← Back to Healthvocate

Consumer Health Data Privacy Policy

Last updated: July 20, 2026 · Effective: July 20, 2026

This is a separate, standalone policy required by the Washington My Health My Data Act (RCW 19.373) and the Nevada consumer health data law (SB 370, NRS 603A). It is published in addition to, and does not replace, our general Privacy Policy. Where the two describe the same practice, they are intended to say the same thing; if they ever conflict, this policy governs consumer health data for Washington and Nevada consumers.

It applies to you if you are a Washington resident, a Nevada resident, or a person whose consumer health data is collected in Washington or Nevada. It does not apply to individuals acting in an employment context. Healthvocate is operated by DYS Global Macro Trading Corp, 5830 E 2nd St, Ste 7000, Casper, WY 82609.

1. What we mean by consumer health data

Both laws define consumer health data broadly: personal information that is linked, or reasonably linkable, to you and that identifies your past, present, or future physical or mental health status. It is wider than the medical-records definition most people have in mind, and it covers things like the medications you take, the conditions you have, and the care you are seeking or paying for.

Healthvocate is not a HIPAA covered entity, and we do not claim to be. That is precisely the gap these two state laws were written to close, which is why this policy exists.

2. Categories of consumer health data we collect, and why

We collect only what a given tool needs in order to do the job you asked it to do. You choose which tools to use, and unused tools collect nothing.

• Health conditions and diagnoses — to determine which benefit programs, assistance funds, and coverage rules apply to you, and to support an appeal where a denial turns on medical necessity.
• Medications, dosages, and quantities — to compare what the same prescription costs from published pricing sources, to check formulary coverage, and to compare Medicare options against the drugs you actually take.
• Allergies and medical procedures — to populate the visit summary and intake forms you ask us to prepare.
• Healthcare providers and pharmacies — to check network status, screen providers against the federal exclusion list, and route appeals and disputes to the right place.
• Insurance coverage, claims, denials, explanations of benefits, and medical bills — to audit a bill line by line, identify charges that may violate the No Surprises Act, and draft an appeal built around the insurer's own stated reason for denying.
• Documents you upload — bills, EOBs, denial letters, insurance cards, medical records, and blank forms. We read what is printed on the page in order to extract the codes, amounts, and dates the tool needs.
• Household, income, and age information — to determine eligibility for benefit and assistance programs. This is not health data on its own, but because we use it to reach health-related conclusions, we treat it under this policy.
• Analysis results and inferences we generate — the findings, flags, and estimates our software produces from the above, retained so you can return to a result without re-running it.

How it is used. Solely to deliver the tools you requested, to show you your own results, and to prepare documents that you review and sign before anything is sent. We do not use consumer health data for advertising, for profiling unrelated to the service, or to build audiences.

3. Categories of sources we collect it from

• Directly from you — what you type into your profile and the tool forms.
• From documents you upload — extracted from the file you provide.
• Generated by the service — results and inferences our own software derives from the two sources above.

We do not buy consumer health data, obtain it from data brokers, receive it from your insurer or provider, or gather it from third-party tracking. Every piece of it originates with you.

4. Categories of consumer health data that we share

We do not share consumer health data with third parties. Under both statutes, disclosure to a processor acting on our instructions — and consistent with the purpose the data was collected for — is not "sharing," and a processor is not a "third party." We nonetheless describe those processors in section 5, because we would rather over-disclose than have you discover a data flow you did not expect.

We have never sold consumer health data, we do not sell it, and we will not sell it without first obtaining the separate written authorization both laws require. We have no such authorizations on file.

5. Third parties, affiliates, and processors

Third parties with whom we share consumer health data: none.

Specific affiliates with whom we share consumer health data: none. Healthvocate has no corporate affiliates, parents, or subsidiaries with which any data is shared.

The processors that handle consumer health data on our behalf, by category:

• AI processing provider (Anthropic, PBC) — performs analysis and reads uploaded documents under contract. No request we send carries an account identifier of any kind — no user ID, session ID, email address, or customer number — so requests are not linkable to you, or to each other, from the processor's side. Analyses transmit only the facts the question needs: codes, dollar amounts, provider specialty, state and ZIP, household size and income band. Where an analysis depends on age, we compute the age on our own servers and the date of birth never leaves them. Where a letter needs your name, our software inserts it locally after the AI has finished. Uploading a document is the one path where identifiers printed on the page are transmitted, because reading the page means reading all of it — which is why we tell you to redact anything you do not want read. Several tools use no AI at all.
• Hosting provider (LyneHost / SupremeCluster) — stores the database your data resides in. Hosting providers necessarily have technical access to stored data; access is restricted by policy and sensitive fields are encrypted at rest.
• Email delivery provider — sees the recipient address and the content of transactional messages we send you.
• Payment processor (Stripe) — receives your email and payment details. It receives no consumer health data.

