# Consumer Health Data Privacy Policy 

**State Supplement: Washington (MHMDA Compliant)**
*This document serves as a template for a Washington medical spa's public-facing website privacy policy, integrating federal requirements and addressing the strict requirements of the Washington My Health My Data Act (MHMDA). Under MHMDA, this must be a separate, distinct link on the homepage.*

---

## 1. Introduction
Welcome to our website. We respect your privacy and are committed to protecting your consumer health data. This Washington Consumer Health Data Privacy Policy supplements our general Privacy Policy and provides specific information required by the Washington My Health My Data Act (MHMDA). It applies solely to individuals whose consumer health data is collected in Washington state.

## 2. Consumer Health Data We Collect
Under Washington law, "Consumer Health Data" is defined very broadly. It includes any personal information linked or reasonably linkable to a consumer that identifies the consumer's past, present, or future physical or mental health status.

We may collect the following categories of Consumer Health Data:
- **Individual Health Conditions:** Information regarding skin conditions, aesthetic concerns, or medical history provided through contact forms, consultation requests, or patient portal interactions.
- **Bodily Measurements:** Facial mapping, skin analysis data, or before/after photographs used to recommend or track treatments.
- **Treatment Inquiries:** Data indicating that you are seeking health care services, including searching for or inquiring about specific aesthetic treatments (e.g., laser therapy, injectables).
- **Inferences:** Any inferences drawn from non-health data (such as web browsing history on our site) that identify a health status or treatment interest.

## 3. How We Use Consumer Health Data
We collect and use your Consumer Health Data solely for the following business purposes:
- To provide the specific aesthetic services, consultations, or treatments you have requested.
- To communicate with you regarding your appointments and care.
- To process payments related specifically to your care.
- *Note: We do not use your Consumer Health Data for targeted marketing without your separate, explicit written authorization.*

## 4. Sources of Consumer Health Data
We collect this data directly from you when you:
- Fill out digital intake forms or consultation requests on our website.
- Interact with our online scheduling tools.
- Communicate with our clinic via email or SMS.

## 5. Sharing of Consumer Health Data
We do not sell your Consumer Health Data. We do not share your Consumer Health Data with third parties or affiliates without your separate, explicit written authorization, except as strictly necessary to provide the service you requested. 

We may share data with specific "Processors" (such as our secure EMR software provider or payment processor) who are contractually bound to process the data only on our behalf and are prohibited from using it for their own purposes.

## 6. Geofencing Prohibition
In accordance with Washington law, we do not implement geofencing around our facility or any other health care facility to identify, track, or collect data from consumers, or to send notifications or advertisements related to their health data.

## 7. Your Privacy Rights Under MHMDA
If you are a Washington consumer, you have the right to:
- **Confirm:** Confirm whether we are collecting, sharing, or selling your consumer health data.
- **Access:** Access the consumer health data we have collected about you, including a list of all third parties and affiliates with whom we have shared the data.
- **Withdraw Consent:** Withdraw consent from our collection or sharing of your consumer health data.
- **Delete:** Request the immediate deletion of your consumer health data.

To exercise these rights, please contact us using the dedicated privacy contact information provided on our website. We will authenticate your request and respond within 45 days.

## 8. HIPAA Exemption Note
Please note that "protected health information" (PHI) collected by our medical clinic acting as a covered entity governed by the Health Insurance Portability and Accountability Act (HIPAA), is exempt from the MHMDA. The privacy of your clinical medical records is governed by our separate Notice of Privacy Practices (NPP).

*Effective Date: April 17, 2026*