Consumer Health Data Notice

1. Introduction

Washington's My Health My Data Act ("MHMDA," RCW 19.373) provides Washington residents and consumers whose data is collected while they are in Washington with specific rights with respect to "consumer health data." This Consumer Health Data Notice supplements our Privacy Policy and explains how we collect, use, share, retain, and protect consumer health data.

This Notice applies to consumer health data we collect through our website, our forms, our quote flow, our phone numbers, our chat, and our email. It does not apply to data collected independently by a licensed insurance professional, carrier, quoting or enrollment service, or another partner after you interact with that party.

2. What is consumer health data?

MHMDA defines "consumer health data" to include information that identifies your attempts to obtain health care services, and information about your health status, mental or physical health conditions, diagnoses, treatments, pregnancy, disability, prescriptions, providers, and bodily functions. Consumer health data also includes physical and biological information (such as genetic data and biometric data), and information used to infer health status.

MHMDA's definition of "consumer health data" is broader than HIPAA's definition of "protected health information." MHMDA applies to a wider range of companies, including companies that are not covered entities or business associates under HIPAA.

3. What consumer health data we collect

Information we collect that may qualify as consumer health data includes:

• Health-related information you voluntarily provide through our website forms, including general health-condition indicators.
• Pregnancy, blindness or disability, and Native American / Alaska Native status (used only for ACA eligibility and special-program purposes).
• Preferred healthcare providers (doctors, hospitals) that you choose to share with us.
• Prescription medications that you choose to share with us.
• Self-reported healthcare usage patterns.
• Tobacco use (which is a health-relevant factor used to determine eligibility for ACA-compliant plans and certain premium calculations).

We do not intentionally collect Social Security numbers, Medicare Beneficiary Identifiers, full date of birth, full payment or banking information, or detailed medical records through our public-facing forms.

4. Why we collect it

We collect consumer health data only when you voluntarily provide it to us, and only for the purpose of evaluating your request and matching you with health insurance resources through licensed insurance professionals or other authorized quoting or enrollment partners. The specific purposes include:

• Estimating eligibility for ACA Marketplace subsidies (Advance Premium Tax Credits and Cost-Sharing Reductions).
• Determining eligibility for special ACA enrollment periods, Medicaid, or CHIP based on life events, pregnancy, disability, or Native American / Alaska Native status.
• Matching you with health insurance plans whose provider networks include your preferred doctors and whose drug formularies cover your prescriptions.
• Routing you to a licensed insurance professional or agency that can advise you on Medicare Advantage, Medicare Supplement, and Medicare Part D plans (where you have requested Medicare information).

5. Consent

Before we collect certain categories of consumer health data from you, we request your affirmative consent through a dedicated health-data consent checkbox in our wizard. The consent disclosure is presented immediately before the data is collected, and is acknowledged by a separate, required checkbox. The consent disclosure is in addition to (and not in lieu of) our general Terms of Service and Privacy Policy consent.

You may withdraw your consent at any time by contacting us using the methods in Section 11. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

6. How we share consumer health data

We may share consumer health data with the following categories of recipients, for the purposes described in Section 4:

• Authorized quoting or enrollment services, where identified and permitted by your consent, to evaluate potential ACA Marketplace eligibility, subsidies, and plan options.
• Licensed insurance agents, brokers, agencies, carriers, and other authorized enrollment partners that you have been routed to, to provide quote, eligibility, plan-comparison, enrollment, and support services.
• Service providers and vendors that help us operate our website and business (such as hosting, CRM, analytics, communications, and security), under confidentiality and data-protection obligations.
• Government agencies, insurance regulators, Marketplaces, carriers, or law enforcement, where required by law or in response to valid legal process.

Each recipient is independently responsible for its own services, disclosures, privacy practices, and compliance obligations. We do not control how recipients use the data after it is shared with them.

7. We do not sell consumer health data

We do not sell your consumer health data. We may share consumer health data with identified licensed insurance professionals and authorized quoting or enrollment partners as described in Section 6 and permitted by applicable consent, and we may receive compensation when consumers request information, use a referral link, call a referral number, or enroll through a partner. This compensation may be a "sale" of personal information under other state privacy laws (such as the California Consumer Privacy Act / California Privacy Rights Act); however, this section addresses the MHMDA-specific definition of "sale," which is more restrictive and applies to the sale of consumer health data for "valid consent and monetary or other valuable consideration."

To exercise your right to opt out of any sharing of consumer health data, see Section 10.

8. Retention

We retain consumer health data only for as long as reasonably necessary to fulfill the purposes described in Section 4, to maintain consent and compliance records as required by applicable law (including the 10-year Medicare marketing records requirement at 42 CFR § 422.2274 and 42 CFR § 423.2274), and to comply with our other legal, regulatory, and contractual obligations. When consumer health data is no longer needed, we will delete, de-identify, aggregate, or securely dispose of it according to our retention practices.

9. Your rights under MHMDA

Subject to MHMDA, Washington residents and consumers whose data is collected while they are in Washington have the right to:

• Confirm whether we collect consumer health data about you.
• Access a list of categories of consumer health data we have collected about you.
• Access a list of categories of sources from which consumer health data is collected.
• Access a list of categories of third parties and specific third parties to whom consumer health data is shared or sold.
• Access the purpose of collecting and sharing consumer health data.
• Withdraw consent for the collection and sharing of consumer health data.
• Request deletion of consumer health data.
• Request that we stop selling or sharing consumer health data.

10. How to exercise your rights

To exercise your MHMDA rights, contact us using the methods in Section 11. You may also use our Do Not Sell or Share page, which allows you to submit a "Do Not Sell or Share" request, a "Limit the Use of My Sensitive Personal Information" request, or both.

We will respond to your request within 45 days. If we need additional time, we will notify you of the extension. We may need to verify your identity before processing your request.

If your request concerns information shared with a licensed insurance professional, carrier, agency, broker, quoting or enrollment service, or another partner, you may also need to contact that party directly to exercise your rights under that party's policies and applicable law.