Consumer Health Data Privacy Policy
On this page
This Consumer Health Data Privacy Policy describes how ObyMe collects, uses, shares and protects "consumer health data" as defined by the Washington My Health My Data Act (RCW 19.373), Nevada Senate Bill 370 (NRS 603A) and the Connecticut Data Privacy Act. We apply it to everyone in the United States, not only residents of those states. It supplements our Privacy Policy.
Our commitments
- We never sell consumer health data.
- We never share consumer health data with advertisers, social media platforms or data brokers.
- We collect it only to provide the service you ask for, or with your consent.
- We never use geofencing around health care facilities.
- You can see, delete or withdraw consent for your consumer health data at any time.
1. What consumer health data we collect, and why
"Consumer health data" means personal information that identifies, or could reasonably be linked to, your past, present or future physical or mental health. Health information you share once you become a patient is also covered by HIPAA and our Notice of Privacy Practices.
| Consumer health data | Why we collect and use it |
|---|---|
| Reproductive and pregnancy status: whether you are trying to conceive, which trimester you're in, or that you recently gave birth | To provide the waitlist you signed up for, contact you about care suited to your stage, and plan availability by area |
| Health information you choose to include in the optional message box | To understand and answer your request |
| The fact that you signed up for prenatal care, and data that could reveal it, such as your contact details together with the page you signed up on | To provide the waitlist and keep a record of your sign-up and consent |
| Inferences, such as whether ObyMe might be right for you when we open near you | To decide whom to contact first when spots open |
2. Where it comes from
Directly from you, through our forms, emails, texts and calls. We don't buy consumer health data or collect it from data brokers, and we don't infer health status from your browsing on other websites.
3. With whom we share it
We share consumer health data only:
- with processors that act on our behalf under contracts restricting them to our instructions: website hosting and database (Cloudflare), email and text messaging providers, and customer relationship management tools;
- with ObyMe-affiliated medical practices and clinicians, when you ask to begin care; and
- when you give separate consent for a specific sharing, or as required by law.
We do not share consumer health data with any other third parties. You can ask us for a list of every third party and affiliate with whom we have shared your data, along with their contact information (see section 5).
4. Consent
We collect consumer health data only as necessary to provide the waitlist and other services you request, or with your consent. If we ever want to collect or share consumer health data for another purpose, we will ask for your separate, clear consent first, describing the data, the purpose and the recipients. We will never sell it, and we would need your signed authorization even to consider doing so, as the law requires.
5. Your rights
- Confirm and access: whether we collect, share or sell your consumer health data (we never sell it), a copy of it, and a list of all third parties and affiliates with whom we've shared it, with their contact information.
- Delete your consumer health data, including from archives and backups. We delete it from our active systems within 30 days of confirming your request, from backups within 6 months, and we tell every processor and affiliate we shared it with to delete it too.
- Withdraw consent to collection or sharing at any time.
- Equal treatment: we won't treat you differently for using these rights.
How to make a request. Email privacy@obyme.com with the subject "Consumer health data request". We verify requests using the contact details you gave us and respond within 45 days, which may be extended once by another 45 days when reasonably necessary, in which case we'll tell you why. Responses are free, up to twice a year.
Appeals. If we decline your request, you can appeal within 60 days by emailing privacy@obyme.com with the subject "Consumer health data appeal". We'll respond in writing within 45 days with our reasons. If your appeal is denied, you can contact your state attorney general. Washington residents can file a complaint at atg.wa.gov/file-complaint.
6. Security and access within ObyMe
Access to consumer health data is limited to employees, contractors and processors who need it to provide the services you requested or to carry out the purposes in this policy. We protect it with safeguards at least as strong as those we use for our most confidential information, as described in our Privacy Policy.
7. Changes and contact
We'll post any changes here and update the effective date, and we'll ask for your consent before using consumer health data in a materially different way. Questions? Email privacy@obyme.com.