Consumer Health Data Privacy Policy

1. What this policy covers

This policy explains how Conduit collects, uses, shares, and protects consumer health data — information that identifies your past, present, or future physical or mental health status. It applies in addition to our Privacy Policy, and where the two conflict on the subject of consumer health data, this policy governs.

Some information you share with us is medical record information held by your treating physician or the dispensing pharmacy. That information is governed by the health-privacy laws that apply to those providers and by the notices they give you. This policy covers consumer health data held by Conduit outside of those records.

2. The health data we collect

• Health assessment responses. Height, weight, goals, medical history, current medications, allergies, conditions, and related answers you provide in our eligibility check or intake.
• Treatment and protocol information. The protocol a physician designs for you, dose and cadence, adjustments over time, and refill or shipment records.
• Clinical communications. Messages between you and your care team, check-in responses, and reported side effects or outcomes.
• Measures you report over time, such as weight, and inferences we draw from the above — for example, whether you are eligible for a given protocol.
• Your state of residence. We do not collect precise geolocation. We collect the state you are located in, because a physician may only treat patients in states where they are licensed.

3. Where it comes from

Directly from you, through the eligibility check, intake, check-ins, messages, and your account profile; from your treating physician as part of providing your care; and from the dispensing pharmacy regarding fills and shipments. We do not buy consumer health data, and we do not obtain it from data brokers or advertising networks.

4. Why we collect it, and how we use it

• To let a licensed physician review your case and decide whether treatment is appropriate for you.
• To design, dispense, deliver, and adjust your protocol.
• To communicate with you about your care, including check-ins and reminders.
• To operate the service — billing, support, security, fraud prevention, and recordkeeping.
• To meet legal, regulatory, licensing, and pharmacy requirements.

We do not use consumer health data for advertising, ad targeting, or audience building, and we do not permit advertising or analytics technologies to collect it.

5. Who we share it with

• Your treating physician and care team, to provide your care.
• The dispensing pharmacy, to fill and ship your prescription.
• Service providers acting on our behalf under contract and limited to what they need to perform their function — our hosting and database providers, our transactional email provider, our payment processor, and our support tooling. They may not use your health data for their own purposes.
• When required by law, to respond to lawful process, or to protect someone’s safety.

We do not sell consumer health data. Under Washington law “sale” is defined broadly and includes exchanges for anything of value, not only money. Selling would require your separate, signed authorization, which we do not seek.

6. Your rights

You have the right to:

• Confirm and access — learn whether we collect, share, or sell your consumer health data, obtain a copy, and receive a list of the third parties it has been shared with.
• Withdraw consent to our collection and sharing of your consumer health data.
• Delete your consumer health data.

How to exercise them: send a request through our Contact page, or by secure message in the member portal if you have an account. We will take steps to verify your identity before acting on a request, and we will respond within 45 days. If we need more time, we may extend once by a further 45 days and will tell you why before doing so.

If we deny your request, we will tell you why and how to appeal. To appeal, reply to our decision or contact us again through the same channel, stating that you are appealing. If your appeal is denied, you may contact the Washington State Attorney General at atg.wa.gov/file-complaint.

One limit on deletion. Medical and pharmacy records that a physician or pharmacy is required by law to retain cannot be deleted on request, and retention periods are set by state law. We will delete what we lawfully can, and tell you plainly what must be kept and why.

7. How we protect it

We use administrative, technical, and physical safeguards designed to protect consumer health data, including encryption of data in transit and at rest, access limited to personnel who need it to provide your care or support you, and logging of access to records. No system is perfectly secure, and we cannot guarantee absolute security.

8. Changes to this policy

If we make material changes we will post the updated policy here and update the effective date below. Where the law requires it, we will obtain your consent before applying material changes to consumer health data we already collected.