Consumer Health Data Privacy Policy for Washington residents

§ 01Who this policy covers

This policy applies to consumer health data that Cosmetiq Medicine LLC collects from Washington residents, and from any individual whose consumer health data is collected in Washington, through our website at cosmetiqmedicine.com, our online forms and our clinic operations.

Consumer health data means personal information that is linked or reasonably linkable to a consumer and that identifies that consumer's past, present or future physical or mental health status. Under the Act this includes information about health conditions, treatments, bodily functions, measurements, and the seeking or obtaining of health care services.

Information not covered by this policy

The Act does not apply to information governed by other federal or state laws. This policy therefore does not cover protected health information subject to the Health Insurance Portability and Accountability Act, information governed by the Gramm-Leach-Bliley Act, the Family Educational Rights and Privacy Act or the Fair Credit Reporting Act, or data used in approved research as the Act defines it. It also does not cover information that does not identify your physical or mental health status.

Personal information that is not consumer health data, such as website analytics unrelated to health, is described in our general privacy policy rather than here.

§ 02Categories we collect, and why

We collect the following categories of consumer health data. For each category, the purpose of collection and how the data is used are stated together, because we do not use these categories for any purpose beyond the one stated.

We collect only what is necessary for these purposes. We do not collect consumer health data for advertising, and we do not infer health characteristics about you from browsing behavior.

§ 03Where the data comes from

We collect consumer health data from the following categories of sources:

• Directly from you. Website forms, consultation requests, intake and medical history forms, consent forms, messages you send us, and what you tell a provider during a consultation or treatment.
• From your use of our online tools. A photograph or description you choose to submit to our treatment planner. Use of the tool is optional.
• Generated by us during care. Clinical notes, measurements and photographs created by our providers in the course of treating you.
• From our booking and records platform, where your appointment history and treatment records are stored on our behalf.
• From a person you authorize, such as a parent or legal guardian for a minor, or an agent acting on your written authority.

We do not purchase consumer health data, and we do not obtain it from data brokers or advertising networks.

§ 04What we share, and with whom

Categories of consumer health data shared

We share the following categories, and only for the purposes stated in Section 02:

• Treatments sought, received or considered
• Information that identifies you seeking health care services
• Information used to associate those categories with you, such as your name and contact details

We do not share health conditions and symptoms, medical history, medications and allergies, measurements, or photographs with any third party for that third party's own purposes.

Categories of third parties

• Booking and practice management providers, which store appointment and treatment records on our behalf under contract.
• Website, hosting and form providers, which transmit and store what you submit through our forms on our behalf under contract.
• Professional advisors, such as legal counsel, where necessary to establish or defend a legal claim.
• Government authorities, where disclosure is required by law, court order or a valid request from a public authority.

Each service provider acts as our processor. Our agreements require them to use consumer health data only to perform services for us, to keep it confidential and to protect it with appropriate safeguards.

Specific affiliates

Cosmetiq Medicine LLC has no affiliates, and we do not share consumer health data with any affiliated entity. Our Portland, Oregon and Vancouver, Washington clinics are locations of the same legal entity, not separate affiliates. If this changes, we will name the specific affiliate in this policy before any sharing occurs.

§ 05What we do not do

§ 06Consent

We collect and share consumer health data only where it is necessary to provide a service you have requested, or where you have given consent. We request consent separately from any other terms, is specific to the purpose described at the time, and is never a condition of receiving care.

You may withdraw consent at any time, using the methods in Section 07. Withdrawal applies going forward and does not affect collection or sharing that already took place. Where we are legally required to keep a clinical record, withdrawing consent does not remove that record, and we will tell you when that applies.

§ 07Your rights and how to exercise them

If you are a Washington resident, or your consumer health data was collected in Washington, you have the rights below.

Your rights

• Confirm and access. Confirm whether we collect, share or sell your consumer health data, access that data, and receive a list of all third parties and affiliates with whom we have shared or sold it, including an active contact for each.
• Withdraw consent. Withdraw consent to our collection and to our sharing of your consumer health data.
• Delete. Have your consumer health data deleted, including from our archived and backup systems.
• Appeal. Appeal our refusal to act on a request, as described below.

How to submit a request

1. Send your request. Email cosmetiqmedicine@gmail.com with “Washington health data request” in the subject line, or call (503) 572-2675 and tell us you are making a request under this policy.
2. Tell us what you want. State whether you are asking to confirm and access, to withdraw consent, or to delete, and give us the name, email address and phone number you used with us so we can locate your record.
3. We verify who you are. We may ask for information we already hold to confirm your identity. You will not be asked to create an account. If we cannot reasonably verify you, we may request additional information or decline the request, and we will tell you why.
4. We respond within 45 days. If we need longer, we will tell you within those 45 days, explain why, and may extend once by a further 45 days.
5. Deletion is passed on. When we delete your consumer health data, we notify any service provider or third party that received it from us and instruct them to delete it as well.

How to appeal

If we decline your request, we will explain why and how to appeal. To appeal, reply to our response or email cosmetiqmedicine@gmail.com with “Appeal” in the subject line. We will respond in writing within 45 days with our decision and the reasons for it.

If your appeal is denied, you may submit a complaint to the Washington State Attorney General through the Attorney General's complaint form. General information about the Act is published by the Washington State Attorney General.

§ 08Contact and changes

Questions about this policy, and all requests under it, go to the contact below.

Changes to this policy

If we change the categories of consumer health data we collect, the purposes for collection, the categories we share, or the third parties and affiliates we share with, we will update this policy and change the date at the top before the change takes effect. We will not apply a material change retroactively to consumer health data already collected without your consent.