Washington Consumer Health Data Privacy Notice

Washington My Health My Data Act

Scope

This Washington Consumer Health Data Privacy Notice ("Notice") applies to consumer health data subject to the Washington My Health My Data Act ("MHMD") that is collected, used, processed, shared, or sold by Atelier Protocol LLC ("Atelier Protocol," "we," "our," or "us"). This Notice applies to Washington consumers and to consumer health data collected in Washington as provided by applicable law. It does not apply to information exempt from MHMD, including protected health information governed by HIPAA where the statutory exemption applies.

Categories of Consumer Health Data We Collect

The consumer health data we collect depends on your interactions with the services, the treatment or information you request, the choices and permissions you provide, and applicable law. Consumer health data may include:

• Health conditions, symptoms, diagnoses, medical history, treatment history, allergies, medications, prescriptions, procedures, laboratory results, and other clinical information.
• Information submitted through intake questionnaires, check-ins, follow-up questionnaires, secure messages, photographs, identity-verification processes, and customer support communications.
• Biometric or physical information used for identity verification or reasonably capable of identifying health status, where applicable.
• Information concerning reproductive or sexual health, mental or behavioral health, gender-affirming care, substance use, or other health-related status when relevant to requested services and lawfully collected.
• Information identifying or reasonably capable of identifying an attempt to seek, research, inquire about, purchase, or receive healthcare services, medications, products, or supplies.
• Precise location information that could reasonably indicate an attempt to acquire or receive healthcare services or supplies, but only when collected with the consent required by law.
• Internet, device, browsing, interaction, and transaction information that may reveal or support an inference about health interests or attempts to obtain health services.
• Inferences derived from information described above concerning health status, treatment interests, or health-related behavior.

Sources of Consumer Health Data

• Directly from you, including information you enter, upload, communicate, or authorize us to receive.
• From your interactions with atelierprotocol.com, patient-facing technology, emails, messages, and customer support.
• From licensed Providers, Wasef Health, PC, pharmacies, laboratories, and other healthcare participants involved in services you request.
• From identity-verification, payment, security, analytics, communications, and technical service providers.
• From cookies or similar technologies where permitted by law and consistent with the consent choices presented to you.

Purposes for Collection and Use

• Facilitating telehealth services and communications with licensed Providers.
• Determining state availability, routing requests, verifying identity, and supporting patient safety.
• Coordinating consultations, prescriptions, pharmacy fulfillment, laboratory services, follow-up care, and customer support.
• Operating, securing, debugging, maintaining, and improving the services.
• Processing transactions and administering accounts and subscriptions.
• Preventing fraud, abuse, unauthorized access, and other security incidents.
• Complying with legal, regulatory, licensing, reporting, and recordkeeping obligations.
• Other purposes disclosed at or before collection and authorized by consent where required.

Categories of Consumer Health Data Shared

We may share the categories of consumer health data identified above only as reasonably necessary to provide services you request, operate the services, protect safety and security, comply with law, or for another purpose authorized by you. Depending on the transaction, shared data may include contact information, identity information, medical intake information, prescription and treatment information, payment and transaction information, device information, and service communications.

Categories of Third Parties and Affiliates

• Wasef Health, PC and licensed physicians, nurse practitioners, physician assistants, and other Providers involved in requested care.
• Licensed pharmacy partners, including GoGo Meds d/b/a Jungle Jims and Pharmacy Hub.
• Laboratories, diagnostic vendors, and other healthcare service participants when applicable.
• Technology, cloud hosting, security, identity-verification, communications, payment, customer-support, and professional service providers acting on our behalf.
• Government agencies, regulators, courts, law enforcement, or other persons when disclosure is required or permitted by law.
• Parties involved in an actual or proposed merger, financing, acquisition, reorganization, bankruptcy, sale, or transfer, subject to applicable legal requirements.
• Affiliates listed here: [SPECIFIC AFFILIATES, IF ANY].

A current list of specific third parties and affiliates with whom consumer health data is shared may be requested by emailing care@atelierprotocol.com.

Sale of Consumer Health Data

Atelier Protocol does not sell consumer health data. We will not sell consumer health data without obtaining a valid authorization that satisfies applicable law. A "sale" may be defined broadly under MHMD and may include an exchange of consumer health data for monetary or other valuable consideration, subject to statutory exceptions.

Consent

Where MHMD requires consent before collecting or sharing consumer health data, consent will be requested separately and will identify the categories of data, the purpose of collection or sharing, and the categories of entities with whom data may be shared. Consent to collect or share consumer health data is separate from any authorization required for a sale.

Your Rights

• Confirm whether we are collecting, sharing, or selling your consumer health data and access such data.
• Obtain a list of third parties and affiliates with whom your consumer health data has been shared or sold and contact information for those entities, as required by law.
• Withdraw consent for future collection or sharing of consumer health data.
• Request deletion of consumer health data maintained by us, subject to exceptions and the statutory process for notifying relevant processors, affiliates, and other entities.
• Appeal a denial of a request.
• Exercise rights without unlawful discrimination.

How to Exercise Your Rights

• Email: care@atelierprotocol.com
• Online request form: [PRIVACY REQUEST FORM URL]
• Postal mail: Atelier Protocol LLC, Attn: Consumer Health Data Request, 418 Broadway, Ste R, Albany, NY 12207

Please describe the right you wish to exercise and provide information reasonably necessary to verify your identity and locate the relevant records. We may deny or limit a request where permitted by law and will provide an explanation and appeal instructions.

Appeals

To appeal a denial, email hello@atelierprotocol.com with the subject line "Washington Consumer Health Data Appeal." If the appeal is denied, you may contact the Washington State Attorney General.

Security and Retention

We use administrative, technical, and physical safeguards designed to protect consumer health data appropriate to the volume and nature of the data. We retain consumer health data only for as long as reasonably necessary for the purposes described in this Notice, to provide requested services, or to satisfy legal, regulatory, contractual, dispute-resolution, and recordkeeping requirements.

Changes to This Notice

We may update this Notice. The revised version will identify its effective date and will be made available through atelierprotocol.com. Where required, we will provide notice or obtain consent before materially changing how consumer health data is collected, used, or shared.

Contact Information

Atelier Protocol LLC
418 Broadway, Ste R, Albany, NY 12207
Privacy: care@atelierprotocol.com
Legal: legal@atelierprotocol.com
Telephone: (929) 723-3212