MEDVROOM CONSUMER HEALTH DATA PRIVACY POLICY

This Consumer Health Data Privacy Policy supplements our main Privacy Policy and applies specifically to “Consumer Health Data” as defined under applicable state laws, including (but not limited to):

• Washington My Health My Data Act
• Connecticut Data Privacy Act (as it relates to health data)
• Nevada Consumer Health Data Privacy Law
• Any similar future state consumer health privacy laws

1. WHAT IS CONSUMER HEALTH DATA?

It includes information that relates to your past, present, or future physical or mental health, health conditions, treatments, or similar health-related details collected through the Platform (e.g., appointment details or limited reason-for-visit descriptions).

2. OUR PRACTICES REGARDING CONSUMER HEALTH DATA

• We collect and process Consumer Health Data only as strictly necessary to provide booking, scheduling, and platform services.
• We do not sell Consumer Health Data.
• We do not use it for targeted advertising or unrelated purposes.
• We require signed Business Associate Agreements (BAAs) with Providers before sharing any Protected Health Information.
• We apply heightened security and access controls to this data.

3. YOUR RIGHTS

Depending on your state of residence, you may have additional rights regarding your Consumer Health Data, including the right to:

• Access and obtain a copy
• Request deletion
• Withdraw consent (where consent is the legal basis)
• Opt out of any sharing beyond what is necessary for services

To exercise these rights, email support@medvroom.com.

4. CHANGES

We may update this supplement. Continued use constitutes acceptance of updates.