How AltuWell collects, uses, shares, and protects consumer health data under Washington's My Health My Data Act.
AltuWell LLC ("AltuWell," "we," "our," or "us") provides the AltuWell website, applications, beta programs, early access features, and related services (collectively, the "Services").
This notice explains what consumer health data we collect through the Services, why we collect it, who we share it with, and how you can exercise your rights over it. It applies to Washington residents and to anyone whose consumer health data is collected in Washington.
This notice covers consumer health data only. Our General Privacy Notice describes how we handle all other information, including account details, payment information, and security practices. Where the two notices differ as to consumer health data, this notice governs.
We collect the following categories of consumer health data:
Information You and Your Care Circle Enter
Information About Individuals Under Your Care
Much of what you enter may be about another person. When you add someone to a care circle, you are confirming that you have their permission, or the legal authority to act for them as a parent, guardian, or health care agent. The person you are documenting has their own rights over their information under this notice.
Information We Generate
Technical and Device Information
To operate and secure the Services, we collect technical records, including device type, operating system, IP address, and crash and error reports. Where these records are linked to you, we treat them as consumer health data, and we use them only for the purposes described in Section 4.
Information We Do Not Collect
We do not collect biometric data, genetic data, or precise location information.
We collect consumer health data from these sources:
We do not purchase consumer health data or obtain it from data brokers.
We collect and use consumer health data only for the purposes below.
To Provide the Service You Requested
We store, organize, and display the medications, symptoms, journal entries, and appointments you and your circle enter, so that everyone in the circle works from the same record. This is necessary to run the Services, and it continues for as long as you use AltuWell.
To Keep the Services Secure and Working
We use technical records such as device type, operating system, IP address, and crash and error reports to operate the Services, maintain security, detect fraud, and diagnose problems. Crash and error reports are configured to exclude the content of your medications, symptoms, journal entries, and appointments.
To Understand How the Services Are Used, Only If You Turn It On
If you enable product analytics, we collect which screens and features you use and how long tasks take. This never includes your medications, symptoms, journal content, or appointments.
To Respond to You
If you send us a support request or feedback, we use what you send, including any health details you choose to include, to respond to you, fix problems, and improve the Services. This information may be processed by our product and support management providers, acting only on our instructions.
We do not use consumer health data for advertising or to target you with marketing.
We may share the categories described in Section 2 as follows.
With the People in Your Care Circle
Anyone you invite to a care circle can see the information shared with that circle, according to the permissions you set.
With Providers Who Operate the Services on Our Behalf
These providers act only on our instructions and only to deliver the Services. The categories of provider are:
When Required by Law
We may disclose consumer health data where we are legally required to do so, such as in response to a valid legal process. We may also use or disclose consumer health data to prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any activity that is illegal under Washington state or federal law; to preserve the integrity or security of our systems; or to investigate, report, or prosecute those responsible for any such activity.
In a Business Transfer
If AltuWell is involved in a merger, acquisition, bankruptcy, or other transaction in which another entity assumes control of all or part of our assets, consumer health data may be transferred as part of that transaction. Any recipient must continue to comply with the Washington My Health My Data Act, and this notice continues to apply to your consumer health data unless it is updated as described in Section 12.
We do not sell consumer health data. Under the Washington My Health My Data Act, a sale means exchanging consumer health data for money or for anything else of value.
We do not disclose consumer health data to advertising networks or data brokers.
We do not use advertising pixels or trackers in the Services.
We do not use a geofence around any facility that provides in-person health care services.
AltuWell does not collect precise location information and does not collect location in the background. If a feature ever requires your location, we ask you at that moment and explain why. We do not use location to infer anything about your health or the health of anyone in your care circle.
If you are a Washington consumer, you have the following rights regarding your consumer health data.
How to Make a Request
To exercise any of these rights, email us at hello@altuwell.com. You can also change your privacy choices at any time, in Settings.
We take reasonable steps to verify that a request comes from you, or from someone authorized to act for you, before acting on it.
We respond within 45 days of receiving a request. If we need more time, we may extend once by an additional 45 days and will tell you why within the first 45 days. Requests are free up to twice per year.
If You Are Documenting for Someone Else
The person whose health information appears in a care circle has these rights over their own information, whether or not they use AltuWell. They may contact us directly at hello@altuwell.com to exercise them.
If we decline a request, we will tell you why and explain how to appeal. You may appeal by replying to our decision or by writing to us at the email address in Section 13. We will respond to an appeal in writing within 45 days, with our reasoning.
If we deny your appeal, you may submit a complaint to the Washington State Attorney General at https://www.atg.wa.gov/file-complaint.
Any provider that processes consumer health data on our behalf is bound by a written contract requiring them to follow our instructions, to assist us in meeting our obligations, and to process the data only for the purposes described in this notice.
Where we use deidentified data, we take reasonable measures to ensure it cannot be linked back to you or to your device, we publicly commit not to attempt to reidentify it, and we contractually require anyone who receives it to do the same.
If we want to collect, use, or share a category of consumer health data that is not described in this notice, or use it for a purpose not described here, we will update this notice and obtain your affirmative consent before doing so. Continuing to use the Services is not consent for these purposes.
Questions regarding this notice may be directed to:
AltuWell LLC
Charleston, South Carolina