ANNEX A
SUPPLEMENTAL CONSUMER HEALTH DATA PRIVACY STATEMENT

This Supplemental Consumer Health Data Privacy Statement (“Consumer Health Data Privacy Statement”) supplements our Privacy Notice. 

This Supplemental Consumer Health Data Privacy Statement only applies to personal information we process that is “consumer health data” subject to the Connecticut Data Privacy Act, as amended (“CTDPA”), Washington My Health My Data Act (“MHMDA”), Nevada’s Consumer Health Data Privacy Law (“NVCHDPL”), or other states with consumer health data privacy laws (as applicable).

Terms used in this Supplemental Consumer Health Data Privacy Statement that are defined in MHMDA, NVCHDPL, or CTDPA will have the meaning set forth in those laws to the extent such laws are applicable. 

CONSUMER HEALTH DATA WE COLLECT

Under the MHMDA, “consumer health data” is defined as “personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status.”

Under NVCHDPL, “consumer health data” is defined as “personally identifiable information that is linked or reasonably capable of being linked to a consumer and that a regulated entity uses to identify the past, present or future health status of the consumer.”

Under CTDPA, “consumer health data” is defined as “any personal data that a controller uses to identify a consumer's physical or mental health condition or diagnosis, and includes, but is not limited to, gender-affirming health data and reproductive or sexual health data.”

Because consumer health data is defined very broadly, many of the categories of personal information that we collect under our Privacy Notice may also be considered consumer health data.

Examples of consumer health data that you may provide to us, or that we may otherwise collect, may include:

• Information that could identify your attempt to seek health care services or information, including services that allow you to assess, measure, improve, or learn about your or another person’s health. For example, we collect your search queries on the Sites, which may include queries or other information concerning nutrition, wellness, fitness, medical conditions, or other health-related topics.

• Information about your health-related conditions, symptoms, status, diagnoses, disease, testing, or treatments.

• Information about social, psychological, behavioral, and medical interventions. 

• Information about use or purchase of prescribed medication. 

• Information about measurements of bodily functions, vital signs, symptoms, or characteristics.

• Information about diagnoses or diagnostic testing, treatment, or medication. 

• Information about surgeries or other health-related procedures. 

• Reproductive or sexual health information. 

• Information about gender-affirming care. 

• Biometric information. 

• Genetic data. 

• Information about your access to healthcare, including precise location information that could reasonably indicate an attempt to acquire or receive health services or supplies; or

• Information processed to associate or identify an individual with the data listed above that is derived or extrapolated from non-health information.

• Information related to the precise (geo)location information of a consumer used to indicate an attempt by a consumer to receive health care services or products. 

• Other information that may be used to infer or derive data related to the above or other consumer health data. 

• 
  

SOURCES OF CONSUMER HEALTH DATA

We collect consumer health data that you provide to us, consumer health data we collect automatically when you use the Sites, and consumer health data from third-party sources, as described in our Privacy Notice and below.

WHY WE COLLECT AND USE CONSUMER HEALTH DATA

We collect and use consumer health data for the purposes and in the manner described in the “Use of your Information” section of our Privacy Notice. 

Primarily, we collect and use consumer health data as reasonably necessary to provide you with the products or Services you have requested or authorized. This may include delivering and operating the products or Services and their features, personalization of certain product or Sites features, ensuring the secure and reliable operation of the products or Services and the systems that support them, troubleshooting and improving the products and Services, and other essential business operations that support the provision of the products and Services (such as analyzing our performance and meeting our legal obligations).

We may also use consumer health data for other purposes for which we give you choices and/or obtain your consent as required by law.

SHARING OF CONSUMER HEALTH DATA

We may share each of the categories of consumer health data described above for the purposes described above and in the “Use of your Information” section of our Privacy Notice.

