Patient.com Privacy Policy - Washington

Patient.com Consumer Health Data Privacy Policy

Effective Date: September 25, 2026

This Washington Consumer Health Data Privacy Policy (“Policy”) applies to personal data defined as “consumer health data” by the Washington My Health My Data Act (“MHMD”) that is collected, used, or shared by Patient.com (“Patient.com,” “we,” “our,” or “us”). This Policy supplements the Patient.com Privacy Policy available at https://patient.com/privacy-policy/. In the event of a conflict between any other policy, statement, or notice and this Policy, this Policy will prevail as to consumer health data protected under MHMD.

The Categories of Consumer Health Data We Collect

The data we collect depends on the context of your interactions with Patient.com, the choices you make, and the tools and features you use. Depending on your interactions with the services and subject to applicable law, we may collect the following categories of consumer health data:

Health conditions, diagnoses, symptoms, diagnostic testing, treatments, and procedures;
Social, psychological, behavioral, and medical interventions;
Health-related surgeries or procedures;
Use or purchase of prescribed medication;
Bodily functions, vital signs, symptoms, or measurements;
Gender-affirming care information;
Reproductive or sexual health information;
Data that identifies a consumer seeking health care services; or
Information processed to associate or identify a consumer with the data described above that is derived or extrapolated from non-health information (such as proxy, derivative, inferred, or emergent data by any means, including algorithms or machine learning

Purposes of Collection and How We Use Consumer Health Data

Generally, we may collect and use the consumer health data that we collect for the purposes set forth below:

To provide, operate, maintain, and support the services you request;
To establish, authenticate, secure, and manage your account;
To communicate with you regarding the services, including support, administrative, and service-related communications;
To verify your identity, maintain data integrity, prevent and detect fraud, and protect the security and integrity of the services;
To synchronize information with health care providers, facilitate pre-registration and appointment-related services, and support other health care–related functionality requested by you;
To personalize your experience and provide information, resources, and recommendations made available through the services;
To understand how users access, use, and interact with the services, including through analytics and measurement tools, and to evaluate onboarding, navigation, workflows, feature usage, engagement, and service performance;
To understand how users find and engage with the services, evaluate the effectiveness of marketing activities, and perform attribution and measurement;
To provide AI-assisted features and functionality, including generating summaries, insights, and other outputs that support your use of the Services;
To improve, develop, troubleshoot, test, and enhance the functionality, performance, quality, and user experience of the services;
To conduct internal research, analytics, and reporting;
To market and promote the services, including sending newsletters and other communications;
To comply with applicable laws, regulations, legal processes, and contractual obligations;
To protect our rights, users, services, and business operations and to investigate or address fraud, security incidents, illegal activity, or violations of our agreements; and
To de-identify and aggregate consumer health data for research, analysis, modeling, marketing, and improvement of the services.

The Categories of Sources from Which We Collect Consumer Health Data

In general, we may collect or receive consumer health data from the following categories of sources:

Directly or indirectly from you;
Individuals or entities authorized to provide information on your behalf;
Healthcare providers;
Health plans and insurers;
Business partners;
Qualified Health Information Networks (QHINs), Health Information Exchanges (HIEs), healthcare clearinghouses, and similar healthcare intermediaries;
Third-party data providers;
Marketing, advertising, analytics, and measurement providers;
From our websites, mobile applications, and other services, including automatically from the devices you use to access or interact with the services.
Credit reporting agencies; and
Public records and public health authorities.

The Categories of Consumer Health Data That We Share

We may share the following categories of consumer health data with third parties and affiliates:

Health conditions, diagnoses, symptoms, diagnostic testing, treatments, and procedures;
Social, psychological, behavioral, and medical interventions;
Health-related surgeries or procedures;
Use or purchase of prescribed medication;
Bodily functions, vital signs, symptoms, or measurements;
Gender-affirming care information;
Reproductive or sexual health information;
Data that identifies a consumer seeking health care services; or
Information processed to associate or identify a consumer with the data described above that is derived or extrapolated from non-health information (such as proxy, derivative, inferred, or emergent data by any means, including algorithms or machine learning).

The Categories of Third Parties and Specific Affiliates with Whom We Share Consumer Health Data

Patient.com may share consumer health data with the following categories of third parties and affiliates, subject to applicable law and the choices described in this Policy:

Health care providers;
Health plans and insurers;
Service providers and vendors that support the operation, security, maintenance, analytics, communications, and functionality of the services;
Advertising, analytics, and measurement providers;
Professional advisors and consultants, including attorneys, auditors, accountants, and other advisors;
Government authorities, regulators, law enforcement, courts, and other parties where disclosure is required by law or legal process;
Parties involved in the prevention, investigation, or resolution of fraud, security incidents, illegal activity, violations of our agreements, or threats to the rights, safety, or property of Patient.com, our users, or others;
Recipients with whom you direct us to share consumer health data or otherwise authorize us to share consumer health data; and
Third parties we, our affiliates, or subsidiaries are or may be acquired by, merged with, financed by, or invested in by another company, or if any of our assets are or may be transferred to another company, whether as part of a bankruptcy or insolvency proceeding or otherwise, we may transfer the information we have collected about you to the other company. We may also share certain personal information as necessary prior to the completion of such a transaction or corporate transactions such as financings or restructurings, to lenders, auditors, and other advisors, including attorneys and consultants, as part of due diligence or as necessary to plan for a transaction.

Your Privacy Rights

Subject to certain conditions and exceptions, the MHMD provides consumers with the following rights:

Know/Access: The right to confirm whether Patient.com collects, shares, or sells your consumer health data and the right to access such consumer health data;
Withdraw Consent: The right to withdraw consent from Patient.com’s collection and sharing of your consumer health data; and
Deletion: The right to have your consumer health data deleted.

Exercising Requests to Know/Access and Delete.

To make a request to know/access or delete your consumer health data, please email us at privacy@patient.com. Before completing your request, we may need to verify your identity or your authority to make a request on behalf of another person. We may send you a link to verify your email address and may request additional documentation or information solely for the purpose of verifying your identity, depending on the type of your request.

Exercising Requests to Withdraw Consent.

You may withdraw your consent to Patient.com’s (i) collection or (ii) sharing of consumer health data by emailing privacy@patient.com and specifying your request. Withdrawal of consent may affect Patient.com’s ability to provide certain products, features, services, or functionality.

If your request to exercise a right under the MHMD is denied, we will provide instructions for how you can appeal our decision. If your appeal is unsuccessful, you can file a complaint with the Washington State Attorney General at www.atg.wa.gov/file-complaint.