retention period required by law applies to it, so we cannot delete it on request. Those records stay subject to the privacy, access, retention, and disclosure rules that apply to a medical record, which includes your right to see and to obtain a copy of them. If you ask us to delete, we will delete everything the Act reaches and tell you in writing what was retained and for how long.
7. Appeals
If we refuse to act on your request, we will tell you in writing without undue delay and in all cases within 45 days, and explain why.
You may appeal by emailing privacy@bidwellhealth.com with the subject line Washington Health Data Appeal. We will respond in writing within 45 days of receiving your appeal, explaining the actions taken or not taken and the reasons for them. Appeals are free.
If we deny your appeal, you may submit a complaint to the Washington State Attorney General at atg.wa.gov/file-complaint.
8. Contact
Questions about this policy, or about consumer health data generally: privacy@bidwellhealth.com.