GetClinic Consumer Health Data Privacy Policy

1. Scope and Who We Are

GetClinic, Inc. (“GetClinic,” “we,” “us,” or “our”) operates an international healthcare marketplace. This Consumer Health Data Privacy Policy applies to consumer health data that GetClinic collects, uses, shares or otherwise processes through its Patient-facing websites, mobile applications, marketplace, messaging, document-upload, consultation, Booking, payment-support and related services, to the extent a U.S. consumer-health-data law applies.

This policy is designed to address the Washington My Health My Data Act (“MHMDA”) and similar U.S. consumer-health-data laws where applicable. It does not replace a Clinic’s independent healthcare privacy notice or medical-record obligations. A Clinic you choose may independently process health information for healthcare purposes under its own legal obligations.

For broader information about account data, payments, cookies, international transfers, security, California privacy rights and other personal information, see the GetClinic Patient Privacy Policy.

2. What “Consumer Health Data” Means

“Consumer health data” means personal information that is linked or reasonably linkable to a consumer and that identifies or reveals the consumer’s past, present or future physical or mental health status, including health information that can be inferred from marketplace activity. The exact statutory definition varies by law; this policy uses the term broadly enough to cover health-service requests, medical information, health-related inferences and similar protected information where applicable.

A procedure search, Clinic selection, consultation request, Booking, or medical-travel destination can itself reveal or permit an inference about a person’s health. We treat those signals as sensitive when consumer-health-data law applies.

3. Categories of Consumer Health Data, Purposes and Sources

We do not collect, use or share an additional category of consumer health data, or use consumer health data for an additional purpose, where applicable law requires prior disclosure and affirmative consent, without first providing that disclosure and obtaining the required consent.

4. Pre-Engagement Data Minimization

Before you select or affirmatively engage a Clinic, GetClinic limits request-level sharing to what is reasonably necessary to route the request or determine whether a Clinic may be able to help. Where reasonably practicable, pre-engagement request information is de-identified or pseudonymized and excludes direct identifiers such as your full name, personal contact details, account credentials and complete medical file.

Identifying details and identifiable health information are transmitted only after you choose or engage a Clinic, when necessary to provide the product or service you requested, or where another lawful basis permits the disclosure.

5. When We Collect or Share Consumer Health Data

Where the MHMDA or a similar law applies, GetClinic collects consumer health data only with the required consent for a specified purpose or to the extent necessary to provide a product or service that you requested. Where a separate consent is legally required for sharing, the sharing consent is separate and distinct from collection consent unless a statutory exception applies.

A consent request will describe the categories of consumer health data involved, the purpose and specific uses, the categories of entities receiving the data, and how you can withdraw consent, to the extent required by applicable law.

Acceptance of the GetClinic Patient Terms or general Privacy Policy is not treated as blanket consent to collect or disclose health information for unrelated purposes.

6. Categories of Consumer Health Data We Share

• Treatment interests, requested procedures and other request-level health information needed to respond to the Patient’s chosen marketplace interaction;
• health history, symptoms, medications, allergies, tests, medical images and documents where needed for a selected Clinic to evaluate or consult with the Patient;
• consultation, appointment, Booking and Medical Approval Status information;
• health-related transaction or refund information where necessary for legitimate payment, fraud, security or dispute handling; and
• health-related support or security information where necessary to resolve a Patient request, protect the platform or comply with law.

We do not disclose a Patient’s complete medical file to every Clinic merely because the Patient uses GetClinic.

7. Categories of Third Parties and Specific Affiliates

We do not permit a processor acting for GetClinic to process consumer health data in a manner inconsistent with this policy. Service-provider contracts must restrict processing to authorized purposes and require appropriate confidentiality and security safeguards.

8. No Sale of Consumer Health Data

GetClinic does not sell consumer health data.

If GetClinic ever proposes a transaction that applicable consumer-health-data law defines as a sale requiring a separate signed authorization, GetClinic will not conduct that sale without the legally required authorization. Any such authorization must be separate from collection/sharing consent and may not be made a condition of obtaining GetClinic goods or services where law prohibits that condition.

9. No Targeted Advertising or Healthcare Geofencing

GetClinic does not use consumer health data, private medical uploads or private Patient-Clinic messages for targeted advertising or cross-context behavioral advertising.

