Consumer Health Data Privacy Policy

1. Who this applies to

This policy applies to “consumer health data” as defined by the Washington My Health My Data Act (RCW 19.373) and Nevada SB 370 — personal information linked to you that identifies your past, present, or future physical or mental health status, including information that merely indicates you are seeking health care services. It is published by BLOOM PROCESSING LLC, doing business as RxHero.

Residents of other states have equivalent protections described in Section 13 of our Privacy Policy.

2. Categories of consumer health data we collect

On our own website, before any medical intake begins, we collect a deliberately narrow set:

• Health-condition interest: the treatment area you select (for example, weight management) and the general goal you choose. Selecting a treatment area indicates you are seeking health care services, which makes it consumer health data.
• Eligibility signals: the state you live in and your confirmation that you are 18 or older.
• Contact information you give us so we can follow up about care.

We do not collect your medical history, current medications, symptoms, diagnoses, lab results, biometric data, precise location, photographs, or identity documents on our website. Those are collected during the medical intake on Remedora’s HIPAA-covered platform and are governed by HIPAA, not by this policy.

3. Sources we collect it from

• Directly from you, when you make selections or contact us.
• Automatically from your device (IP address, browser and device type, pages viewed, referring page) when you use our website.

We do not buy consumer health data, and we do not obtain it from data brokers, advertising networks, or other third-party sources.

4. Why we collect it and how we use it

• To determine whether we can serve your state.
• To route you to the right intake so a licensed clinician can evaluate whether treatment is appropriate.
• To communicate with you about the request you made.
• To operate, secure, and maintain our website.
• To comply with legal obligations.

We do not use consumer health data for targeted advertising, and we do not use it to profile you.

5. Categories of consumer health data we share

When you choose to begin an intake, we share your treatment-area interest, state, age confirmation, and contact information so that care can be delivered. We share no other category of consumer health data.

6. Who we share it with

The specific third parties and categories of third parties with whom we share consumer health data are:

• Remedora Inc. (Remedora) — our telehealth platform, which operates patient intake, clinical records, e-prescribing, and pharmacy routing under a business associate agreement.
• LocumTele — the telehealth provider network supplying the licensed clinicians who evaluate requests.
• Rush Pharmacy — the licensed pharmacy that prepares and ships any prescribed medication.
• Processors acting on our behalf — hosting and email vendors, bound by contract to use the data only to perform services for us.
• Legal and safety recipients — regulators, courts, or law enforcement where required by law, and an acquirer in a merger or sale of assets.

We do not sell consumer health data, and we have never sold it. We do not share it with advertising networks, data brokers, or social media platforms. Selling consumer health data would require your signed, revocable authorization under the My Health My Data Act; we do not seek one because we do not sell it.

7. No geofencing

We do not implement a geofence around any health care facility, pharmacy, or provider location, and we do not use location data to identify, track, or advertise to people near one. This is prohibited by the My Health My Data Act and we do not do it.

8. Your rights over consumer health data

Washington and Nevada residents have the right to:

• Confirm whether we collect, share, or sell your consumer health data, and access that data.
• Know the list of all third parties and affiliates with whom we have shared or sold your consumer health data, along with contact information for each.
• Withdraw consent to our collection and sharing of your consumer health data.
• Delete your consumer health data. When you ask, we delete it from our records, including archived and backup systems on our normal restoration cycle, and we notify the processors and third parties listed in Section 6 so they can delete it as well.
• Be free from discrimination for exercising any of these rights. We will not deny you goods or services, charge you a different price, or give you a lower quality of service.

How to exercise these rights

Email privacy@rxhero.com with “Consumer Health Data Request” in the subject line, or call +1 (307) 218-4388. You may also write to us at BLOOM PROCESSING LLC, 30 N Gould St, STE #53088, Sheridan, WY 82801, USA.

We will verify your request — usually by confirming control of the email address we hold — and respond within 45 days of receipt. We may extend that period by a further 45 days when reasonably necessary, and we will tell you within the first 45 days if we do, along with the reason. An authorized agent may act on your behalf with proof of authorization.

Requests about medical records created during your intake — your medical history, prescriptions, clinician notes — should go to the treating provider organization or pharmacy that holds them, because we do not. Contact us at privacy@rxhero.com and we will direct you to the right entity.

Appeals

If we decline your request, our response will explain why and how to appeal. To appeal, reply to that response or email privacy@rxhero.com with “Consumer Health Data Appeal” in the subject line. We will decide the appeal and explain our reasoning in writing within 45 days. If we deny the appeal, you may submit a complaint to the Washington State Attorney General at atg.wa.gov/file-complaint or, for Nevada residents, to the Nevada Attorney General’s Bureau of Consumer Protection.

9. How we protect consumer health data

We restrict access to consumer health data to the personnel and processors who need it to provide the service, on a least-privilege basis. We encrypt it in transit, log access, and keep the amount we hold deliberately small. Our processors are bound by written contracts that limit them to processing on our instructions. The full compliance program is described in Section 9 of our Privacy Policy.

10. Changes to this policy

We will post any updated version here with a new effective date. We will not collect, use, or share consumer health data in a way that is materially different from what this policy said at the time we collected it, unless you consent.

11. Contact

BLOOM PROCESSING LLC
30 N Gould St, STE #53088, Sheridan, WY 82801, USA
+1 (307) 218-4388 · privacy@rxhero.com