Consumer Health Data Privacy Policy

# Consumer Health Data Privacy Policy *Draft for attorney review. Effective \[Effective Date\]. Version 1. Written to meet Washington's My Health My Data Act and similar state consumer health data laws (such as Nevada's and Connecticut's), applied to everyone.* Some stories include information about a person's physical or mental health, addiction or recovery. This policy explains how that "consumer health data" is handled in Impact Story. It adds to our Privacy Policy. ## Who is responsible The organization that invited you decides how your story is used. \[Company LLC Name\] ("we") processes it for them as a service provider. Both follow this policy. ## What health data we collect - Health, addiction, recovery or mental-health information you choose to mention in your recording or typed answers, and in the transcript made from it. - Health-related details visible in photos you upload, if any. - The fact that you checked the health consent boxes. We don't collect health data from other sources, track your location, or set up geofences around health care facilities. ## Why we collect it Only to make, review and publish the story you chose to share, in the ways you agreed to, and to carry out your later choices to narrow, withdraw or delete it. ## Consent - **To collect and use:** your story is processed with health information only after you check a separate box agreeing to it. - **To share:** your story is published or shared with health information only after you check a second, separate box agreeing to share it in the places you chose. - **Never shared with a parent network,** and never sold. - You can withdraw either consent anytime with your "Manage my story" link or at privacy@impactstoryapp.com. ## Who receives it | Recipient | Why | | --- | --- | | The organization that invited you | To review and use your story as you agreed | | The public, through the channels you agreed to | Publishing your story | | Our service providers (listed in the Data Processing Agreement: hosting, storage, transcription, AI processing, rendering) | To make the video, under contracts that bar any other use | ## Your rights You can: - Confirm whether we or the organization have your health data, see it, and get a list of everyone it was shared with, including their email or website. - Withdraw your consent to collection or sharing. - Have it deleted, including from our service providers and backups (backups roll off within 35 days). - Appeal if a request is denied, and contact the Washington Attorney General or your state's attorney general if the appeal is denied. We respond within 45 days, and may extend once by another 45 days if needed, with notice. We won't treat you differently for using these rights. **How to ask:** use your "Manage my story" link, email privacy@impactstoryapp.com, or write to \[Company LLC Name\], \[Mailing Address\]. ## Security and access Access to health data is limited to people who need it to make and review your story, protected as described in our Privacy Policy and Data Processing Agreement.