Consumer Health Data Privacy Policy

What this policy covers

Washington’s My Health My Data Act protects “consumer health data,” meaning personal information that is linked or reasonably linkable to you and that identifies your past, present or future physical or mental health. This policy explains what consumer health data Northform may collect outside of your medical record, why, who it is shared with, and how you can exercise your rights.

Data we collect and why

Categories of consumer health data

• Website use. Pages visited on this site (for example, a service page about ADHD or hormone therapy) could suggest a health interest. The site uses no advertising trackers, tracking pixels or tracking cookies, and we do not build profiles of visitors.
• Technical data. IP address, device and browser type, processed by our hosting provider to deliver the site and protect it from attacks.
• What you send us. If you email us or book a fit call, the health information you choose to share.
• Precise location. We do not collect precise geolocation.

Sources

Directly from you, and automatically from your browser when you visit the site.

Purposes

To deliver and secure the website, respond to you, schedule a fit call, and provide the services you request. We collect only what is necessary for those purposes. We do not use consumer health data for advertising.

Who we share it with

We share consumer health data only as necessary to provide the service you request, or with your consent:

• Website hosting and security (Cloudflare), to serve and protect the site.
• Patient portal and scheduling (PracticeQ), when you book or complete forms.
• Secure email (Proton), when you email us.

These processors act on our instructions under contract. Northform has no affiliates. We do not sell consumer health data, and we will never do so without your valid written authorization as required by law.

Your rights

• Confirm and access. Ask whether we collect, share or sell your consumer health data, and get a copy of it along with a list of all third parties and affiliates we have shared it with and their contact information.
• Withdraw consent to our collection and sharing of your consumer health data.
• Delete. Ask us to delete your consumer health data, including from our processors’ systems.

To make a request, email [email protected] with the subject “Health data request.” We will verify your identity using the minimum information needed and respond within 45 days. If we need more time (up to another 45 days when reasonably necessary), we will tell you why. Requests are free up to twice a year.

Appeals

If we decline your request, you may appeal by replying to our decision with the subject “Appeal.” We will respond in writing within 45 days and explain our reasons. If your appeal is denied, you may contact the Washington State Attorney General at atg.wa.gov/file-complaint.

Security and changes

Only people who need consumer health data to provide your service can access it, and it is protected with encryption and access controls. We will post any changes to this policy here with a new effective date, and ask for your consent before using data in a materially new way.