Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy explains how Infohealth Ltd, trading as NowPatient, collects, uses, shares and protects “consumer health data” as defined in the Washington My Health My Data Act, Nevada Senate Bill 370, the Connecticut Data Privacy Act and similar state laws (together, “Consumer Health Data Laws”).

It applies to consumers who live in those states, and to anyone whose consumer health data is collected in those states. It supplements our Privacy Policy. If the two conflict, this policy controls for consumer health data.

Infohealth Ltd is a company registered in England and Wales (company number 04004930) whose address is 28 Chipstead Valley Road, Coulsdon, Surrey, CR5 2RA, United Kingdom (“Infohealth”, “NowPatient”, “we”, “us” or “our”). We operate the NowPatient US website at http://nowpatient.com and related services (the “Services”).

Your care may be provided by independent US-licensed clinicians through National Health Rx LLC (the “Medical Group”) with medicines dispensed by licensed US pharmacies (“US Partner Pharmacies”), or by UK-registered prescribers with medicines dispensed by a GPhC-registered pharmacy in the United Kingdom, which may be operated by Infohealth (a “UK Pharmacy”). “Provider” means the clinician who assesses you and “Pharmacies” means US Partner Pharmacies and UK Pharmacies.

This policy does not cover protected health information that is held by the Medical Group or a US Partner Pharmacy and governed by HIPAA. That information is covered by their Notice of Privacy Practices.

Consumer health data is personal information that is linked or reasonably linkable to you and that identifies your past, present or future physical or mental health status. It can include information that is not obviously medical, such as purchases of health products or inferences drawn from your use of a health website.

• Health conditions, symptoms, diagnoses and medical history.
• Current and past medicines, treatments, allergies and health-related procedures.
• Body measurements and vital signs, such as weight, height, BMI and blood pressure.
• Information about the specific conditions you seek treatment for, which may include sexual and reproductive health, mental health, weight management and long-term conditions.
• Photos you upload for clinical review.
• Information that identifies you as seeking health care services, such as the treatment pages you visit, products you add to your cart and the treatments you buy.
• Inferences about your health derived from the above.
• Approximate location, where it could indicate an attempt to obtain health care services.

We do not collect precise geolocation, genetic data or biometric data for identification. Where a selfie is used for identity verification, it is processed by our verification provider only to confirm your identity and is not used to create a biometric template held by us.

• Directly from you, for example when you complete a questionnaire, upload photos, message your care team or buy a treatment.
• Automatically, through cookies and similar technologies when you use the Services (see Section 6).
• From your Provider, the Medical Group and Pharmacies, such as prescription and shipping status.
• From service providers that help us run the Services.

We collect and use consumer health data, with your consent where required, to:

• provide the Services you request, including enabling a Provider to assess you and, where appropriate, prescribe treatment, and enabling a Pharmacy to dispense it;
• manage your account, orders, subscriptions and refills;
• communicate with you about your care, orders and account;
• provide customer support;
• maintain the safety, security and integrity of the Services and prevent fraud;
• improve the Services, using de-identified data wherever possible;
• support your Provider with technology tools, including AI tools that help organize information and draft clinical notes for your Provider to review; and
• comply with our legal and regulatory obligations.

We will ask for your separate consent before collecting or sharing consumer health data for any purpose other than providing the Services you have requested. This includes using your identifiable health information for research or to train AI models. That consent is optional, and you can withdraw it at any time without affecting your care.

Infohealth is based in the United Kingdom. Your consumer health data may be processed and stored in the United States and the United Kingdom, including by a UK Pharmacy where your medicine is dispensed in the UK. We protect it with the same safeguards wherever it is processed.

We do not use consumer health data for targeted advertising, and we do not share it with advertising partners, unless you have given your separate, express consent. We do not place advertising pixels on pages where you complete a medical questionnaire, upload photos or view your care.

You can withdraw consent and opt out of targeted advertising at any time through Your Privacy Choices.

We share consumer health data only:

• with your Provider, the Medical Group and Pharmacies, to deliver your care;
• with processors that act on our behalf under a written contract, such as hosting, customer support, identity verification, payment, shipping and communication providers;
• with affiliates under common ownership or control with Infohealth, where needed to provide the Services;
• where required by law, regulation or valid legal process, or to protect the safety of you or others;
• in connection with a merger, acquisition or sale of assets, subject to this policy; and
• with any other third party, only with your separate consent.

We do not sell consumer health data. We will not sell your consumer health data without your valid written authorization, as required by law.

We do not use geofences around health care facilities to identify or track consumers, collect consumer health data or send notifications.

Under Consumer Health Data Laws, you have the right to:

• Confirm and access: confirm whether we collect, share or sell your consumer health data, and access that data.
• See who received it: receive a list of all third parties and affiliates with whom we have shared or sold your consumer health data, and an active email address or other online contact for each.
• Withdraw consent: withdraw your consent to our collection and sharing of your consumer health data.
• Delete: have your consumer health data deleted, including from our archives and backups and by our processors and third parties to whom we disclosed it, subject to legal exceptions.
• Non-discrimination: not be treated differently for exercising these rights.

Deleting your data or withdrawing consent may mean we can no longer provide the Services to you. Your Provider and Pharmacy may need to keep medical and pharmacy records for the periods required by law.

Email dpo@nowpatient.com with the subject line “Consumer health data request”, your name, the email address linked to your account, your state and the right you wish to exercise. We will verify your identity before acting on your request, usually by matching information you give us with information we already hold.

We will respond within 45 days of receiving your request. If reasonably necessary, we may extend this by a further 45 days and will tell you why. Requests are free of charge, up to twice in any 12-month period. We may refuse requests that are manifestly unfounded, excessive or repetitive.

You may use an authorized agent to make a request on your behalf. We may ask for proof that the agent is authorized and ask you to verify your identity directly.

If we decline your request, you may appeal by replying to our decision or emailing dpo@nowpatient.com with the subject line “Consumer health data appeal” within 45 days. We will respond in writing within 45 days, explaining the outcome and our reasons. If your appeal is denied, you can contact your state Attorney General. Washington residents can contact the Washington State Attorney General at http://www.atg.wa.gov/file-complaint.

We protect consumer health data with appropriate administrative, technical and physical safeguards, and limit access to staff and processors who need it. We keep consumer health data only as long as needed for the purposes in Section 5 or as required by law, then delete or de-identify it securely.

We may update this policy from time to time. If we make material changes, including any new purpose for collecting or sharing consumer health data, we will tell you before the change takes effect and ask for your consent where required.

Infohealth Ltd d.b.a NowPatient, 8911 North Capital of Texas Highway Suite 4200 #1263 Austin, TX 78759 United States.

Data Protection Officer: dpo@nowpatient.com