Consumer Health Data Privacy Notice

Who This Notice Is For

This notice is required by the Washington My Health My Data Act and describes how Rul Health LLC handles consumer health data. It applies to you if you are a Washington resident, or if your consumer health data is collected while you are in Washington.

Because we cannot reliably tell where you are when you use this site, we apply the practices described here to everyone, in every state.

This notice covers consumer health data only. Our general Privacy Policy covers everything else.

An Important Boundary

Health information you share with a treating provider or a dispensing pharmacy is protected health information held by those HIPAA-covered entities, and this notice does not govern it — their own notices of privacy practices do.

This notice governs the consumer health data we hold: what you tell us in an assessment before a provider relationship exists, and information that indicates you are seeking a health service.

Categories Of Consumer Health Data We Collect, And Why

Health history and conditions — what you tell us in the assessment about your health, past or present. Collected to route your assessment to a licensed provider who decides whether treatment is appropriate. Used for that clinical review and for your ongoing care.

Medications you take — including prescribed medication. Collected so a provider can check for interactions and contraindications. Used only for that clinical review.

Body measurements — height, weight and the BMI derived from them. Collected because they are inputs a provider uses to assess eligibility. Used for that assessment and, if you use a calculator on this site, to show you a result. Calculator inputs are processed in your browser and are not sent to us.

Your health goals — for example weight loss, recovery or longevity. Collected to route you to the right clinical pathway. Used for that routing.

The fact that you are seeking care — that you started or completed an assessment, and the contact details you gave us with it. Collected so we can respond to you and so a provider can follow up. Used for that, and to send you messages about your own order or care.

Treatment and order information — what was prescribed, when it shipped, and your history with us. Collected to fulfil your order and support you afterwards. Used for that.

We do not collect biometric data or genetic data. We do not collect precise location.

Where We Get It

Directly from you — the assessment, forms you fill in, messages you send us, and anything you tell our support team. This is the source of almost all consumer health data we hold.

From the licensed providers and pharmacies involved in your care — for example confirmation that a prescription was issued or dispensed, so we can keep your order accurate.

From the laboratories that perform any panel you order, where you have asked us to help coordinate it.

Categories We Share, And With Whom

We share the health history, medications, body measurements, goals and treatment information described above — the categories needed to actually deliver care.

Licensed healthcare providers. To review your assessment and decide whether treatment is appropriate.

503A compounding pharmacies. To dispense and ship a prescription, where one is issued.

Clinical laboratories. Where you have ordered a lab panel.

Service providers acting for us under contract — hosting, payment processing, identity verification, email delivery and customer support. They may use the data only to perform services for us and may not use it for their own purposes.

Legal and regulatory authorities, where required by law or to protect rights and safety.

A successor entity, in the event of a merger, acquisition or sale of assets.

Affiliates. Rul Health LLC has no affiliates. If that changes we will name each one here before sharing any consumer health data with it.

We do not share consumer health data with advertising networks, data brokers or analytics providers. No advertising or third-party analytics tag runs on our assessment, on our treatment pages, or on order confirmation.

We Do Not Sell Consumer Health Data

We do not sell consumer health data, and we do not offer it for sale. Under the My Health My Data Act, “sale” means exchanging consumer health data for money or other valuable consideration — a definition broad enough to cover passing data to an advertising platform in return for targeting or measurement. We do not do that.

If we ever intended to, the Act would require us to obtain a separate written authorization from you first, naming the buyer and the data, valid for one year, which you could revoke at any time, and which we could not condition your care on signing. We have no plans to seek one.

Your Rights

You can confirm what we hold and get a copy of it, including a list of every third party and affiliate we have shared it with, and a way to contact them.

You can withdraw your consent to our collecting or sharing your consumer health data, at any time, for either or both.

You can have it deleted. When you ask, we delete it from our records — including from archives and backups — and we notify every affiliate, processor, contractor and third party we shared it with, who must then delete it too.

Withdrawing consent or deleting your data may end our ability to support your care, and your provider and pharmacy hold their own records under their own legal retention obligations, which we cannot delete on their behalf.

We will not discriminate against you for exercising any of these rights, and you do not need an account to exercise them.

How To Make A Request

Email support@rulhealth.com with the subject line “Health Data Request,” and tell us which right you want to exercise. We will verify who you are before we act — we will not ask you to create an account to do it.

We respond within 45 days. If we genuinely need longer we may extend once by a further 45 days, and we will tell you why within the first 45.

An authorized agent may make a request on your behalf.

If We Say No

If we refuse a request, we will tell you why, and you can appeal by replying to our decision or emailing support@rulhealth.com with the subject line “Health Data Appeal.” Appealing is as easy as making the original request.

We decide appeals within 45 days and explain the reasoning in writing.

If we deny your appeal, you can complain to the Washington State Attorney General at atg.wa.gov/file-complaint.

How We Protect It

We restrict access to consumer health data to the people who need it to do their job, and we apply administrative, technical and physical safeguards designed to protect it. No system is perfectly secure and we do not claim otherwise.

Where a service provider processes consumer health data for us, they do so under a written contract that binds them to our instructions and to this notice.

Geofencing

We do not use geofencing. We do not place a virtual boundary around any place that provides in-person health care in order to identify or track people, collect their data, or send them advertising.

Changes To This Notice

If we intend to collect, use or share a category of consumer health data, or to do so for a purpose, that is not described above, we will update this notice and obtain your consent before we do it.

Questions: support@rulhealth.com.