Consumer Health Data Privacy Policy

Last updated: 28 July 2026

This is a stand-alone policy required by Washington State's My Health My Data Act (RCW 19.373) and similar consumer health data laws. It covers only "consumer health data" as those laws define it — data that identifies your past, present, or future physical or mental health status and is not otherwise covered by HIPAA. It supplements, and does not replace, our general Privacy Policy, which governs all other data we process.

1. What counts as consumer health data here

In iMediq, this includes: biomarker values and lab results you upload, prescription and medication data, health-profile fields (medical history, allergies, lifestyle notes, family medical history), AI-chat messages about your health, and — when you use the clinic-booking feature — the requested medical specialty (e.g. "cardiology") included in a booking email, together with the names of the lab tests being requested (e.g. "Total cholesterol") if you switch that option on for a given email. We never put biomarker values, reference ranges, results or attachments in a booking email.

2. How we collect it

Directly from you: profile fields, uploaded lab/prescription documents, chat messages, and booking requests you submit.
From Apple Health, only if you connect it and only for the data types you authorize.

3. Why we collect and share it

Solely to provide the service you requested: extracting and displaying biomarker values, generating informational health summaries, tracking medications, and — for the booking feature — composing and sending an appointment-request email on your behalf to a clinic you selected. We do not use consumer health data for advertising or behavioral profiling, and we do not sell consumer health data.

4. Who we share it with

Anthropic — processes lab/prescription content and chat messages (and, for booking, the text of a clinic's reply) to power AI interpretation. Contractually prohibited from training on this data.
Resend / Postmark — email delivery for the booking feature. The clinic you choose to contact receives your request email (with your reply-to address); Resend/Postmark only relay it.
The clinic you select — when you use "Book by email," the clinic receives the request you reviewed and approved before sending.
MongoDB Atlas / Hetzner — infrastructure providers storing encrypted data on our behalf.

We do not share consumer health data with data brokers or advertisers, and we do not allow geofencing around healthcare facilities based on this data.

5. Your rights

You may at any time, from the app or by emailing [email protected]:

Confirm whether we process your consumer health data and access it.
Withdraw consent for a specific use (e.g. stop using the booking feature) without affecting the rest of the service.
Request deletion — we respond within 45 days (extendable by 45 more when reasonably necessary; we'll tell you if that applies).
Appeal a denied request by replying to our response with "Appeal."

6. Retention

We keep consumer health data until you delete it or your account, consistent with the retention terms in our general Privacy Policy.

7. Contact

Questions about this policy: [email protected].