If you are in Washington State, or another US state with a comparable consumer-health-data law, a separate policy applies to your health information. The Consumer Health Data Privacy Policy is deliberately a distinct document from the general Patient Privacy Policy, and where Washington's My Health My Data Act or a similar law applies it provides the specific disclosures and rights for that data.
What counts as consumer health data
The policy defines it as personal information linked or reasonably linkable to you that identifies or reveals your past, present or future physical or mental health status, including health information that can be inferred from marketplace activity.
The second half of that sentence is the part people miss. Section 2 says a procedure search, clinic selection, consultation request, booking or medical-travel destination can itself reveal or permit an inference about your health, and that GetClinic treats those signals as sensitive where consumer-health-data law applies. Searching for a treatment is health data, even before you tell anyone anything about yourself.
Section 4 applies minimisation before you engage anyone: pre-engagement request information is de-identified or pseudonymised where reasonably practicable, and identifying details are transmitted only after you choose or engage a clinic.
See progressive disclosure explained.
Your six rights
Where an applicable consumer-health-data law provides them, Section 10 lets you:
- confirm whether GetClinic is collecting, sharing or selling consumer health data about you
- access that data
- obtain a list of the third parties and affiliates it has been shared or sold to, with the contact mechanism the law requires
- withdraw consent to future collection or sharing where consent is the basis for the processing
- request deletion
- appeal a refusal, where an appeal right applies
You do not need to create a new GetClinic account to submit a request. If you already have one, GetClinic may ask you to use it to authenticate securely.
Who receives it, and who does not
Section 7 lists the recipient categories: clinics you select or engage, cloud and infrastructure providers, communications and video providers, customer-support providers, security and fraud providers, payment service providers, and professional advisers or legal recipients.
The same section answers the affiliate question with a single word. Specific affiliates: None. No GetClinic affiliate receives consumer health data, and if that changes the policy is updated and any legally required consent or authorisation obtained before the affiliate receives anything.
Two prohibitions sit alongside that. Section 8 states GetClinic does not sell consumer health data, and that any transaction the law defines as a sale would need the separate signed authorisation the statute prescribes. Section 9 states GetClinic does not use consumer health data, private medical uploads or private patient-clinic messages for targeted or cross-context behavioural advertising, and does not use a geofence around a place providing in-person healthcare to identify or track someone seeking care.
Deletion, propagation and the six-month backup cap
Where the MHMDA applies and you submit an authenticated deletion request, GetClinic deletes covered data from its records, subject to statutory exceptions, and notifies the affiliates, processors, contractors and other third parties it was shared with so they can honour the request.
Archived and backup systems get a limited extension, not an exemption. Deletion may be delayed until those systems are restored or cycled, but Section 11 caps the delay at six months from authentication of the deletion request.
A deletion request to GetClinic does not require an independent clinic to delete a medical record it is legally required to retain under healthcare law. Where the law requires GetClinic to notify that clinic, it does; the clinic decides its own retention obligation.
Deadlines, cost and appeals
Send a request or an appeal to [email protected], or use a secure in-product privacy request method where one is published.
Section 14 adds one further commitment: where a qualifying breach triggers notification duties, GetClinic notifies affected consumers and authorities as required, and where the US Federal Trade Commission Health Breach Notification Rule (16 CFR Part 318) applies, it follows that Rule for qualifying breaches.
GetClinic is a technology marketplace. The clinic you choose provides your healthcare and is responsible for it. This is general information about how GetClinic works, not medical advice.
See the full Consumer Health Data Privacy Policy. See how to submit any privacy request.