Consumer Health Data Privacy Policy.

Who this policy covers

This policy applies to Prime Years Medical and to consumers who are residents of Washington, Nevada or Connecticut, and to any consumer whose consumer health data we collect in those states.

It does not apply to information that is protected health information held by, or on behalf of, a HIPAA covered entity, to information governed by other federal or state health-record laws, or to information used only for treatment, payment or health care operations by a licensed provider — each of which those statutes exclude from the definition of consumer health data. Because it is not always obvious to a consumer which category a given field falls into, we apply the rights described below to all of your health information, whichever exclusion may technically apply.

Categories of consumer health data we collect

• Individual health conditions, treatment, status, diseases and diagnoses — the conditions, surgeries, allergies and family history you report to us, and diagnoses or clinical findings recorded in your care.
• Medications and interventions — the medications and supplements you tell us you take, and treatments provided to you.
• Symptoms — the symptoms you report and how long you have had them, including anything you write in a free-text field or say to our assistant.
• Measurements of bodily functions and vital signs — height, weight, body composition, heart rate, heart rate variability, respiratory rate, blood oxygen saturation, sleep, and activity.
• Diagnostic testing and laboratory results — the tests you order through us, their results, and lab documents you upload.
• Data relating to sex — sex assigned at birth, and health information relating to hormone therapy where that is part of your care.
• Bodily and biological information collected by a device — readings from a wearable you choose to connect.
• Data used to seek or receive health care services — your contact details, the state you live in, appointment and order records, and the products and services you purchase.
• Inferences derived from any of the above — trends, reference bands, readiness and risk indicators, and suggested next steps that we calculate from your data, including with the assistance of artificial intelligence.

We do not collect precise location data, and we do not operate or use a geofence around any health care facility.

Sources we collect it from

• Directly from you — your account details, your intake questionnaire, documents you upload, messages you send, and your orders.
• From a device you connect — a wearable or health app, only after you authorise the connection through that company’s own sign-in and consent screen.
• From laboratories that perform tests you ordered through us.
• From the licensed clinicians who provide your care, and the clinician network through which they work.
• From pharmacies that dispense a prescription written for you.
• Generated by us — the inferences described above, calculated from the data listed here.

Why we collect it and how we use it

• To let a licensed clinician review your case, decide whether treatment is appropriate, and design and adjust a protocol for you.
• To order, deliver and track the tests, medications and products you purchase.
• To show you your own results, trends and history, and to explain them — including with the assistance of artificial intelligence, as described in our Privacy Policy.
• To calculate the inferences described above, so that you and your clinician can see whether a therapy is working.
• To communicate with you about your care, your orders and your account.
• To take payment for what you buy, and to issue refunds.
• To keep the platform secure, to detect and prevent fraud, to maintain audit records of who has accessed your data, and to keep backups.
• To study, inside our own protected environment and using a dataset with direct identifiers removed, how well our protocols work. That dataset retains an internal member key, so it is pseudonymized rather than de-identified, and it is never disclosed outside our environment.
• To comply with the law, to respond to a lawful request, and to establish or defend legal claims.

We do not use consumer health data for advertising, and we do not use it to make an automated decision about your care.

Categories of consumer health data we share

We share the categories listed above only where sharing is needed to deliver the care or the product you asked for, or where the law requires it. Specifically we may share:

• Health conditions, medications, symptoms, vital-sign measurements, laboratory results, data relating to sex, device readings and our inferences — with the clinicians treating you.
• Laboratory orders and the identifiers needed to run them — with the laboratory.
• Prescription and delivery details — with the dispensing pharmacy.
• Any category, in the form of encrypted storage and processing — with the cloud infrastructure providers that host our platform.
• Any category you specifically choose to share — with a family member, caregiver or other person you designate, until you turn that sharing off.
• The specific data required — where compelled by law, a subpoena or a court order, or where necessary to prevent serious harm.

We do not share consumer health data with our payment processor. It receives an amount and an order reference only, never a diagnosis, a drug name or a treatment category. We do not share consumer health data with our email provider; our emails carry no health content.

