Washington Privacy Notice

Washington My Health My Data Act Privacy Notice

Effective Date: March 29, 2024

This My Health My Data (“MHMD”) Act Notice (the “MHMD Notice”) applies to residents of Washington State and individuals whose Consumer Health Data (as defined below) is collected in Washington State by Planned Parenthood Federation of America, Inc. (“Planned Parenthood,” “PPFA,” “we,” “us,” or “our”) through www.plannedparenthood.org and any other website we own and operate that links to this Notice (the “Sites”) or the related content, platform, products, and other functionality offered on or through our services (collectively, the “Services”). This Notice supplements the PPFA Privacy Notice and explains how we use and disclose your Consumer Health Data. 

IMPORTANT NOTE: PPFA is a 501(c)(3) non-profit membership organization dedicated to ensuring that people can receive comprehensive reproductive and complementary health care services. PPFA does not itself provide health care services. Rather, we support the local Planned Parenthood Affiliates (each, and “Affiliate”), which are separately incorporated 501(c)(3) organizations, who do provide health care services. In certain situations, PPFA functions as a service provider to Planned Parenthood Affiliates or related entities pursuant to the Health Insurance Portability and Accountability Act (“HIPAA”). In the course of providing services to the Affiliates, we may process your personal information on their behalf pursuant to our contracts with them, including HIPAA business associate agreements. This information may include patient or health plan member information that you provided to Affiliates or related entities to obtain pharmacy, medical, or healthcare or health plan services online or in person at facilities operated by Affiliates. This MHMD Notice does not apply to our processing of such information. Such information is protected by state and federal law and is disclosed to us in accordance with each local Affiliate’s own privacy notice or HIPAA Notice of Privacy Practices. This MHMD Notice also does not address privacy practices relating to Planned Parenthood employees and other personnel. Please note that this MHMD Notice is not a contract and does not create any legal rights or obligations not otherwise provided by law.

1. Our Collection and Use of Consumer Health Data 

The term “Consumer Health Data” as used in this MHMD Notice means any personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status as defined in the MHMD Act. The data we collect depends on the context of your interactions with us and, in most cases, is information that you decide to share with us. Consumer Health Data does not include information that is considered deidentified under the MHMD Act. Examples of Consumer Health Data that PPFA may collect include:

• Information you share about your health-related conditions, symptoms, experiences, diagnoses, testing, or treatments. For example, we may collect such information through a PPFA webform on our Sites or through other communications we have with you, including information provided in custom messages sent through webforms or in chat messages on our Sites, such as through Chat/Text or Ask Roo.
• Information about experiences with health care providers that you choose to share with PPFA through inquiries to or communications with us.
• Other information that may be used to infer or derive data related to the above or other health-related information.

2. Sources of Consumer Health Data

The Consumer Health Data we collect depends on the context of your interactions with our Services and, in most cases, is information that you decide to share with us.  

3. Our Disclosure of Consumer Health Data

We may share the categories of Consumer Health Data included in Section 1 of this MHMD Notice with the following third parties:

• Service Providers: We work with a variety of service providers who help us process your Consumer Health Data, such as to facilitate the operation of our Sites and Services and to support our communications, and advocacy programs.
• Business Transactions: We may take part in or be involved with a business transaction, such as a merger. We may disclose Consumer Health Data to a third-party during the negotiation of or in connection with such a transaction but, to the extent permitted by applicable law, we will only disclose Consumer Health Data upon the third party agreeing to the same or stronger protections for your Consumer Health Data than are set forth in this MHMD Notice.  
• Legal Obligations and Rights: We may disclose Consumer Health Data to third parties: in connection with the establishment, exercise, or defense of legal claims; to comply with laws or to respond to lawful requests and legal processes; to protect our rights and property and the rights and property of others, including to enforce our agreements and policies; to detect, suppress, or prevent fraud; to protect the health and safety of us and others; or as otherwise required by applicable law.
• With Your Consent: We may disclose Consumer Health Data about you to certain other third parties or publicly with your consent or at your direction. For example, with an individual’s consent or at their direction we may post their testimonial on our Sites or Services-related publications. 

4. Your Privacy Rights

The MHMD Act provides the following rights with respect to Consumer Health Data we collect about you:  

• Right to Access / Confirm: You may have the right to confirm whether we are collecting, sharing, or selling Consumer Health Data about you and with whom we may be disclosing such Consumer Health Data, and to access such data. 
• Right to Withdraw Consent: If you have provided your consent for our processing or sharing of your Consumer Health Data, you may have the right to withdraw your consent.
• Right to Delete: You may have the right to request that we delete your Consumer Health Data and that all third parties to whom we have disclosed your Consumer Health Data delete such data. 

5. How to Exercise Your Privacy Rights

To exercise any of the privacy rights set forth above, please submit a request by either completing our Individual Rights Form or calling 1-800-430-4907.

Before processing your request, we will need to authenticate your identity. To authenticate your identity, we will generally require matching a minimum amount of information you provide us with the information we maintain about you in our systems. This process may require us to request additional information from you, including, but not limited to, your email address and phone number.

In certain circumstances, we may decline a request to exercise the rights described above, particularly where we are unable to authenticate your identity or locate your information in our systems. If we are unable to comply with all or a portion of your request, we will explain the reasons for our decision.

6. Appealing Privacy Rights Decisions

If your request to exercise a right under the MHMD Act is denied, you may appeal that decision by contacting us at [email protected]. If your appeal is unsuccessful, you can raise a concern or lodge a complaint with the Washington State Attorney General at www.atg.wa.gov/file-complaint.

7. Changes to this MHMD Notice

We may update this MHMD Notice from time to time. When we make changes to this MHMD Notice, we will change the date at the beginning of this MHMD Notice. All changes shall be effective from the date of publication unless otherwise specified.