This policy supplements our Privacy Policy and applies to consumer health data covered by the Washington My Health My Data Act and Nevada Senate Bill 370. Where the two conflict as to consumer health data, this policy controls.
1. Introduction and Scope
This Consumer Health Data Privacy Policy describes how Soha Health LLC ("Soha," "we," "us," or "our") collects, uses, and shares "consumer health data" as that term is defined under the Washington My Health My Data Act and Nevada Senate Bill 370 (together, the "Consumer Health Data Laws"). It applies to consumer health data we collect from or about consumers to whom those laws apply, and it supplements the Soha Privacy Policy. To the extent this Consumer Health Data Privacy Policy conflicts with the Soha Privacy Policy with respect to consumer health data, this Consumer Health Data Privacy Policy controls. Capitalized terms not defined here have the meanings given in the Soha Privacy Policy and the Soha Terms and Conditions.
This Consumer Health Data Privacy Policy does not apply to: (a) "protected health information" governed by the Health Insurance Portability and Accountability Act ("HIPAA") that we create, receive, or maintain in our capacity as a business associate of the Medical Groups or Pharmacies; (b) information collected and maintained by or on behalf of the Medical Groups, Providers, or Pharmacies for purposes of diagnosis and treatment, which is handled in accordance with our agreements with those parties and applicable law; or (c) information that has been de-identified in accordance with applicable law. We recommend that you review this policy carefully before providing us with any information.
2. Consumer Health Data We Collect
Depending on how you interact with the Services, we may collect the following categories of consumer health data:
- Health information you provide, such as your responses to intake questionnaires, symptom assessments, quizzes, and surveys, including information about symptoms, health conditions, medications, and treatment history.
- Purchase and transaction information that identifies your health status, such as the health-related products, treatments, and subscriptions you seek, purchase, or consider through the Services.
- Communications containing health information, such as messages, emails, calls, and support interactions in which you provide information about your health.
- Usage data that identifies health interests or status, such as the health-related pages, treatments, and symptoms you view or search for on the Platform, and measurements or data derived from those interactions.
- Biometric data, to the extent biometric information processed by us or our service providers to verify your identity constitutes consumer health data.
- Inferences, meaning information we derive or infer from the categories above that could identify your past, present, or future health status.
We do not collect precise geolocation data, and we do not use geofencing around facilities that provide in-person health care services to identify, track, or collect data from, or send notifications or advertisements to, consumers.
3. Sources of Consumer Health Data
We collect consumer health data: (a) directly from you, when you complete questionnaires or forms, make purchases, create or maintain an account, or communicate with us; (b) automatically, through cookies and similar technologies that record your interactions with the Platform, as described in the Soha Privacy Policy; and (c) from our service providers and processors acting on our behalf in connection with the Services.
4. How We Use Consumer Health Data
We collect and use consumer health data to provide the products and services you request from us, including to: register, verify, and administer your account; determine the products and services available to you; facilitate your relationship with the Medical Groups, Providers, and Pharmacies; place, process, and fulfill orders; process payments; provide customer support and respond to your requests and communications; maintain the security and integrity of the Services, including detecting and preventing fraud and security incidents; and comply with our legal obligations, including establishing, exercising, and defending legal claims. We may also use consumer health data for other purposes with your consent, where consent is required by the Consumer Health Data Laws.
5. Consent; No Sale of Consumer Health Data
We collect and share consumer health data only: (a) as necessary to provide the products and services you have requested from us; or (b) with your prior consent, where consent is required by the Consumer Health Data Laws. We do not sell consumer health data, and we will not sell consumer health data without first obtaining your valid written authorization as required by applicable law. If you provide such an authorization, you may revoke it at any time.
6. How We Share Consumer Health Data
We may share consumer health data with the following categories of recipients:
- The Medical Groups, Providers, and Pharmacies, to enable them to provide the services you request through the Services.
- Service providers and processors that process consumer health data on our behalf and pursuant to our instructions under binding contracts, such as technology, hosting, and IT providers; identity verification providers; communications and support providers; payment processors; and fulfillment and shipping providers.
- Law enforcement, government authorities, and other parties for legal purposes, when we believe disclosure is necessary to comply with applicable law or valid legal process, or to establish, exercise, or defend legal claims.
- Parties to a corporate transaction, in connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale or transfer of some or all of our business or assets, to the extent permitted by applicable law.
- Parties you direct or consent to, including any recipient to whom you ask us or authorize us, with consent valid under the Consumer Health Data Laws, to disclose consumer health data.
We do not share consumer health data with third-party advertising platforms, networks, or data brokers without consent valid under the Consumer Health Data Laws. Soha does not currently share consumer health data with any affiliates. If we share consumer health data with affiliates in the future, we will identify those affiliates in this policy. Whenever you interact with us on behalf of another individual, such as by referring another person to us, you must first obtain that individual’s consent, or have the legal authority to act without consent, before sharing their consumer health data with us. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are excluded from every category of sharing described above and will not be shared with any third parties, as described in the "SMS and Text Message Program" section of the Soha Privacy Policy.
7. Your Rights
Subject to the Consumer Health Data Laws that apply to you, you have the following rights with respect to consumer health data:
- Right to Know and Access. You have the right to confirm whether we are collecting, sharing, or selling consumer health data concerning you; to access that data; and to receive a list of the third parties and affiliates with whom we have shared or to whom we have sold your consumer health data, together with an active email address or other online mechanism that you may use to contact those third parties.
- Right to Withdraw Consent. Where our collection or sharing of your consumer health data is based on your consent, you have the right to withdraw that consent at any time.
- Right to Delete. You have the right to request that we delete your consumer health data. If you exercise this right, we will delete the data from our records, including, within the timeframes required by applicable law, from archived and backup systems, and we will notify our processors and any third parties with whom we have shared the data of your deletion request, in each case as required by the Consumer Health Data Laws.
8. Exercising Your Rights; Appeals
You may exercise any of these rights by emailing us at legal@joinsoha.com with the subject line "Consumer Health Data Request." To protect your information, we may need to verify your identity before acting on a request, which may include asking you to submit the request from the email address associated with your account or to provide additional identifying information. We will respond to authenticated requests within the timeframes required by applicable law.
If we decline to take action on your request, we will notify you and explain our reasons. You may appeal our decision by replying to our response or by emailing us at legal@joinsoha.com with the subject line "Consumer Health Data Appeal." We will respond to your appeal in writing within the timeframe required by applicable law, including a written explanation of the reasons for our decision. If your appeal is denied, you may raise a concern or lodge a complaint with the Attorney General of your state: for Washington residents, at www.atg.wa.gov/file-complaint; for Nevada residents, through the Office of the Nevada Attorney General at ag.nv.gov.
9. Changes to This Policy
We may update this Consumer Health Data Privacy Policy from time to time. Updated versions will be posted on this page with a revised "Last Updated" date and will be effective when posted, except as otherwise required by applicable law. We recommend that you review this policy periodically.
10. Contact Us
If you have questions about this Consumer Health Data Privacy Policy or our handling of consumer health data, or if you would like to exercise a right described above, please contact us:
- By email: legal@joinsoha.com, Attn: Privacy
Questions about this document? Email legal@joinsoha.com.
See also our Important Safety Information.