Third parties and affiliates we share it with

• Our affiliated professional entity and the licensed clinicians and clinician network who provide your care.
• Clinical laboratories that perform the tests you order.
• Licensed pharmacies that dispense prescriptions written for you.
• Cloud infrastructure and hosting providers that store and process your record, including Amazon Web Services (storage, database and the artificial-intelligence processing described in our Privacy Policy) and Vercel (application hosting).
• Persons you designate to view your information.
• Government authorities and courts, where legally required.
• A successor entity, if Prime Years Medical is acquired or merges, subject to the same protections and with notice to you.

Every one of these recipients, other than a government authority acting under legal compulsion and a person you designate yourself, is bound by a written contract that requires them to protect your data, restricts them to the purpose we engaged them for, and forbids them from using it for their own purposes or selling it.

Selling consumer health data

Prime Years Medical does not sell consumer health data today. We do not offer it for sale and we do not exchange it for money or for anything else of value. We have not asked any consumer for the valid authorization that the Washington My Health My Data Act and Nevada Senate Bill 370 require before such a sale, because there has been nothing to authorize.

That is a statement about our practices now, not an undertaking about the future. If it ever changes, the statutes decide how, and they are strict:

• No sale without your valid authorization, signed and dated by you, in a document separate from every other agreement between us.
• It has to tell you the specifics — what data, to which purchaser, for what purpose, and that the purchaser may use it for those purposes and no other.
• It expires one year after you sign it, and you may revoke it at any point before then.
• We may not condition anything on your signing it. Not access, not a service, not a price. That is the statute’s rule, and we agree with it.
• You get a copy, and we keep ours for six years.

Data from which you cannot be identified is not consumer health data and this section does not govern it. We may create de-identified or aggregated datasets and license or sell those. Our general Privacy Policy, section 10 explains that in full, including the standard a dataset has to meet before it may leave and the contractual bar on any recipient trying to identify you.

Consent, and how to withdraw it

We collect and use consumer health data only with your consent, or where it is necessary to provide a product or service you have requested from us. We ask for your consent separately from any other agreement, before collection, and we ask again — separately — before any sharing that is not necessary to provide what you asked for.

You may withdraw your consent at any time by emailing privacy@primeyearsmedical.com. Withdrawing consent stops future collection and sharing. It does not undo processing that already took place, and it may mean we can no longer provide some or all of the service.

Your rights, and how to exercise them

You have the right to:

• Confirm whether we are collecting, sharing or selling your consumer health data, and access that data.
• Obtain a list of all third parties and affiliates with whom we have shared your consumer health data, together with an active email address or other online contact for each of them.
• Withdraw consent to our collection and sharing of your consumer health data.
• Delete your consumer health data, including from our backups and archives.

To make a request, email privacy@primeyearsmedical.com and tell us which right you want to use. We will acknowledge your request, verify your identity, and respond within 45 days. If we need more time we will tell you why, and we may extend once by a further 45 days.

If we refuse, we will tell you why and how to appeal. To appeal, reply to our decision or email the same address with the word “appeal”. We will respond to an appeal within 45 days. If we deny the appeal, we will give you a way to contact your state Attorney General to submit a complaint.

Deletion has limits, and we will be specific about them. Where a record is a medical record that a clinician is required by law to retain, or where we must keep a transaction record for tax or fraud purposes, we cannot delete it. In that case we will tell you exactly what we are keeping, why, and for how long, and we will delete everything else.

You may use an authorised agent to make a request on your behalf. We will ask for written proof that you authorised them.

We will not deny you goods or services, charge you a different price, or provide a different level of service because you exercised any of these rights.

How to contact us

Washington residents may also submit a complaint to the Washington State Attorney General at atg.wa.gov/file-complaint. The My Health My Data Act also gives Washington consumers a private right of action under the state Consumer Protection Act. Nevada residents may contact the Nevada Attorney General, and Connecticut residents the Connecticut Attorney General.

Changes to this policy

We will not collect, use or share consumer health data for a purpose that is not listed above without first disclosing the new purpose here and obtaining your consent. If we change this policy we will update the date at the top and notify you.