Consumer Health Data Privacy Policy

Consumer health data we collect, where it comes from and why

Health details in messages you send us

• What: any health information you choose to write in a message through our contact form, such as a condition or a medicine you take. The form also records the address of the page you sent it from and keeps a one-way digest of your IP address, made with a secret key, to stop repeated messages.
• Source: you, when you send the form.
• Why and how we use it: to read and answer your message, to correct the site if you report an error, and to stop abuse of the form.

Health topics you look up on the site

• What: the address of each page you request, which can show the health topic you were reading and, for site search, the words you typed, together with your IP address.
• Source: your browser, when it requests a page.
• Why and how we use it: to deliver the page, protect the site from attacks and count visits. Our visitor statistics receive page addresses without search words. We don’t link page addresses to your name or email address.

Consumer health data we share, and with whom

We don’t share or sell consumer health data, and we have no affiliates.

Service providers process it only on our behalf, to run the site: Vercel (hosting), Cloudflare (network security), Neon (database) and Google (email, for a copy of contact messages). Under Washington law these are processors, not third parties.

Your rights and how to use them

You have the right to:

• confirm whether we collect, share or sell your consumer health data, and get a copy of it, with a list of all third parties and affiliates we shared or sold it to and a way to contact them;
• withdraw consent to our collection and sharing of your consumer health data;
• have your consumer health data deleted. We delete it from all our systems, ask our service providers to delete it too, and remove it from backups within six months.

To use these rights, send a request through our contact form and choose the topic “My personal data.” You don’t need an account. We may ask for information to confirm that the request comes from the person the data is about, for example by asking you to write from the email address you used before.

We answer within 45 days of receiving your request. If we need more time, we tell you why within those 45 days and take no more than 45 extra days. Requests are free of charge up to twice a year.

How to appeal a decision

If we decline your request, you can appeal through the same contact form: choose the topic “My personal data” and start your message with “Appeal.” We answer appeals in writing within 45 days and explain the reasons for our decision.

If we deny your appeal, you can file a complaint with the Washington State Attorney General’s Office through its online complaint form, or contact the attorney general of the state where you live.