Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy supplements our Privacy Policy and applies to “consumer health data” of Washington residents and individuals whose consumer health data is collected in Washington (under the Washington My Health My Data Act) and of Nevada residents (under Nevada Senate Bill 370). To the extent of any conflict for such data, this policy controls. Health information governed by HIPAA and maintained by the covered-entity Medical Groups, Providers, and Pharmacies involved in your care is subject to HIPAA and their Notices of Privacy Practices rather than this policy.

1. What Is Consumer Health Data

“Consumer health data” means personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. This can include: health conditions, symptoms, and diagnoses; treatments, medications, and interventions sought or received; measurements such as weight and BMI; photographs relating to a health condition; information about your use of our health services and treatment pages; and data that could reasonably indicate an intent to seek health services, such as completing a health intake.

2. Categories of Consumer Health Data We Collect

• Health conditions, symptoms, diagnoses, and health history you provide during intake, consultations, and follow-up.
• Medications and treatments sought, prescribed, or received, including refill and order history.
• Body measurements you provide, such as height, weight, and BMI.
• Photographs you upload where a service requires them.
• Communications with your care team through the platform.
• Usage information that identifies you as seeking health services, such as account creation and intake completion.

Sources: we collect consumer health data directly from you, from your device when you use the Services, and from the Medical Groups, Providers, and Pharmacies involved in your care.

3. Why We Collect and Use Consumer Health Data

We collect and use consumer health data to: provide the products and services you request, including routing your intake to licensed Providers and coordinating pharmacy fulfillment and shipping; communicate with you about your care, orders, and account; provide customer support; maintain safety and quality, including adverse-event handling; secure the Services and prevent fraud; and comply with legal obligations. We do not use consumer health data for purposes inconsistent with these without your consent.

4. How We Share Consumer Health Data

We share consumer health data only with: the Medical Groups, Providers, and Pharmacies involved in your care; processors and service providers that support the Services (hosting, identity verification, payment processing, shipping, support, and communications) under contracts restricting their use of the data; parties to whom you direct us to disclose it; and government authorities where required by law. We do not sell consumer health data. We would not sell consumer health data without first obtaining the separate, signed valid authorization required by the Washington My Health My Data Act, and we do not share consumer health data with third parties for their own marketing.

5. Your Rights

Subject to legal limits and exceptions, you have the right to:

• Access: confirm whether we collect, share, or sell your consumer health data and access that data, including a list of the third parties and affiliates with whom we have shared it and an active contact method for each.
• Withdraw consent: withdraw any consent you provided for the collection or sharing of your consumer health data.
• Delete: request deletion of your consumer health data. We will delete it from our records, including archives and backups on their standard deletion cycles, and instruct our processors and other recipients to do the same, except where retention is required by law (for example, medical- and pharmacy-record retention requirements).

6. How to Exercise Your Rights; Verification

Submit requests to support@dripvitals.com with the subject “Consumer Health Data Request.” We will verify your identity using information associated with your account, typically by confirming control of your account email, and may request additional information where reasonably necessary. We will respond within the time required by applicable law (generally within 45 days of receipt, extendable once by 45 days where reasonably necessary with notice to you). Exercising these rights will not result in discriminatory treatment.

7. Appeals

If we decline to act on your request, you may appeal by replying to our decision (or emailing support@dripvitals.com) with the subject “Consumer Health Data Appeal” within a reasonable time after our decision. We will respond to your appeal in writing within the period required by applicable law (45 days for Washington requests), including a written explanation of the reasons for our decision. If your appeal is denied, you may contact the Washington State Attorney General at atg.wa.gov/file-complaint or, for Nevada residents, the Nevada Attorney General.

8. Changes

We may update this policy from time to time; the “Last updated” date reflects the current version, and material changes will be communicated through the Services or by email before they take effect.

9. Contact

Questions about this policy or our consumer health data practices: support@dripvitals.com.

See also our Privacy Policy, Terms of Service, Refund Policy, and Important Safety Information.