Consumer Health Data Privacy Policy

Last updated:

This Consumer Health Data Privacy Policy supplements the Privacy Policy and applies to personal data defined as “consumer health data” subject to the Nevada Consumer Health Data Privacy Law, NRS 603A.400 through 603A.550 (“NHDPA”). This Consumer Health Data Privacy Policy applies to individual consumers who are residents of the State of Nevada or individuals whose consumer health data is collected in the State of Nevada. In the event of a conflict between any other policy, statement, or notice and this Consumer Health Data Privacy Policy, this Consumer Health Data Privacy Policy will control as to consumer health data subject to the NHDPA. This Consumer Health Data Privacy Policy does not apply to any person or entity, or to any data, that is subject to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and the regulations adopted pursuant thereto, as provided in NRS 603A.490.

Consumer Health Data We Collect

As described in the Personal Data We Collect About You section of the Privacy Policy, the data we collect depends on the context of your interactions with us and the choices you make (including your privacy settings), the Services you use, your location, and applicable law. Because consumer health data is defined very broadly, many of the categories of data we collect could also be considered consumer health data. Under the NHDPA, “consumer health data” means personal information that is linked or reasonably linkable to a particular individual and that identifies that individual’s past, present, or future physical or mental health status. However, the following categories of information are not consumer health data and not covered by this Consumer Health Data Privacy Policy:

  • Protected Health Information (“PHI”), as defined by the Health Insurance Portability and Accountability Act (“HIPAA”);

  • Information that is collected, used, or disclosed by a person or entity that is subject to HIPAA and the regulations adopted pursuant thereto;

  • Publicly available information;

  • Deidentified data; or

  • Information otherwise excluded from the scope of the NHDPA.

Examples of consumer health data may include:

  • Information about your health-related conditions, symptoms, status, diagnoses, testing, or treatments (including surgeries, procedures, medications, or other interventions). For example, we may collect such information through surveys or other communication with you for research studies and improving product accessibility.

  • Measurements of bodily functions, vital signs, or characteristics, including photographs, which may also be considered biometric information under the NHDPA or other applicable state consumer health privacy law.

  • Precise location information that could reasonably indicate your attempt to acquire or receive health services or supplies.

  • Information that could identify your attempt to seek health care services or information, including services that allow you to assess, measure, improve, or learn about your or another person’s health.

  • Other information that may be used to infer or derive data related to the above or other health information.

Sources of Consumer Health Data

As described further in the  Privacy Policy, we collect personal data (which may include consumer health data) directly from you, from your interactions with our Services, from third parties, and from publicly available sources.

Why We Collect and Use Consumer Health Data

We collect and use consumer health data for the purposes described in the How We Collect Your Personal Data and Personal Data Collected Through and Use of Automatic Data Collection Technologies sections of the Privacy Policy. We will not collect consumer health data without your affirmative, voluntary consent, except to the extent necessary to provide a product or service you have requested (NRS 603A.500). Primarily, we collect and use consumer health data as reasonably necessary to provide you with the Services you have requested or authorized. This may include delivering and operating the Services and their features, personalization of certain Service features, ensuring the secure and reliable operation of the Services and the systems that support them, troubleshooting and improving the Services, and other essential business operations that support the provision of the Services (such as analyzing our performance, meeting our legal obligations, developing our workforce, and conducting research and development). We process consumer health data electronically through our Platform and through secure systems maintained by our service providers.

We may use consumer health data for other purposes for which we give you choices and/or obtain your consent as required by law – for example, for advertising or marketing purposes. See the Choices About How We Use and Disclose Your Personal Data section of the Privacy Policy and the How to Exercise Your Rights section below for more details on the controls and choices you may have.

Our Sharing of Consumer Health Data

We may share each of the categories of consumer health data described above for the purposes described in the Disclosure of Your Personal Data section of the Privacy Policy.

We will not share consumer health data without obtaining your separate and distinct consent prior to sharing, except as reasonably necessary to provide a product or service you have requested or when we believe that doing so is necessary to comply with applicable law or respond to valid legal process (NRS 603A.500). “Share” means to release, disclose, disseminate, divulge, make available, provide access to, license, or otherwise communicate consumer health data to a third party or affiliate. Before requesting your consent to share consumer health data, we will disclose the categories of consumer health data to be shared, the purpose of sharing (including the manner in which the data will be used), the categories of third parties or affiliates with whom the data will be shared, and how you may withdraw your consent. Rareform Health, Inc. (“Rareform Health”) collects payments for clinical services on behalf of its affiliated medical groups, Rareform Medical Group CA, PC and Rareform Medical Group, PC (collectively, the “Medical Groups”), as their authorized billing agent. Consumer health data shared between Rareform Health and the Medical Groups in connection with billing, payment processing, and the provision of the Services is shared to facilitate the Services you have requested.

