Consumer Health Data Privacy Policy

Scope of this policy

This policy applies specifically to consumer health data and supplements our Privacy Policy. Where the two differ with respect to health data, this policy controls.

It is provided under Washington’s My Health My Data Act and Nevada’s SB 370. The rights described below are those the law provides to residents of those states.

Eterna IQ LLC is a health technology company, not a healthcare provider. Clinical services are delivered by independent licensed clinicians and partners who maintain their own records and privacy practices.

Categories of consumer health data we collect

We collect the following, and only in connection with a service you asked for:

Health assessment responses: goals, symptoms you choose to report, sleep, energy, recovery, and lifestyle answers.
Assessment outputs: your score, score band, primary focus area, and the segment we use to tailor what we send you.
Demographics relevant to eligibility and care: date of birth and state of residence.
Clinical intake responses you submit when requesting treatment, including medical history, current medications, and shipping address.
Treatment and order status: whether a request is under review, approved, being prepared, shipped, or declined.
Appointment and care information displayed to you in your member dashboard, including lab results and care plans.
Account identifiers that connect you across our partners: your email address and the record identifiers each partner assigns you.

Where it comes from

There are only two sources. We do not buy consumer health data, and we do not infer health status from your browsing behavior or from data brokers.

Directly from you, when you complete an assessment, intake, profile, or booking.
From your clinical partners, when results, care plans, appointments, or order status are returned to us for display.

Why we collect it, and how it is used

We do not use consumer health data to build advertising audiences, to target advertising to you, or to measure advertising performance. See the section below.

To produce and show you your assessment results.
To determine whether a treatment you requested is appropriate to send to a licensed provider for review.
To pass your intake to the prescribing partner who reviews it.
To display your own clinical record back to you in your member dashboard.
To send you communications about your care and, where you have opted in, education and offers relevant to your stated focus area.
To operate, secure, and debug the platform, and to meet legal obligations.

What we store, and what we only display

Much of your health information is held by our clinical partners rather than by us. Our platform is generally designed to display it rather than to keep its own copy.

Your clinical intake responses are passed through to the prescribing partner rather than written to our database. Your lab results, care plan, documents, and order status are requested from our clinical partners when you open the relevant page and shown to you, rather than stored by us.

What we do store is your assessment responses and results, together with the contact, eligibility, and account identifier details described above.

Who we share it with

We share consumer health data only with the categories of recipients listed here, and only as needed to deliver what you asked for:

Clinical record platform: maintains your chart, care plan, lab results, documents, and appointments.
Prescribing and pharmacy partner: reviews your intake, makes the prescribing decision, dispenses and ships, and bills you directly for medication.
Diagnostics partner: performs lab testing and returns results to your clinical record.
Customer relationship platform: receives your contact details, date of birth, assessment score, score band, primary focus area, and lifecycle status, so that the emails and messages you receive relate to what you actually told us. It does not receive your lab values, diagnoses, clinical notes, medications, or intake responses.
Infrastructure providers that host our application and database, under contractual confidentiality and security obligations.
Payment processors, which receive billing information but no health data.
Professional advisors under confidentiality duties, and authorities where required by law.

We do not share consumer health data with advertising platforms

We do not sell consumer health data. We do not share it with advertising or social media platforms, and we do not use it for cross-context behavioral advertising.

Analytics, session recording, and advertising tools are disabled on our health assessment, our treatment store, our member dashboard, and our member portal domain.

On our general marketing pages, which do not collect or display health information, we use ordinary advertising measurement to understand which campaigns work. Those events carry contact and purchase information, not health data.

How long we keep it

We retain consumer health data for no longer than needed for the purposes described above, and for these periods:

Assessment responses, results, and the contact details captured with them: up to 24 months from your last activity.
Account identifier records linking you to our partners: for the life of your membership, and afterwards for as long as needed to respond to questions about access to your information.
Records of access to health information: up to six years.
Payment records: up to seven years, for tax and accounting purposes. These contain no health data.
Clinical records held by our partners: governed by their retention policies and by medical record retention law, which we do not control.

Your rights

If you are a Washington or Nevada resident, the law gives you the following rights as to consumer health data:

Confirm whether we collect, share, or sell your consumer health data, and access it.
Obtain a list of all third parties with whom we have shared your consumer health data, along with contact information for each.
Withdraw your consent to our collection and sharing of your consumer health data.
Request deletion of your consumer health data. Where we have shared it, we will notify the recipients of your request.
Appeal a refusal. If we decline a request, we will tell you why and how to appeal, and if we deny the appeal we will tell you how to complain to your state Attorney General.

How to exercise these rights

Email support@eternaiq.com with the request you are making. We will verify your identity before acting on it.

We will respond within the period the applicable law allows, currently 45 days, and where the law permits an extension we will tell you before taking it and explain why.

Clinical records held by your treating partners generally cannot be deleted on request, because medical record retention is required by law. A deletion request will cover the consumer health data we hold and will be forwarded to the partners we have shared it with, but their own legal retention obligations govern what they do with it. We would rather say that here than imply a deletion we are not able to deliver.

You may use an authorized agent. We will ask for proof of their authority.

Geofencing

We do not operate geofences around healthcare facilities, and we do not use location data to identify people near them, to advertise to them, or to collect health data from them. This practice is prohibited by law and we have no exception to it.

How it is protected

We use administrative, technical, and organizational safeguards designed to protect consumer health data. These include encryption in transit, limiting access to the people and systems that need it to run the service, and logging access to health information through our platform.

No system is perfectly secure, and we will not claim otherwise. If consumer health data is disclosed without authorization, we will notify affected people as required by applicable law.

Contact

Questions, requests, or complaints about consumer health data: support@eternaiq.com.

Eterna IQ LLC