Health Data Notice

February 11, 2025

This Consumer Health Data Privacy Notice (“CHD Notice“) supplements our Consumer Canvas, LLC (“Consumer Canvas” “we,” “our,” or “us”) Privacy Notice (“Privacy Notice”) and applies to “consumer health data” (“CHD”), as defined by the Washington State My Health My Data Act (WMHMDA), Nevada’s Consumer Health Data Privacy Law, and other similar U.S. state health data privacy laws (collectively, “health data privacy laws”). Where there are differences between this CHD Notice and our Privacy Notice, this CHD Notice governs.

Consumer Health Data We May Collect

As described in our Privacy Notice we do not collect Personal Information directly from consumers, and most of our records contain only pseudonymized information, which is not linked to your identifying information (such as your name, phone number, or email address).

Instead, we use advanced mathematical methods to process and organize lots of information into a single, refined version of that data – our Data Products – that are based on information collected and provided by our data provider partners. This Personal Information, which may include CHD, varies and depends, among other things, on the context of your interactions with our data provider partners, products and features you use that are of interest to our business clients, and applicable law. Some of the categories of data we obtain could be considered CHD under the health data privacy laws.

Below are examples of the categories of data we obtain from our data provider partners that could be deemed CHD:

Information about your health-related conditions, symptoms, status, diagnoses, procedures, testing, medications, or treatments for which you authorize companies like ours to obtain and process. For instance, if this information is linked to a product you buy, you might share your feedback with our data provider partners as a survey participant, detailing your preferred brands.

Information that could be related to reproductive or sexual health, such as your purchase history of over-the-counter medications and vitamins or behavioral data such as exercise routines and diets

Information that could identify your attempt to seek health care services or information, including services that allow you to assess, measure, improve, or learn about your or another person’s health. For example, your browsing history, search history, and information regarding your interaction with mobile apps, websites, or ads you’re likely to be interested in.

Information that could associate you with a category of CHD that is derived or extrapolated from information such as when our data models (the framework in how we organize data) use the information detailed above to infer, examine, and make predictions that may reflect an individual’s preferences, characteristics, trends, behaviors, and actions. For example, if your transactions indicate you reside in a particular general geographic area, our systems might associate you with certain health-related conditions prevalent in that area based on census or demographic data, such as skin cancers in regions closer to the equator.

Sources of Consumer Health Data

We collect Personal Information considered CHD from our data provider partners. We do not collect Personal Information considered CHD directly from consumers.

Why We Collect and Use Consumer Health Data

We collect and use Personal Information for the purposes described in our Privacy Notice. More specifically, we collect and use information that could be considered CHD:

To perform the functions of our services requested or authorized by our business clients, which include advertisers, consumer brands, media companies, and data brokers, including data aggregators, data compilers, and data originators.

To develop and improve our Data Products.

As reasonably necessary to operate our business. This may include delivering and operating our Data Products; ensuring the secure and reliable operation of the systems that support our Data Products; troubleshooting our data models; and other essential business operations that support the provision of our services.

Consumer Health Data We Share

We may share each of the categories of CHD described above for the following purposes:

To the extent necessary to provide our Data Products to our business clients, which include advertisers, consumer brands, media companies, and data brokers, including data aggregators, data compilers, and data originators.

If we are involved in a merger, asset sale, financing, corporate divesture, reorganization, or acquisition of all or some portion of our business to another company or if we undergo liquidation or bankruptcy proceedings, we may disclose your information in connection with such transaction or proceeding before and or after the transaction closes or the proceedings are completed.

We may disclose data when we believe that doing so is necessary to comply with applicable law or respond to valid legal process, or when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss in connection with an investigation of suspected or actual illegal activity, or if necessary to protect the vital interests of another individual.

Third Parties with Whom We Share Consumer Health Data

As necessary for the purposes described in the section “Consumer Health Data We Share,” we disclose information that could be considered CHD with the following categories of third parties:

Affiliates. We enable access to data across our subsidiaries, affiliates, and related companies, for example, where we utilize common data systems or where access helps us to provide our services and operate our business.

Government, regulatory, and public authorities. As described in our Privacy Notice, we disclose data to law enforcement or other government agencies when we believe doing so is necessary to comply with applicable law or respond to valid legal process.

Parties to a corporate transaction. We may disclose information that might be considered CHD as part of a corporate transaction or proceeding such as a merger, financing, acquisition, bankruptcy, dissolution, or a transfer, divestiture, or sale of all or a portion of our business or assets.

Other third parties. In certain circumstances, it may be necessary to provide data to other third parties, for example, to comply with the law or to protect our rights or those of our customers. To the extent we share your CHD with other third parties, we will do so in accordance with health data privacy laws.

With the assistance of our affiliates and other trusted business partners, we undertake a process that is designed to obscure or replace your directly identifiable Personal Information with a unique identifier. We may further combine or aggregate this information with other information available to us or our data provider partners, and once the information is processed, we use this processed information as part of our Data Products.

Privacy Rights and Choices

If you are a consumer under the health data privacy laws and we collect, use, or share CHD, you may have the following rights with respect to your CHD, subject to applicable exceptions.

Right to access. You have the right to confirm whether we are processing your CHD and to access such CHD.

Right to delete. You have the right to ask us to delete certain CHD we have collected about you.

Right to withdraw consent. If you consent to any collection or sharing of CHD, you have the right to withdraw your consent at any time.

You can request to exercise such rights using the methods described in the “Privacy Rights and Choices” section of our Privacy Notice, including through our webform, also located in the footer of our website, or by emailing us at privacy@consumercanvas.net with the subject line “Your Privacy Choices.” Consumer Canvas belongs to the group of companies listed here.

If your request to exercise a right under the health data privacy laws is denied, you may appeal that decision by emailing us at privacy@consumercanvas.net with the subject line “Privacy Rights Appeal”. If your appeal is unsuccessful, you can raise a concern or file a complaint with the Washington State Attorney General at www.atg.wa.gov/file-complaint.