Third Parties With Which We Share Consumer Health Data

As necessary for the purposes described above, we share consumer health data with the following categories of third parties:

  • Service providers. Vendors or agents (“processors”) working on our behalf may access consumer health data for the purposes described above. For example, companies we’ve hired to provide customer service support or assist in protecting and securing our systems and Services may need access to data to provide those functions.

  • Business partners. We may share consumer health data with other companies, for example, where you use a Service that is cobranded and jointly operated with another company, or where you use our Services to interact with another company.

  • Financial institutions & payment processors. When you make a purchase or enter into a financial transaction, we will disclose payment and transactional data to banks and other entities as necessary for payment processing, fraud prevention, credit risk reduction, analytics, or other related financial services.

  • Parties to a corporate transaction. We may disclose consumer health data as part of a corporate transaction or proceeding such as a merger, financing, acquisition, bankruptcy, dissolution, or a transfer, divestiture, or sale of all or a portion of our business or assets.

  • Affiliates. We enable access to data across our subsidiaries, affiliates, and related companies, for example, where we share common data systems or where access helps us to provide our Services and operate our business.

  • Government agencies. As described in our Privacy Policy, we disclose data to law enforcement or other government agencies when we believe doing so is necessary to comply with applicable law or respond to valid legal process.

  • Other third parties. In certain circumstances, it may be necessary to provide data to other third parties, for example, to comply with the law or to protect our rights or those of our customers.

  • Other users and individuals. If you use our Services to interact with other Users of the Service or other recipients of communications, we will share data, including consumer health data, as directed by you and your interactions.

  • The public. You may select options available through our Services to publicly display and disclose certain information, such as your profile, demographic data, content and files, or geolocation data, which may include consumer health data.

Sales of Consumer Health Data

Under the NHDPA, a “sale” means the exchange of consumer health data for monetary or other valuable consideration (NRS 603A.410). We will not sell your consumer health data without first obtaining your prior written consent. If you have previously provided written consent for the sale of your consumer health data, you can revoke that consent at any time by contacting us at support@rareformhealth.co. We do not currently sell consumer health data.

How to Exercise Your Rights

If you are covered by the NHDPA, or other applicable consumer health privacy law, you have the following rights with respect to your consumer health data, subject to certain exceptions: (a) the right to confirm whether we are collecting, sharing, or selling your consumer health data; (b) the right to access your consumer health data; (c) the right to have a list of all third parties and affiliates with whom we have shared or to whom we have sold your consumer health data during the preceding 12 months, including an active email address or other online mechanism the consumer may use to contact those third parties; (d) the right to request deletion of your consumer health data (and upon such request, we will also direct all affiliates, processors, contractors, and third parties to whom we have shared or sold such data to delete it); and (e) the right to withdraw your consent to the collection or sharing of your consumer health data. You can request to exercise such rights using the various tools and mechanisms described in the Choices About How We Use and Disclose Your Personal Data section of the Privacy Policy. For example, depending on the Service you use, you can access and make choices about your data through product controls. You can also access and clear some of your data through your web browser. And if you want to access or control consumer health data processed by us that is not available via those tools or directly through the Service you use, you can always contact us at support@rareformhealth.co. You may submit a rights request, free of charge, up to two times per year. We will respond to your rights request within 45 days, though in certain cases we may inform you that we will need up to another 45 days to act on your request.

If your request to exercise a right is denied, you may appeal that decision by contacting our support team at support@rareformhealth.co. If your appeal is unsuccessful, you can raise a concern or lodge a complaint with the Nevada State Attorney General at https://ag.nv.gov/complaints/file_complaint/ or the Nevada Commissioner of Consumer Affairs, or other regulatory authority as applicable.

Changes to This Policy; Third-Party Cross-Site Tracking

If we make material changes to this Consumer Health Data Privacy Policy, we will notify you by email to the email address associated with your account and/or through a conspicuous notice on our Platform prior to the changes taking effect. Your continued use of the Services after such notification constitutes your acceptance of the updated policy.

Third parties may collect consumer health data about your online activities over time and across different websites when you use our Services. For more information about tracking technologies and your choices, see the Cookies and Other Tracking Technologies section of our Privacy Policy.

Contact Us

If you have any questions, concerns, complaints or suggestions regarding this Consumer Health Data Privacy Policy or otherwise need to contact us, do not hesitate to contact us at:

Website: www.rareformhealth.co
Email: support@rareformhealth.co

Postal Address: 8 The Green, Ste. A, Dover, DE 19901
Rareform Health, Inc.
Attn: Legal