Consumer Health Data Privacy Notice

1. Introduction

This Consumer Health Data Privacy Notice (“Notice”) describes how the Mindful Therapy Group professional entities identified in our Notice of Privacy Practices, and Mindful Support Services, LLC (“MSS”) process Consumer Health Data that is subject to applicable consumer health data laws.

Mindful Therapy Group subcontracts with MSS to provide certain administrative services, including operation of the websites and related administrative, technology, communications, scheduling, and support functions. For purposes of this Notice, “we,” “us,” and “our” refer collectively to the entity or entities responsible for the applicable Consumer Health Data processing described in this Notice.

This Notice is separate from our Privacy Policy for Website and SMS/Text Communications and is published under its own link. Consumer Health Data is expressly excluded from that Privacy Policy and is addressed in this Notice.

This Notice applies to Consumer Health Data covered by applicable state consumer health data laws, including the Washington My Health My Data Act, Chapter 19.373 RCW, and Nevada’s consumer health data law, Chapter 603A of the Nevada Revised Statutes. The Washington and Nevada supplements at the end of this Notice apply where applicable and control if they differ from the general terms of this Notice.

This Notice does not apply to Protected Health Information (“PHI”) governed by HIPAA. PHI is governed by our Notice of Privacy Practices.

2. Scope of This Notice

Consumer Health Data generally means personal information that is linked or reasonably linkable to an individual and identifies the individual’s past, present, or future physical or mental health status.

Consumer Health Data may include information identifying that a person is seeking healthcare services, information about requested health services, health conditions or treatment, insurance-related information associated with a request for care, and health-related information inferred or derived from other personal information.

This Notice does not apply to information exempt from applicable consumer health data laws, including:

• PHI governed by HIPAA and its implementing regulations
• Healthcare information collected, used, or disclosed in accordance with Chapter 70.02 RCW
• Patient-identifying information governed by 42 C.F.R. Part 2
• Other information expressly exempt under applicable state law

These exemptions apply to particular categories of information and do not necessarily exempt an organization as a whole. For example, information collected through our website or through an inquiry before a treatment relationship begins may be Consumer Health Data, even if related clinical information later becomes PHI.

3. Categories of Consumer Health Data We Collect

Depending on how you interact with us, we may collect:

• Information about seeking healthcare services, such as a request for mental-health, behavioral-health, therapy, psychiatric, medication-management, telehealth, or other healthcare services; the type of provider, service, specialty, or modality you are seeking; and related provider or treatment preferences.
• Contact and identifying information, such as your name, email address, telephone number, mailing address, date of birth or age range, and other identifiers you provide when requesting information or services.
• Insurance and payment-related information, such as insurance carrier, plan or coverage information, member or subscriber information, whether you intend to use insurance or self-pay, and information used to assess service availability or insurance compatibility.
• Health and service-preference information, such as general concerns, symptoms, conditions, or service needs you choose to provide; provider, location, language, accessibility, scheduling, telehealth, or modality preferences; and information included in messages, intake forms, inquiries, calls, chats, emails, or text communications.
• Technical and online information, such as Internet Protocol address; cookie, session, referral, or device identifiers; website-interaction information; general location information inferred from an Internet Protocol address; referral source and campaign information; and information showing that a person visited or interacted with a healthcare-related page, form, location, or service.

We do not use precise geolocation data for advertising, audience creation, retargeting, or measurement related to healthcare services. We do not permit third-party advertising technologies to use Consumer Health Data collected through our website for their own advertising purposes.

4. Sources of Consumer Health Data

We may collect Consumer Health Data:

• Directly from you, including through website or intake forms, calls, emails, text messages, chat, appointment requests, feedback, formal complaints, and other communications.
• From a parent, guardian, personal representative, or authorized agent acting on your behalf.
• From independent healthcare providers or provider practices when necessary to respond to your request or support a service you requested.
• From Mindful Therapy affiliates, including MSS.
• From service providers and processors supporting website hosting, forms, communications, appointment scheduling, call routing, insurance verification, security, accessibility, website functionality, and related administrative functions.
• Automatically through your interaction with our website, including through cookies, server logs, referral identifiers, and similar technologies.
• From advertising or referral sources, to the extent permitted by law and consistent with your request or consent.
• From other third parties at your direction or with your authorization.

