Washington My Health My Data Act
Consumer Health Data Privacy Policy
This policy is required by the Washington My Health My Data Act, RCW 19.373, and applies to consumer health data collected through brennamay.com and through the services described below. It is kept separate from the general Privacy Policy because the Act requires a stand-alone policy containing only what the Act requires.
The entity responsible for this policy is May Creative and Consulting LLC, an Oregon limited liability company doing business as Brenna May Wellness and as May Practice Frameworks. Contact: brenna@brennamay.com.
Categories of consumer health data collected, and why.
The following categories are collected. Each is collected only where a person chooses to provide it.
- Health conditions, symptoms and status described in free-text fields. The Work With Me form asks what is going on and what else you would want known. Anything you write there that describes physical or mental health is consumer health data.
- Information about diagnostic testing. The Work With Me form asks whether you have had recent blood work.
- Information about efforts to improve health. The Groundwork interest form asks what you have already tried.
- Bodily functions, symptoms, diet, sleep, digestion and stress information. Provided by clients through the NutriQ client portal in assessments, intake forms and food and mood journals.
- Information about seeking or receiving health-related services. The fact that you inquired about or received nutritional therapy services.
- Information about obtaining health-related products and testing. Registration for a practitioner dispensary account under this practice, and the purchase of a functional laboratory test ordered through a practitioner link on this site.
- Identifiers linked to any of the above. Name, email address and any other identifier submitted alongside health information.
Purpose, and how the data is used
Consumer health data is collected and used to respond to inquiries, to determine whether the practice is an appropriate fit for a person, to provide nutritional therapy services to clients who request them, to maintain client records, and to comply with legal and tax obligations.
It is not used for advertising, targeted marketing, profiling, or automated decision making, and it is not used to train any machine learning system.
Categories of sources.
- Directly from the consumer, through forms on brennamay.com.
- Directly from the consumer, through the NutriQ client portal.
- Directly from the consumer, by email or in a consultation.
- From the website’s own software, recording that a form was submitted.
- From practitioner dispensary and laboratory testing providers, where a consumer registers an account or orders a test through a practitioner link on this site.
Consumer health data is not purchased, licensed, or obtained from data brokers, advertising networks, or any other outside source.
Categories of consumer health data that is shared.
All of the categories listed above may be shared, and only with the service providers that store, transmit or display that data on behalf of May Creative and Consulting LLC. In practice this means the following.
- Free-text health descriptions, testing information and linked identifiers are stored by the form software and the website host, and are transmitted and stored by the email provider.
- Assessment, intake and journal data is stored by the client portal provider.
- Name and contact details are shared with a practitioner dispensary or a laboratory testing provider when a consumer registers an account or orders a test through a practitioner link on this site.
Consumer health data is not shared with advertisers, advertising networks, data brokers, analytics providers, or social media platforms.
Third parties and affiliates.
Categories of third parties
- Website hosting and infrastructure providers. A privately owned server and the third-party infrastructure provider on whose hardware and network that server runs.
- Website and form software providers. Automattic, Inc. (WordPress.com and Jetpack) and WPForms, LLC.
- Email provider. Google LLC (Google Workspace).
- Client portal provider. The Nutritional Therapy Association, Inc. (NutriQ).
- Practitioner dispensaries. Fullscript, Designs for Health, CellCore and LifeWave, and only where a consumer registers an account through a practitioner link on this site.
- Laboratory testing providers. Designs for Health, for the functional tests ordered through practitioner links on this site.
- Professional advisors. Legal and accounting advisors, where necessary and under a duty of confidentiality.
- Government authorities. Where disclosure is required by law, subpoena or court order.
Specific affiliates
May Creative and Consulting LLC has no affiliates. Brenna May Wellness and May Practice Frameworks are trade names of the same legal entity rather than separate companies, and no consumer health data is shared with any parent, subsidiary or commonly controlled company.
Selling
Consumer health data is not sold and has never been sold. Under RCW 19.373.070 no sale may occur without a separate valid written authorization signed by the consumer, and no such authorization has been sought or obtained.
Your rights, and how to exercise them.
Under RCW 19.373.040 a consumer has the right to:
- Confirm whether consumer health data concerning them is being collected, shared or sold, and to access that data, including a list of all third parties and affiliates with whom it has been shared or sold together with a way to contact them.
- Withdraw consent to the collection and sharing of consumer health data concerning them.
- Have consumer health data concerning them deleted.
How to make a request
Send an email to brenna@brennamay.com with the subject line Consumer Health Data Request, and state which of the three rights above you are exercising. Requests are received and answered by Brenna May directly. You do not need to create an account to make a request, and if you already have an account you may use it.
Requests are authenticated using information already held, such as the email address a form was submitted from. If a request cannot be authenticated by commercially reasonable means, additional information reasonably necessary to authenticate it may be requested, and the request may not be acted on until it is authenticated.
Responses are provided free of charge up to twice a year per consumer. A request that is manifestly unfounded, excessive or repetitive may carry a reasonable administrative fee or may be declined, and the burden of showing that a request is of that kind rests with May Creative and Consulting LLC.
Timing
Requests are answered without undue delay and in all cases within 45 days of receipt. That period may be extended once by a further 45 days where reasonably necessary, and where it is, notice of the extension and the reason for it will be given within the first 45 days.
Deletion
On a deletion request, consumer health data is deleted from all records, including archived and backup systems, and all processors, contractors and third parties with whom it has been shared are notified of the request and are required to delete it as well. Where data sits on an archived or backup system, deletion may be delayed to allow for restoration of that system, and that delay will not exceed six months from the date the request is authenticated.
Appeals
If a request is refused, you may appeal by replying to the refusal, or by sending a new email to brenna@brennamay.com with the subject line Consumer Health Data Appeal. A written decision, including the reasons for it, will be provided within 45 days of receipt of the appeal.
If an appeal is denied, you may submit a complaint to the Washington State Attorney General at atg.wa.gov/file-complaint.
Changes to this policy
No additional category of consumer health data will be collected, used or shared, and no new purpose will be applied to data already held, without this policy first being updated and affirmative consent obtained.