We only share or disclose your consumer health data as needed to provide you with the products or Services that you request, or with your explicit consent. We may share or disclose any or all the above categories of consumer health data to the following entities, who shall use the data only as permitted for the purposes set forth above, and within the bounds of our contracts with them:

These general categories of third parties:

• Service Providers (including those hosting or analyzing data on our behalf, those assisting with fraud prevention, those assisting in program administration, those assisting in incident management and reporting, those administering our call center and websites, and those who assist with our information technology and security programs)

• Emergency Personnel

• Authorized/legal representatives, family members, and caregivers

• Third parties (including those with whom Openwell Health has joint marketing and similar arrangements, those who provide marketing and data analytics services, those who provide program enrollment or product fulfillment, payment, and authorization, other third parties as necessary to complete transactions and provide products or Services, or where required by law)

• Openwell Health lawyers, auditors, and consultants

• Legal and regulatory bodies

In addition, we may share or disclose consumer health data as permitted or required by law, such as (i) to an acquiring organization if we are involved in a sale or a transfer of our business, (ii) as needed to prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, (iii) in situations that may involve violations of our terms of use or other rules, (iv) to protect our rights and the rights and safety of others, (v) as needed to support external auditing, compliance and corporate governance functions, (vi) as needed to preserve the integrity or security of our systems, or (vii) to investigate, report, or prosecute those responsible for any action that is illegal under applicable state or Federal law.

HOW TO EXERCISE YOUR RIGHTS

The CTDPA, MHMDA, and NVCHDPL provide consumers with certain rights with respect to consumer health data.

Under MHMDA, consumers have the right to: (i) confirm whether Openwell Health is collecting, sharing, or selling consumer health data and to access such data; (ii) withdraw consent from Openwell Health’s collection and sharing of consumer health data; and (iii) request that Openwell Health delete consumer health data.

Under NVCHDPL, consumers have the right to: (i) confirm whether Openwell Health is collecting, sharing or selling consumer health data; (ii) have Openwell Health provide the consumer with a list of all third parties with whom Openwell Health has shared consumer health data relating to the consumer or to whom Openwell Health has sold such consumer health data; (iii) request that Openwell Health cease collecting, sharing, or selling consumer health data relating to the consumer; and (iv) request that Openwell Health delete consumer health data.

Under CTDPA, Openwell Health is required to obtain consumer consent prior to selling or offering to sell, consumer health data. Consumers have the right to: (i) confirm whether Openwell Health is collecting or sharing consumer health data; (ii) have Openwell Health provide the categories of consumer health data that it shares with third parties and the categories of third parties with which it shares consumer health data; and (iii) withdraw consent from Openwell Health’s selling of consumer health data.

The rights afforded to consumers under CTDPA, MHMDA, and NVCHDPL are subject to certain exceptions. 

Subject to certain legal limitations and exceptions, you have the following rights with respect to any consumer health data we may collect about you:

• The right to confirm whether we are collecting, sharing, or selling your consumer health data and to access such data, including to receive a list of affiliates or specific third parties with whom we have shared or sold your information, along with contact information such as an active email address for each third party;

• The right to review and request corrections to your consumer health data;

• The right to withdraw consent from our collection or sharing of your consumer health data; and

• The right to request that we delete your consumer health data.

you may submit a request pursuant to any of these rights by contacting us as described in “Making Access, Deletion, and Correction Requests.”

Openwell Health will not discriminate against you for exercising any of your rights. We will make reasonable efforts to respond promptly to your requests in accordance with applicable laws. Please allow 45 days for a response.  We may, after receiving your request, require additional information from you to authenticate your request and verify your identity. Please be aware that we may be unable to afford these rights to you under certain circumstances, such as if we are legally prevented from doing so. If we deny your request, you have the right to appeal that denial by contacting us as described in “Making Access, Deletion, and Correction Requests.” We will process and respond to your appeal within the time permitted by applicable law. 

If you are a Washington resident and your appeal is unsuccessful, you may file a complaint with the Washington State Attorney General at www.atg.wa.gov/file-complaint.

CHANGES TO OUR CONSUMER HEALTH DATA PRIVACY STATEMENT

We may update this Consumer Health Data Privacy Statement from time to time. When we do update it, for your convenience, we will make the updated statement available on this page. Our intention is to use consumer health data in accordance with the Consumer Health Data Privacy Statement in place at the time the consumer health data was collected.