Consumer Health Data Privacy Policy

This is a separate policy about consumer health data, published because Washington's My Health My Data Act and Nevada's equivalent require it to stand on its own. Our general privacy policy covers everything else.

What consumer health data is, and how it reaches us

Consumer health data means information that identifies a person's past, present or future physical or mental health status.

Almost all of the health information on our platform reaches us in one way: a practitioner records it about their client, in the course of care. We hold it for that practice. We did not collect it from the person it is about, we did not ask for it, and we do not decide what is recorded.

That distinction runs through this whole document.

What we collect, and where it comes from

What	Where it comes from	Why we have it
Clinical records, notes, assessments, measurements and treatment information about clients	Recorded by a practitioner in their practice, or provided by the client to their own practitioner through the client portal or an intake form	To provide the platform to that practice, on that practice's instructions
Appointment and scheduling information	The practice, or the client booking with that practice	To run the booking and reminder features
Telehealth session recordings and transcripts, where a practice uses them	The session itself, with the consent of everyone in it	To provide the telehealth feature
Billing information connected to health services	The practice and our payment processor	To bill for the service
Account information about practitioners	The practitioner	To run their account

We do not collect consumer health data from advertising networks, data brokers, public records, or by inference from browsing behaviour. We do not buy it, and we have no source for it other than the practice.

Who we share it with

We share consumer health data with two categories of recipient, and only these:

The service providers who run the platform for us — hosting and storage, telehealth video, email delivery, error monitoring, product usage measurement, and optional AI features where a practice turns them on. We require each to use the information only to provide its service to us. Where a provider handles production client information, a written data-processing agreement covers it. For most of our providers that agreement is part of their standard terms. Where a provider asks for a separate acceptance or signature, we complete it before that provider handles any client information. The full list, with each provider's purpose and location, is on our providers page.
Whoever the practice tells us to send it to. The practice controls disclosures from its own records.

We do not share consumer health data with advertisers, data brokers, or anyone for their own purposes.

We do not sell consumer health data

We do not sell it, we have never sold it, and we do not have a process for selling it. If that ever changed we would need your written authorization first, in the specific form the Act requires — and this policy would say so before it happened.

How we use it

To provide the platform to the practice that holds the record, and for nothing else.

We do not use client clinical information for our own analytics or for our own marketing, and client information is never used to train AI models, ours or our AI provider's. Where a practice uses our outcome-reporting features, those report on that practice's own clients, for that practice — they never pool one practice's clients with another's.

Your rights

You may ask us to:

confirm whether we hold consumer health data about you, and what we hold;
give you a list of the third parties it has been shared with;
withdraw your consent to its collection and sharing;
delete it.

Write to privacy@effectwellness.com. We will verify who you are before acting, and respond within the time the law allows. Using these rights costs nothing and we will not treat you differently for it.

One thing we want to be straight with you about. If the data you are asking about is a clinical record held by a practice, that practice — not us — decides what happens to it, and the practice may have a professional or legal duty to keep the record for a set number of years. We will tell you which practice holds it, we will pass your request on, and we will help them respond. What we will not do is quietly delete a record a clinician is required to keep, or pretend the decision was ours.

How we protect it

Information is encrypted in transit, and encrypted at rest in our database and file storage. Telehealth session recordings and transcripts, which our telehealth provider holds for us, are encrypted at rest too. Access to clinical records is controlled by role- and relationship-based permissions enforced in the database, not only in the app. Administrative access, disclosures and exports are recorded as part of the action.

More detail is on our security page.

How long we keep it

For as long as the practice needs it and the applicable professional and legal retention rules require. See section 13 of our privacy policy.

Changes

We will post any change here and update the date at the top.

Contact

privacy@effectwellness.com · Effect Wellness, Inc. · registered office: 16192 Coastal Highway, Lewes, Delaware 19958, United States