Last Updated: February 19, 2026

This Consumer Health Data Privacy Notice (“Notice”) applies to personal information defined as “consumer health data” subject to applicable state consumer health data law, including the Washington My Health My Data Act (“MHMDA”). 

This Notice supplements other applicable Evidation privacy notices. For example, the privacy notice for our corporate website at www.evidation.com is available by clicking here, and the privacy notice for our consumer platform “Evidation” (sometimes referred to as “MyEvidation” or “Achievement”) that rewards healthy actions and helps users participate in research is available by clicking here. Additionally, research or other programs, including sponsored programs as well as services that feature our partners’ branding instead of or in addition to Evidation branding, facilitated by Evidation (“Health Programs”) may be subject to terms provided in the specific informed consent and/or other disclosures for the relevant Health Program. For example, under applicable law, medical records you authorize us to access when participating in a Health Program may be subject to terms in the relevant authorization. The privacy notice that applies to Evidation’s data practices for employment applicants is available by clicking here.

Consumer Health Data We Collect

As described further in the “Personal Information We Collect” sections of the Evidation.com, MyEvidation, and employment applicant privacy notices, as may be applicable to you, the information we collect depends on how you interact with us, the services you use, and the choices you make. Because consumer health data is defined very broadly, many of the categories of information we collect are or could be considered consumer health data. 

Such data may also be categorized as follows:

• Information about your health-related conditions, symptoms, status, diagnoses, testing, or treatments (including surgeries, procedures, medications, or other interventions). For example, we may collect such information through surveys or other communication with you for research studies and improving service accessibility.
• If you use third-party applications and services that collect biometric information and connect them to our services, we may obtain measurements of bodily functions, vital signs, or characteristics, including photographs, through those third-party applications and services. This may include data collected by these third-party applications and services up to 30 days before the date you connect them to our services. Additionally, if you participate in Evidation programs that involve completing biometric measurements, such as by using the camera on your phone, we may obtain similar information from those measurements. Such information may also be considered biometric information under applicable consumer health data law.
• Information that could identify your attempt to seek health care services or information, including services that allow you to assess, measure, improve, or learn about your or another person’s health. For example, your interactions with us could involve queries concerning nutrition, wellness, fitness, medical conditions, or other health-related topics. 
• Other information that may be used to infer or derive data related to the above or other health information. 

Categories of Sources From Which We Collect Consumer Health Data

As described further in the “Personal Information We Collect” sections of the Evidation.com, MyEvidation, and employment applicant privacy notices, as may be applicable to you, we collect personal information (which may include consumer health data) directly from you, from your interactions with our services, from third parties, and from publicly available sources.

Why We Collect and Use Consumer Health Data

We collect and use consumer health data for the purposes described in the “How We Use Personal Information” sections of the Evidation.com, MyEvidation, and employment applicant privacy notices, as may be applicable to you. Primarily, we collect and use consumer health data as reasonably necessary to provide you with the services you have requested or authorized. This may include delivering and operating the services and their features, personalization of certain service features (such as rewards), ensuring the secure and reliable operation of the services and the systems that support them, troubleshooting and improving the services, and other essential business operations that support the provision of the services (such as analyzing our performance, meeting our legal obligations, developing our workforce, and conducting research and development). 

We may use consumer health data for other purposes for which we give you choices and/or obtain your consent as required by law - for example, for advertising or marketing purposes. See the “Choices and Control of Personal Information” sections of the Evidation.com, MyEvidation, and employment applicant privacy notices, as may be applicable to you, and the “How to Exercise Your Rights” section below for more details on the controls and choices you may have. 

Our Disclosure of Consumer Health Data

We may disclose each of the categories of consumer health data described above for the purposes described in the “How We Disclose Personal Information” sections of the Evidation.com, MyEvidation, and employment applicant privacy notices, as may be applicable to you. In particular, we may disclose personal information, including consumer health data, with your consent or as reasonably necessary to complete any transaction or provide any service you have requested or authorized, as described in the previous section of this Notice.

For example, if you redeem rewards, we will disclose information about the transaction as necessary to process the rewards, including protection against fraud. And we may disclose data when we believe that doing so is necessary to comply with applicable law or respond to valid legal processes.

Third Parties to Which We Disclose Consumer Health Data

As necessary for the purposes described above, we disclose consumer health data to the following categories of third parties:

• Service Providers. Vendors or agents (“processors”) working on our behalf may access consumer health data for the purposes described above. For example, companies we’ve hired to assist in protecting and securing our systems and services may need access to data to provide those functions. 
• Affiliates. We enable access to consumer health data across any subsidiaries, affiliates, and related companies, for example, where we share common data systems or where access helps us to provide our services and operate our business. 
• Financial Institutions & Payment Processors. When you enter into a financial transaction, for example to redeem rewards, we will disclose payment and transactional data to banks and other entities as necessary for payment processing, fraud prevention, credit risk reduction, analytics, or other related financial services.
• Business Partners. We may disclose consumer health data to other companies, for example, where you use a service that is co-branded and jointly operated with another company,  or where you use our services to interact with another company. 
• Government Agencies. We will disclose consumer health data to law enforcement or other government agencies when we believe doing so is necessary to comply with applicable law or respond to valid legal process.
• Other Third Parties. In certain circumstances, it may be necessary to provide data to other third parties, for example, to comply with the law or to protect our rights or those of our customers. 
• Parties to a Corporate Transaction. We may disclose consumer health data as part of a corporate transaction or proceeding such as a sale, transfer, divestiture, or transfer of all or a portion of our business or assets, or a merger, financing, acquisition, bankruptcy, or dissolution. 

How to Exercise Your Rights

Applicable state consumer health data law may provide certain rights with respect to consumer health data, including rights to access, delete, or withdraw consent relating to such data, subject to certain exceptions. You can request to exercise such rights using the various tools and mechanisms described in the “Choices and Control of Personal Information” sections of the Evidation.com, MyEvidation, and employment applicant privacy notices, as may be applicable to you. For example, depending on the service you use, you can access and make choices about your data by logging into your Evidation account and navigating to your “Account” page, or by completing the “Submit a Request” form (available by clicking here); please select “Privacy” under the “What’s this about?” dropdown. And if you want to access or control consumer health data we process that is not available via those tools, you can always contact us by emailing us at privacy@evidation.com or via the contact methods described at the bottom of this Notice. 

If your request to exercise a right is denied, you may appeal that decision by contacting our Privacy Office at privacy@evidation.com or via the contact methods described at the bottom of this Notice. In submitting your appeal, please enclose a copy of or otherwise specifically reference the decision you are appealing and your specific concerns to help our review. If your appeal is unsuccessful, you may be entitled to raise a concern or lodge a complaint with the Attorney General of your state. For example, if your appeal is unsuccessful and MHMDA applies to your request, you may contact the Washington Attorney General by clicking here.

Changes to this Notice

We will update this Notice when necessary to reflect changes in our services, how we use consumer health data, or the applicable law. Changes to this Notice will become effective when published, unless otherwise noted. When we post changes to the Notice, we will revise the “Last Updated” date at the top of this Notice. If we make material changes to this Notice, we will provide notice or obtain consent regarding such changes as may be required by law.

Contact Us

For any privacy questions, complaints, or inquiries regarding this Notice, please direct your inquiry to:

Evidation Health
Attn: Privacy Office
63 Bovet Rd #146
San Mateo, CA 94402
privacy@evidation.com