Consumer Health Data Privacy Notice

Effective Date: March 31, 2024

This Washington Consumer Health Data Privacy Notice (“Notice”) supplements the information in the Evidation Privacy Notice. It applies solely to Washington consumers who interact with us in an individual or household capacity and applies only to personal information defined as “consumer health data” under the Washington My Health My Data Act. Capitalized terms that are not defined here have the same meaning as in the Evidation Privacy Notice. This Notice describes what consumer health data we collect, how we collect and use it, who we disclose it to and why, and the choices you may have regarding our use or disclosure of your consumer health data. ‍

‍Categories of Consumer Health Data We Collect

We may collect or receive the categories of consumer health data listed below. Not all categories will be collected or received for every individual.

Health information submitted as part of your Evidation account, including, but not limited to, demographic information, education information, professional, or economic information;
Survey responses and information you submit about yourself, including, but not limited to information about your demographics and health (such as physical or mental health status or conditions, diagnoses, symptoms, treatments, or other similar information, general wellness, etc.);
Documents or other records that identify your health data that you choose to share with us; including, metadata associated with such documents;
Health data from Third-Party Applications that you may connect with your Evidation account and subject to the permissions you may set on those Third-Party Applications, such as activity data (like your steps, movement, sleep, etc.) or medical records and claims information (if such connection is available through your electronic medical record application or account);
If you opt in to participate in a study, research, or program (including any Health Programs, as discussed in additional detail below), we will collect information for that research or program;
Biometric Information: such as your height, weight, blood pressure, heart rate, pulse, and other similar information;
The following health information may be collected in the context of a Health Program:
- Health and Treatment Information:
  - Diagnosis information specific to the specific condition(s), disease(s), or illness(es) of the relevant Health Program;
  - Information related to prescription medications or other treatments that you are taking or may have been prescribed (including how frequently and regularly you take that medication, awareness of and access to alternative medications or other treatments, and other similar information);
  - Appointments you have with various medical providers (including general information about type(s) of providers, frequency, etc.);
  - Clinical events that you experience (for example, if you have to go to the emergency room or an urgent care clinic, have recurring or ad hoc provider visits, etc.); and
  - Vaccination status and information related to that status (including why you received or chose to forego vaccination);
- Wellness and Wellbeing Information:
  - Information you provide us related to your mood, symptoms, activities;
  - Your knowledge and understanding of, or opinions about, condition(s), disease(s), or illness(es), including any preventative measures and/or treatments, and other questions or topic areas that may help provide insight into your experience regarding your condition(s), disease(s), or illness(es); and
  - Information about your activity (like your steps, sleep, etc.), as may be collected from your wearable device and applications (if connected) or self reported;
- Medical Record and Claims Information:
  - With your specific authorization, your medical records (in which case we may ask for you to connect your Evidation account with your electronic medical record application or account); or
  - With your specific authorization, information from your medical record or claims history that may be provided to us by a third party;
- Profile Information that includes health data: such as demographic information, education information, professional, or economic information, etc. from your Evidation account profile, which we may want to combine with any personal information or other data we have collected specific to the Health Program; and
- Other similar information, as may be requested by us that is specific to the relevant Health Program.‍‍

Categories of Sources From Which We Collect Consumer Health Data

We may obtain consumer health data from different sources, as described in the Information We Collect About You section of the Evidation Privacy Notice. With respect to consumer health data, we collect that from the following sources:

Provided directly by you;
Collected from a device associated with you; and
Collected from another solution or asset, where you have authorized that solution or asset to provide us with your data.

Purposes for Collecting Your Consumer Health Data

We may collect and use consumer health data for one or more of the following purposes:

Provide, develop, improve, repair, and maintain our technology, products and services;
Process and deliver rewards;
Contact you, or otherwise provide you with information about:
- your account;
- referrals;
- current and future programs and initiatives offered;
- studies, research, or programs in which you are currently participating; or
- participation in studies, programs or other opportunities for which you may be eligible, based upon information previously collected or from which we may make inferences;
Respond to your feedback, comments, or questions, or to otherwise send you information about our Services;
Ask you to complete surveys, read articles, or engage in other activities or other programs and monitor your completion of and engagement in those activities;
Combine the information collected, including from Third-Party Applications and services, with other information about you or the Evidation community;
Perform analysis and/or research, including for publication (in a manner that does not identify you personally) pursuant to Institutional Review Board approval, waiver, or exemption, as necessary;
When we have your consent, such as pursuant to your participation in a study, research, or other program, such as a Health Program;
De-identify, tokenize, or aggregate your information (or otherwise render the information so you are not reasonably identifiable), or to create or derive datasets, as part of the Services and for other purposes consistent with why the information was collected and Evidation’s mission;
Detecting, preventing, and responding to security incidents and health and safety issues;
Personalize, advertise, and market our products and services to you, including the Services;
Conduct or perform research, analytics, and data analysis;
Detect and prevent fraud;
Comply with law, legal process, and internal policies; and
Exercise and defend legal claims.

‍Sharing of Consumer Health Data

a. Categories of Consumer Health Data that is Shared

We may share each of the categories of consumer health data described above. In particular, we may share personal data, including consumer health data, with your consent, to complete transactions or provide products or services you have requested, and for the purposes described in this Notice.

b. Categories of Third Parties and Specific Affiliates with Whom Consumer Health Data is Shared

We may share consumer health data with business partners such as those providing advertising and technology services, service providers who act on our behalf, governmental agencies and legal bodies, and purchasers of or successors to our business or assets.

Your Washington Consumer Health data Rights

Washington residents have the right to (1) request access to their consumer health data; (2) confirm whether we have disclosed or sold their consumer health data; (3) delete their consumer health data; or (4) withdraw their consent or authorization relating to such consumer health data. You may exercise many of the data subject rights applicable to you directly in your Evidation account. By logging-in to your Evidation account, you can update the information in your profile, see the programs in which you are enrolled, and make requests to exercise many of your data subject rights. Data subject requests can also be made through the “Submit a Request” function in your Evidation account or by emailing help@evidation.com. You may also exercise your rights by reaching out to our Privacy Office at privacy@evidation.com or the contact information listed below. To fulfill your request, please be sure to respond to any follow-up inquiries we may make. Please be aware that we do not accept or process requests through other means (e.g., via fax, chats, social media etc.).

How to Submit an Appeal

To appeal our decision on your Washington Consumer Health Data Rights request, you may contact our Privacy Office by using the contact information listed below or emailing our Privacy Office at privacy@evidation.com. In submitting your appeal, please enclose a copy of or otherwise specifically reference our decision on your data subject request, so that we may adequately review and address it. We will respond in accordance with applicable law.

‍