My Health My Data Privacy Policy

Washington State Supplement

This notice supplements our general Privacy Policy and addresses the rights of Washington state residents under the Washington My Health My Data Act ("MHMD Act," RCW Chapter 70.372), effective March 31, 2024. It applies specifically to personal data that qualifies as "consumer health data" under Washington law.

What Is Consumer Health Data

Washington law defines "consumer health data" broadly to include any personal information that identifies or is reasonably linkable to a consumer and relates to their health status, condition, treatment, or health-related behaviors — including data that is derived or inferred from non-health data. Because of this broad definition, much of the information we collect in the course of providing clinical services may qualify as consumer health data.

Examples of consumer health data we may collect include:

• Health conditions, diagnoses, symptoms, medications, lab results, treatment history, and clinical records collected in connection with services such as HRT, GLP-1/weight management, peptides, IV therapy, aesthetics, or longevity/regenerative medicine.
• Precise geolocation data that could reasonably indicate that you are seeking or receiving healthcare services.
• Information — such as pages viewed, search terms, or product inquiries — that could be used to infer a health condition or interest in a particular treatment.
• Any other information that may be used to derive or infer health-related attributes about you.

Geofencing Prohibition

We do not implement or use geofencing technology to identify, track, or collect consumer health data from individuals entering a facility that provides in-person health care services, including but not limited to hospitals, clinics, pharmacies, or mental health facilities, as prohibited under RCW 70.372.060.

How We Collect Consumer Health Data

We collect consumer health data primarily through information you provide directly when creating an account, completing clinical intake forms, or interacting with our platform. We may also collect limited consumer health data through cookies and analytics tools where you have provided consent through our Cookie Consent tool. We do not collect consumer health data through cookies without your affirmative consent.

How We Use Consumer Health Data

We use consumer health data to coordinate and deliver the healthcare services you request, including facilitating provider consultations, processing prescriptions, and managing your clinical records. We may also use it for quality improvement, regulatory compliance, and fraud prevention.

We will not use consumer health data for purposes beyond those disclosed in this notice or our Privacy Policy without first obtaining your affirmative consent.

How We Share Consumer Health Data

We share consumer health data only to the extent necessary to deliver the services you request or as otherwise permitted or required by law. We require your affirmative consent before (i) collecting your consumer health data, (ii) sharing it with third parties beyond what is necessary to provide the Services, and (iii) any sale of such data.

We do not sell consumer health data. We do not share consumer health data for targeted advertising purposes. When we share consumer health data with service providers, we do so under written data sharing agreements that prohibit those parties from using your data for any purpose other than performing services on our behalf.

Categories of parties with whom we may share consumer health data:

• Licensed healthcare providers and pharmacies involved directly in your care and treatment.
• Service providers performing functions on our behalf who are contractually prohibited from using your data for their own purposes.
• Affiliated professional entities operating within our clinical infrastructure network where data access is required for clinical operations.
• Government authorities or law enforcement when required by valid legal process, applicable law, or to prevent serious harm.
• Successor entities in the event of a merger, acquisition, or business transfer, subject to applicable notification requirements.

Your Rights Under the MHMD Act

Washington state residents have the following rights with respect to their consumer health data, subject to certain exceptions:

• Right to access: Request a list of all third parties with whom we have shared your consumer health data and a copy of the data itself.
• Right to deletion: Request deletion of your consumer health data from our systems and from those of our service providers.
• Right to withdraw consent: Withdraw consent to the collection, use, or sharing of your consumer health data at any time.
• Right to confirm: Confirm whether we are collecting or sharing your consumer health data.

Note: Certain rights may be subject to exceptions where retention or use is required by law, including applicable medical record retention obligations.

How to Exercise Your Rights

To exercise any of your rights under the MHMD Act, email us at privacy@lumoramd.com. Include your full name, email address, and a clear description of the right you wish to exercise. We will respond within 45 days, with a possible 45-day extension where reasonably necessary.

To opt out of data collection through Google Analytics, install the Google Analytics Opt-out Browser Add-on at https://tools.google.com/dlpage/gaoptout.

Appeals and Complaints

If we deny your rights request, you may appeal by emailing privacy@lumoramd.com with the subject line "MHMD Appeal," including your original request and reason for appeal. We will respond within 45 days.

If your appeal is unsuccessful, you may file a complaint with the Washington State Attorney General at www.atg.wa.gov/file-complaint.