5. Why We Collect and Use Consumer Health Data

We may collect and use Consumer Health Data to:

• Respond to requests for information or healthcare services.
• Help identify providers, specialties, services, or locations that may meet your stated needs.
• Help determine service availability and facilitate intake, scheduling, insurance verification, and other administrative support.
• Communicate with you about your inquiry, requested services, appointments, provider availability, insurance, billing, or other administrative matters.
• Operate, maintain, secure, troubleshoot, and improve our website and intake processes.
• Where permitted by applicable law and consistent with the consumer’s choices and any required consent, we may use limited technical information to evaluate website operation, security, accessibility, and the effectiveness of our outreach. We do not use Consumer Health Data for targeted advertising or disclose it to advertising platforms except as expressly described and permitted by applicable law.
• Prevent, detect, investigate, and respond to fraud, security incidents, malicious activity, or unlawful conduct.
• Comply with legal and regulatory obligations and establish, exercise, or defend legal claims.
• Carry out another purpose disclosed to you at the time of collection or for which you provide consent.

We limit our collection and use of Consumer Health Data to what is reasonably necessary to provide a product or service you requested or to purposes for which we obtain consent when required by law.

6. Categories of Consumer Health Data We Share

Depending on your interaction with us and the services you request, we may share:

• Information indicating that you are seeking healthcare services.
• Contact and identifying information associated with your inquiry.
• Insurance and coverage information.
• Provider, specialty, scheduling, location, and service preferences.
• Information you provide in intake forms or communications.
• Technical, security, and website-interaction information.
• Other Consumer Health Data necessary to respond to or fulfill your request.

We share Consumer Health Data only as necessary to provide a product or service you requested, with your consent when required, or as otherwise permitted or required by applicable law. When consent is required to share Consumer Health Data, it will be separate and distinct from consent to collect Consumer Health Data.

7. Categories of Third Parties and Affiliates With Which We Share Consumer Health Data

We may share Consumer Health Data with:

• Mindful Support Services, LLC, which provides administrative, technology, website, communications, scheduling, billing, and other support services on behalf of Mindful Therapy.
• Independent healthcare providers and their professional practices when you request assistance identifying, contacting, scheduling with, or receiving services from a provider.
• Service providers and processors that support website hosting and infrastructure, forms and intake platforms, scheduling, communications, insurance verification, payment and billing, website performance and attribution, security, data storage, accessibility, and professional services such as legal, audit, insurance, and consulting.
• Government agencies, regulators, courts, law enforcement, or other parties when required or permitted by law or necessary to protect our rights, safety, systems, consumers, or the public.
• A successor organization or other party involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction, subject to applicable legal requirements.

8. Sale of Consumer Health Data

We do not sell Consumer Health Data. We will not sell Consumer Health Data without first obtaining a valid authorization that is separate from consent to collect or share Consumer Health Data and that satisfies applicable legal requirements.

9. Your Consumer Health Data Rights

Subject to applicable law, you may have the right to:

• Confirm whether we collect, share, or sell Consumer Health Data concerning you.
• Access Consumer Health Data concerning you.
• Obtain a list of third parties and affiliates with which we have shared or sold your Consumer Health Data, together with an active email address or another online method for contacting those recipients.
• Withdraw consent to future collection or sharing of Consumer Health Data.
• Request deletion of Consumer Health Data concerning you.
• Appeal our refusal to act on a request.
• Exercise these rights without unlawful discrimination.

These rights may not apply to information exempt from applicable consumer health data law, including PHI governed by HIPAA or healthcare information governed by Chapter 70.02 RCW.

10. Contact Us and Exercise Your Rights

To submit a Consumer Health Data request, withdraw consent, appeal a decision, or ask a question about this Notice, contact us at privacy@mindfultherapygroup.com or by mail:

Mindful Therapy Group
Attn: Privacy Officer
6505 216th Street SW, Suite 100
Mountlake Terrace, WA 98043

Please identify your state of residence and the nature of your request, such as “Consumer Health Data Request,” “Consumer Health Data Appeal,” or “Consumer Health Data Consent Withdrawal.” We may request information reasonably necessary to verify your identity or authority to act for another person.