Two further categories of outbound query carry health-related terms but nothing that identifies you, which is why they do not constitute sharing of consumer health data:

• Published prescription pricing sources — when you run a price check, the medication name, strength, and quantity are sent to retrieve a price. The recipient receives the medication details needed to answer, and no account identity, name, or other information about you. The request is made by our server, so your IP address is not exposed either.
• Federal provider registries (CMS NPPES, CMS Open Payments) — receive the provider name or NPI you searched for, and nothing about you.

6. What we do not do

• We do not sell consumer health data.
• We do not share it with advertisers, ad networks, or data brokers.
• We run no third-party advertising or analytics trackers — no Google Analytics, no advertising pixels — on any page.
• We do not use geofencing. We operate no geofence around any healthcare facility, and we do not use location to infer that you are seeking care.
• We do not discriminate against you for exercising any right described below.

7. The basis on which we collect and share

Both laws permit collection and sharing of consumer health data, without separate consent, to the extent necessary to provide a product or service you requested. That is the basis Healthvocate operates on: we collect what a tool needs to produce the result you asked for, and nothing beyond it.

If we ever want to collect additional categories of consumer health data, or use it for a purpose not described in this policy, we will disclose that and obtain your affirmative, opt-in consent first — separately for collection and for sharing, as the statutes require. Continuing to use the service, or accepting our general terms, does not count as that consent and we will not treat it as such.

8. Your rights, and how to exercise them

If you are covered by this policy, you have the right to:

• Confirm whether we are collecting, sharing, or selling your consumer health data, and access that data — including a list of every third party and affiliate we have shared or sold it to. As stated in section 5, that list is currently empty.
• Withdraw consent to our collection and sharing of your consumer health data.
• Delete your consumer health data. On a deletion request we remove it from our records, including from archived and backup systems, and notify any processor holding it. In practice, deleting it from our database is the operative step: our hosting provider stores that database, so removal there is removal, and because no request we send to the AI provider carries an account identifier, there is no record on its side that could be linked back to you in the first place. Where data sits on a backup that must be restored before it can be purged, deletion may be delayed — but never by more than six months from the date we authenticate your request.

How to submit a request. Signed-in users can use Account & Data Rights, which is the fastest route because your identity is already established. Anyone else can email support@healthvocate.com with the subject line Consumer Health Data Request. You do not need to create an account to make a request.

Verification. We will take reasonable steps to confirm the request is really from you, and may ask for additional information if we cannot. If we are unable to authenticate you, we may decline to act, and we will say so.

Timing. We respond within 45 days. If a request is complex we may extend once by a further 45 days, and we will tell you within the first 45 days that we are doing so, and why. Requests are free up to twice a year; we may charge a reasonable fee, or decline, only for requests that are manifestly unfounded, excessive, or repetitive — and the burden of showing that is ours.

If we refuse. You may appeal by replying to our decision, or by emailing support@healthvocate.com with the subject line Consumer Health Data Appeal. We will respond in writing within 45 days, explaining the reasons for the decision. If we deny the appeal, you may complain to your state Attorney General using the links in sections 9 and 10.

9. Washington residents

This policy is our consumer health data privacy policy for purposes of RCW 19.373.020, and the rights in section 8 are those provided by RCW 19.373.040.

Washington's My Health My Data Act is enforceable through the Washington Consumer Protection Act (chapter 19.86 RCW). If we deny your appeal, you may submit a complaint to the Washington State Attorney General at atg.wa.gov/file-complaint.

10. Nevada residents

This policy is our consumer health data privacy policy for purposes of NRS 603A.495, and states its effective date at the top of this page as that section requires.

Nevada's law is enforced by the Nevada Attorney General as a deceptive trade practice; it does not provide a private right of action. If we deny your appeal, you may submit a complaint to the Nevada Attorney General's Bureau of Consumer Protection at ag.nv.gov/Complaints/File_Complaint.

11. Data security

Access to consumer health data is restricted to those who need it to deliver the service you requested. We maintain administrative, technical, and physical safeguards appropriate to the volume and sensitivity of the data, including encryption in transit, encryption at rest for sensitive fields, hashed credentials, optional two-factor authentication, and audit logging of sensitive actions. Any processor handling this data does so under a binding contract that limits it to our instructions.

12. Changes to this policy

If we change the categories of consumer health data we collect, the purposes we use it for, or who receives it, we will update this policy and bump the dates above before the change takes effect — and where the law requires affirmative consent for the change, we will ask for it first rather than relying on this notice.

13. Contact

DYS Global Macro Trading Corp
5830 E 2nd St, Ste 7000, Casper, WY 82609
support@healthvocate.com

← Back to Healthvocate · Privacy Policy · Terms of Service