GetClinic does not use a geofence around an entity that provides in-person healthcare services to identify or track a consumer seeking healthcare, collect consumer health data from that consumer, or send health-related messages or advertisements where such geofencing is prohibited by applicable law.

10. Your Consumer Health Data Rights

Where applicable consumer-health-data law provides these rights, you may:

• confirm whether GetClinic is collecting, sharing or selling consumer health data concerning you;
• access your consumer health data;
• obtain a list of third parties and affiliates with whom GetClinic has shared or sold your consumer health data, together with the contact mechanism required by applicable law;
• withdraw consent from future collection or sharing where consent is the basis for the processing;

• request deletion of consumer health data concerning you; and
• appeal a refusal to act on a request where applicable law provides an appeal right.

You do not need to create a new GetClinic account solely to submit a consumer-health-data request. If you already have an account, GetClinic may ask you to use it where appropriate to securely authenticate the request.

11. Deletion Requests

Where the MHMDA applies and you submit an authenticated deletion request, GetClinic will delete covered consumer health data from its records, subject to statutory exceptions, and will notify affiliates, processors, contractors and other third parties with whom the covered consumer health data was shared so they can honor the deletion request as required by law.

If covered consumer health data is stored in archived or backup systems, deletion may be delayed until those systems are restored or cycled, but where the MHMDA applies the delay will not exceed six months from authentication of the deletion request.

A deletion request to GetClinic does not necessarily require an independent Clinic to delete a medical record that the Clinic is legally required to retain under healthcare law. Where consumer-health-data law requires GetClinic to notify that Clinic of the deletion request, GetClinic will do so; the Clinic remains responsible for determining any independent legal retention obligation.

12. How to Submit a Request or Appeal

Submit a consumer health data request or appeal by emailing [email protected] or through any secure in-product privacy request method that GetClinic publishes. We may request information reasonably necessary to authenticate your identity and authority.

Where the MHMDA applies, GetClinic will respond without undue delay and in all cases within 45 days of receiving the request. We may extend the response once by up to 45 additional days when reasonably necessary because of complexity or the number of requests, and will notify you of the extension and reason within the initial response period.

Where the MHMDA applies, requests are free of charge up to twice annually per consumer, subject to the statute’s rules for manifestly unfounded, excessive or repetitive requests.

If GetClinic refuses to act on a request and an appeal right applies, you may appeal through [email protected] or the designated in-product method. We will respond to an MHMDA appeal within 45 days. If the appeal is denied, we will provide the required method for contacting the relevant attorney general or regulator.

13. Security

GetClinic uses administrative, technical and organizational measures designed to protect consumer health data against unauthorized access, acquisition, use, disclosure, alteration and loss. Measures may include encryption in transit and at rest, role-based access, authentication, logging and monitoring, secure development, vulnerability management, backups, vendor due diligence and incident-response procedures, depending on the system and risk.

Consumer health data should be accessible only to personnel and contracted providers with a legitimate need to perform their authorized role.

14. Health-Data Breach Notification

Where a qualifying breach triggers notification duties, GetClinic will notify affected consumers and authorities as required by applicable law. Where GetClinic is subject to the U.S. Federal Trade Commission Health Breach Notification Rule (16 C.F.R. Part 318), GetClinic will follow the Rule’s applicable requirements for qualifying breaches of unsecured PHR identifiable health information.

15. Changes to Consumer Health Data Practices

GetClinic may update this policy when law, product functionality, data flows or vendors change. However, where applicable consumer-health-data law requires prior disclosure and affirmative consent before collecting, using or sharing an additional category of consumer health data or using consumer health data for an additional purpose, GetClinic will provide the required disclosure and obtain that consent before the new collection, use or sharing occurs.

A policy update is not retroactive permission for a materially different health-data use where fresh consent or authorization is legally required.

16. Relationship With the General Patient Privacy Policy

This policy supplements the GetClinic Patient Privacy Policy. The general policy explains broader matters such as account information, legal bases under the EU/UK GDPR, international transfers, cookies, California privacy rights, retention and other personal-data practices. For consumer health data covered by a mandatory U.S. consumer-health-data law, this policy controls to the extent that law requires a more specific rule.

17. Contact Information

18. Publication and Homepage Link

Where applicable law requires a distinct and conspicuous link to this Consumer Health Data Privacy Policy, GetClinic will publish this policy through that separate link and prominently link it from the GetClinic homepage as required.

Your health data should follow your choices - not travel farther than necessary.