We will respond to authenticated requests within 45 days. When permitted by law, we may extend this period once by up to an additional 45 days and will notify you of the reason for the extension. If we deny your request, you may appeal by contacting us using the information above and identifying your request as a “Consumer Health Data Appeal.”

You may use an authorized agent to submit a request on your behalf. We may require reasonable proof of the agent’s authority and verification of your identity, as permitted by law.

11. Data Security

We maintain reasonable administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of Consumer Health Data.

We restrict access to workforce members, contractors, and service providers that need access for a disclosed purpose, to fulfill a service you requested, or as otherwise permitted by law.

No method of transmission or storage is completely secure. Please do not send sensitive health information through unsecured email or text messages. Where available, use the secure patient portal or another secure communication method.

12. Geofencing

We do not use precise location data to create geofences around healthcare facilities to identify or track individuals seeking healthcare services, collect Consumer Health Data, or send health-related notifications, messages, or advertisements.

Washington and Nevada have different statutory geofence radii. The applicable requirements are described in the state supplements below.

13. Changes to This Notice

We may update this Notice periodically. When we do, we will post the revised Notice and update the “Last Updated” date.

We will not collect, use, or share additional categories of Consumer Health Data, or process Consumer Health Data for materially different purposes not disclosed in this Notice, without first providing required notice and obtaining consent when required by law.

Washington Supplement

This supplement applies if you are a Washington resident or if your Consumer Health Data is collected in Washington, including while you are visiting the state. It reflects the Washington My Health My Data Act, Chapter 19.373 RCW.

Specific Affiliates

Washington law requires us to name the specific affiliates with which we share Consumer Health Data. We share Consumer Health Data with:

• Mindful Support Services, LLC

Geofencing

We do not use precise location data to implement a geofence within 2,000 feet of an in-person healthcare facility for the purpose of identifying or tracking consumers seeking healthcare services, collecting Consumer Health Data, or sending notifications, messages, or advertisements related to Consumer Health Data or healthcare services.

Sale

Washington requires a separate, signed authorization before Consumer Health Data may be sold. We do not sell Consumer Health Data and do not currently use such an authorization process.

Complaints

We will respond in writing to an appeal within 45 days after receiving it. If we deny an appeal, our written response will explain the basis for the decision and provide information about how to submit a complaint to the applicable state Attorney General.

The Washington My Health My Data Act is also enforceable through the Washington Consumer Protection Act.

Nevada Supplement

This supplement applies if you are a Nevada resident, or if your Consumer Health Data is collected in Nevada, and you have requested a product or service from us. It reflects Nevada’s consumer health data law, Chapter 603A of the Nevada Revised Statutes.

Scope of Consumer Health Data

Nevada defines Consumer Health Data as personally identifiable information that is linked or reasonably capable of being linked to a consumer and that a regulated entity uses to identify the consumer’s past, present, or future health status. Nevada’s definition differs from Washington’s definition. As a result, certain information described in Section 3 may be Consumer Health Data in Washington but may not be Consumer Health Data in Nevada.

Third Parties and Affiliates

Nevada requires disclosure of the categories of third parties and affiliates with which we share Consumer Health Data. Those categories are listed in Section 7 of this Notice.

Consent

Where Nevada law requires consent, we obtain affirmative and express consent. We do not combine consent for the collection or sharing of Consumer Health Data with consent for another purpose.

Geofencing

We do not precise location data to implement a geofence within 1,750 feet of an in-person healthcare facility for the purpose of identifying or tracking consumers seeking healthcare services, collecting Consumer Health Data, or sending notifications, messages, or advertisements related to Consumer Health Data or healthcare services.

Complaints

Nevada’s consumer health data law is enforced by the Nevada Attorney General. If we deny your appeal, you may submit a complaint to that office. Nevada’s statutory framework requires a conspicuous consumer-health-data notice and includes consent, consumer-rights, security, processor, and geofencing requirements