Consumer Health Data Privacy Policy

1. Data categories and purposes

Consumer health data is personal information linked or reasonably linkable to an individual that identifies past, present, or future physical or mental health status. Depending on your use of the Service and the protections that apply, it can include:

• Your health-related requests, treatment interests, or information you voluntarily include in a general support inquiry
• Information about an order, medication, laboratory service, or an attempt to obtain a health-related service, when not exempt under another law
• Contact or account identifiers associated with the health-related information above
• Technical request data, including IP address, device information, timestamps, and requested treatment-page URLs, where that data is linked to an identifiable person seeking health-related services

We process these categories to provide the website or service you request, respond to support and privacy requests, administer an order or account, and protect the security and reliability of the Service. We do not use them for targeted advertising, unrelated profiling, or decisions about your clinical eligibility. We do not collect precise location through the public website or use geofencing around healthcare facilities.

2. Sources of data

• Directly from you, when you contact us or choose to use a hosted account or service
• From the hosted clinical platform, Medical Group, Providers, pharmacies, laboratories, or payment and account service providers, where necessary for a service you requested and where the information is not exempt from the applicable consumer-health law
• From technical requests made by your device to our hosting and security providers when delivering the website

The public website has no health-history or payment form. Its product search and filters stay in your browser. Optional advertising pixels, retargeting, cross-site analytics, and session-replay scripts are not deployed on the public website.

3. Data disclosures and recipients

Where needed for the disclosed purposes and permitted by applicable law, the categories in Section 1 may be disclosed to:

• Hosting, security, support, communications, and account-service processors acting on our behalf
• The hosted clinical platform, independent Medical Group and Providers, licensed pharmacies, laboratories, and payment providers, to the extent necessary for the product or service you requested or separately authorized

We do not sell consumer health data, disclose it to advertising networks, or share it with corporate affiliates. We do not allow these disclosures to become permission for unrelated marketing. We do not deploy third-party tools that collect consumer health data over time and across unrelated websites for advertising.

Information required by law or valid legal process is handled under the applicable legal requirements. We limit access to people and processors who need it for the disclosed purpose and apply appropriate safeguards.

4. Consent and withdrawal

We collect or share covered consumer health data only with the consent required by applicable law, to the extent necessary to provide a product or service you request, or where otherwise permitted or required by that law. When consent is required, a collection request identifies the categories and purpose; a sharing request identifies the categories, purpose, and recipients and is separate from collection consent.

You may withdraw consent for future collection or sharing by contacting support@purvuehealth.com. Accepting website Terms and Conditions, dismissing a notice, or browsing a page is not treated as the separate consent required for consumer health data. Withdrawing consent may affect a service that depends on the information, but we do not unlawfully discriminate because you exercise a privacy right.

5. Requests, deletion, and correction

Where the applicable law grants these rights, you can request confirmation of whether we collect, share, or sell your consumer health data; access to the data and a list of relevant third parties or affiliates, with contact information where required; withdrawal of consent or cessation of collection or sharing; deletion; and review or correction of inaccurate information.

Email support@purvuehealth.com with the subject "Consumer health data request," call (617) 893-0460, or write to our mailing address below. Describe the request without sending medical records or full payment details. You do not need to create a new account. We may authenticate the request using information reasonably necessary to identify you or your authorized agent.

For Washington requests, we respond without undue delay and within 45 days of receipt, with one additional 45-day period only when permitted and explained during the initial period. For Nevada requests, the general response period is 45 days after authentication, with a permitted 45-day extension; Nevada deletion requests are handled within 30 days after authentication, subject to applicable exceptions.

Deletion includes notifying recipients where required. We address archived or backup data within the applicable statutory limits. Requests are generally handled without charge; any exception is limited to what the applicable law permits, and we explain it. PHI and other exempt records are handled under the law and notice that govern those records.

6. Appeals and complaints

If we decline a request, you can appeal by replying to our decision or emailing support@purvuehealth.com with the subject "Consumer health data appeal." Explain which decision you are appealing and why. We provide a written appeal response and reasons within 45 days of receiving the appeal, as required by applicable Washington or Nevada law.

If an appeal is denied, you can contact the relevant Attorney General. Washington complaint information is available at https://www.atg.wa.gov/file-complaint. Nevada complaint information is available at https://ag.nv.gov/Complaints/CSU_Complaints___FAQ/.

7. Changes to this policy

We post updates with a new "Last updated" date and provide additional notice of material changes where required, including by email or through the Service. Before collecting, sharing, or using additional categories for a new purpose requiring consent, we disclose the change and obtain the required affirmative consent. A policy update alone does not provide that consent.

8. Contact us