Washington Consumer Health Data Privacy Policy

Last Updated: 29 March 2024 This notice supplements the Incode Privacy Policy and applies to personal data defined as “consumer health data” subject to the Washington State My Health My Data Act (MHMDA). Consumer Health Data We Collect

Consumer Health Data We Collect

As described in the “What personal data does Incode collect” section of the Incode Privacy Policy, the data we collect depends on the context of your interactions with us and the choices you make (including your privacy settings), the products and features you use, your location, and applicable law. Because consumer health data is defined very broadly, many of the categories of data we collect could also be considered consumer health data. Examples of consumer health data may include:

• Information about your health-related conditions, symptoms, status, diagnoses, testing, or treatments).
• Measurements of bodily functions, vital signs, or characteristics, including photographs, which may also be considered biometric information under the MHMDA.
• Precise location information that could reasonably indicate your attempt to acquire or receive health services or supplies
• Information that could identify your attempt to seek health care services or information, including services that allow you to assess, measure, improve, or learn about your or another person’s health.
• Other information that may be used to infer or derive data related to the above or other health information.

Sources of Consumer Health Data

As described further in the “What personal data does Incode collect” section of the Incode Privacy Policy, we collect personal data (which may include consumer health data) directly from you, from your interactions with our products and services, from third parties, and from publicly available sources.

Why We May Collect and Use Consumer Health Data

We may collect and use consumer health data for the purposes described in the “Purposes for collection, use, and disclosure” section of the privacy statement. Put briefly, we collect and use consumer health data as reasonably necessary to provide you with the products or services have requested or authorized. This may include: (i) delivering and operating our products and services; (ii) personalization of certain features; (iii) ensuring the secure and reliable operation of our products and services; (iv) troubleshooting and improving the products and services; and (v) other support for our products and services, (such as analyzing our performance, meeting our legal obligations, developing our workforce, and conducting research and development). We may use consumer health data for other purposes for which we give you choices and/or obtain your consent as required by law – for example, for advertising or marketing purposes. See the “Your choices” section of the Privacy Policy and the information below for more details on the choices you may have.

Our Sharing of Consumer Health Data

We may share each of the categories of consumer health data described above for the purposes described in the “How does Incode disclose personal data” section of the Privacy Policy. For example, we may share personal data, including consumer health data, with your consent or as reasonably necessary to complete any transaction or provide any product or service you have requested or authorized, to prevent fraud, or to comply with applicable law. Third Parties With Which We Share Consumer Health Data As necessary for the purposes described above, we share consumer health data with the following categories of third parties:

• Consent. We may disclose your personal data with others if we have obtained your consent to such disclosure, including where you specifically authorize or direct us to disclose your personal data to our business partners.
• Service providers. These vendors help us provide the Services or perform business functions on our behalf, and will only process your personal data for purposes described herein and in our Privacy Policy.
• Analytics partners. These parties provide analytics on web traffic or usage of the Incode Website
• Business partners. We may share consumer health data with other companies.
• Parties to a corporate transaction. We may disclose consumer health data as part of a corporate transaction or proceeding such as a merger, financing, acquisition, bankruptcy, dissolution, or a transfer, divestiture, or sale of all or a portion of our business or assets.
• Affiliates. We enable access to data across our subsidiaries, affiliates, and related companies, for example, where we share common data systems or where access helps us to provide our services and operate our business. Our Affiliates include: Incode Technologies Europe SL (ESP), Incode Advanced Technologies, LLC (SRB), and Incode Technologies Mexico, S. de RL de CV (MEX).
• Government agencies. As described in our Privacy Policy, we disclose data to law enforcement or other government agencies when doing so is necessary to comply with applicable law or respond to valid legal process.
• Other third parties. In certain circumstances, it may be necessary to provide data to other third parties, for example, to comply with the law or to protect our rights or those of our customers.

How to Exercise Your Rights

The MHMDA provides certain rights with respect to consumer health data, including rights to access, delete, or withdraw consent relating to such data, subject to certain exceptions. These rights and the mechanisms for effecting them are described in our Privacy Policy. If you want to access or control consumer health data processed by Incode, you can always contact us at the contact information in the “Contact Information” section. If you make a request to exercise a right under the MHMDA it is denied, you may choose to appeal that denial by contacting our privacy support team at dataprotection@incode.com. If your appeal is unsuccessful, you can raise a concern or lodge a complaint with the Washington State Attorney General at www.atg.wa.gov/file-complaint.