Consumer Health Data Privacy Policy

1. Scope of this Policy

This Consumer Health Data Privacy Policy describes how Jupiter Health, Inc., a Delaware corporation doing business as Wellward ("Wellward," "we," "us," or "our") collects, uses, shares, and protects "Consumer Health Data" as defined under Washington's My Health My Data Act and similar state consumer health data laws. This policy supplements our general Privacy Policy and, where applicable, our Notice of Privacy Practices. Where there is a conflict between this policy and our general Privacy Policy with respect to Consumer Health Data, this policy controls; where there is a conflict between this policy and our Notice of Privacy Practices with respect to PHI, the Notice of Privacy Practices controls.

2. Categories of Consumer Health Data We Collect

"Consumer Health Data" includes personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status. The categories of Consumer Health Data we collect include:

Individual health conditions, treatments, diseases, and diagnoses you share with us during intake or with our care navigators.
Information about social, psychological, behavioral, and medical interventions you have received or are considering.
Health-related surgeries, procedures, and other medical interventions.
Use or purchase of medications, including prescription medications you are filling, switching, or evaluating.
Bodily functions, vital signs, symptoms, or measurements you share with us.
Diagnoses, diagnostic-testing results, and lab or imaging results you share with us.
Reproductive or sexual health information you share with us.
Gender-affirming care information you share with us.
Biometric data you share with us (Wellward does not currently collect biometric data, but reserves the right to update this Policy if it begins to do so).
Genetic data you share with us (Wellward does not currently collect genetic data, but reserves the right to update this Policy if it begins to do so).
Information that identifies your seeking or obtaining healthcare services, including precise location information that could reasonably indicate your attempt to acquire or receive healthcare services.
Information that identifies your health-related insurance status or coverage.
Information that you provide that, when combined with other information about you, reasonably identifies your physical or mental health status.

3. Sources of Consumer Health Data

We collect Consumer Health Data from the following sources:

Directly from you, including through our intake, member account, concierge messages, uploaded documents (such as bills and prescriptions), and forms you submit.
From healthcare providers, pharmacies, laboratories, imaging centers, payers, and other third parties, but only with your written authorization.
Automatically from your interactions with the Services, such as your activity log within your member account (we do not use third-party tracking technologies on authenticated member surfaces).
From publicly available sources such as the federal HRSA database of community health centers (for provider data, not consumer data).

4. Purposes for Collecting and Using Consumer Health Data

We use Consumer Health Data for the following purposes:

To provide the Services you have purchased, including curating your Personal Provider Lineup, comparing pharmacy prices, reviewing bills, preparing appeals, recommending insurance plans, and answering your concierge questions.
To communicate with you about the Services and to deliver appointment reminders, lineup updates, and concierge replies.
To authenticate your identity and to process payments through our payment processor.
To maintain the security, integrity, and availability of the Services, and to investigate and prevent fraud, security incidents, and other violations of our Terms of Service or applicable law.
To comply with our legal, regulatory, audit, and reporting obligations.
To improve the Services through aggregated or de-identified analytics. We do not use Consumer Health Data to train AI models, and our AI vendors are contractually prohibited from doing so.

5. Sharing of Consumer Health Data

We share Consumer Health Data only in the categories described below, and only with the categories of third parties listed below.

5.1 Categories of Third Parties

Service providers that act as processors and are bound by contract to protect Consumer Health Data, such as cloud hosting, database, communications, customer support, and security and audit-logging providers.
Business Associates under HIPAA: service providers that may handle PHI on our behalf, bound by Business Associate Agreements as well as our processor terms.
Healthcare providers, pharmacies, payers, and similar third parties: only with your specific written authorization and only as necessary to provide the Services you have requested.
Government authorities, regulators, and law enforcement: only as required by law.
Successors in interest: in the event of a corporate transaction such as a merger, acquisition, or sale of assets, subject to continued protection of Consumer Health Data and consistent with applicable law.

5.2 No Sale of Consumer Health Data

We do not sell Consumer Health Data. We do not exchange Consumer Health Data for monetary or other valuable consideration, and we do not share Consumer Health Data for cross-context behavioral advertising. We will not sell Consumer Health Data without first obtaining your separate, valid authorization that meets the requirements of WMHMDA and similar laws.

6. Your Rights

If you are a resident of Washington State, you have the following rights with respect to your Consumer Health Data under WMHMDA. Residents of other states with consumer health data laws may have similar rights and may exercise them in the same manner. We will respond to your request within 45 days, with a possible 45-day extension upon notice to you.

Right to Confirm and Access. You have the right to confirm whether we collect, share, or sell your Consumer Health Data, and to access that data, including a list of all third parties and affiliates with whom we have shared or to whom we have sold it.
Right to Withdraw Consent. You have the right to withdraw consent to our collection and sharing of your Consumer Health Data. Withdrawal will not affect collection or sharing that occurred before withdrawal.
Right to Delete. You have the right to have your Consumer Health Data deleted, including all archived or backup copies, subject to exceptions permitted by law (for example, retention required under HIPAA or for legal claims). We will inform any third party with whom we have shared the data of your deletion request unless impossible or involving disproportionate effort.
Right to Non-Discrimination. We will not deny you services or charge you a different price for exercising your rights, except where the exercise of the right (for example, deletion of intake information) prevents us from being able to provide the Services.

7. How to Exercise Your Rights

To exercise any of these rights, contact us at:

Email: hello@wellwardhealth.com
Mail: Jupiter Health, Inc. d/b/a Wellward, Attn: Privacy, 860 Broadway, 6th Floor, New York, NY 10003

We will verify your identity before responding to your request, using information already in our possession (such as your registered email address) or by asking you to provide additional information. We will not require you to create an account to submit a request, but if you already have an account, we may require you to use it to verify your identity.

8. Authorized Agents

You may designate an authorized agent to submit a request on your behalf. We will require written authorization from you and reasonable verification of the agent's identity and authority. An authorized agent who is a business with which you have a contractual relationship may not exercise your rights unless you have signed a separate written authorization or unless the agent has been granted power of attorney.

9. Right to Appeal

If we decline to take action on your request, we will inform you in writing of the reasons and explain how you may appeal. If you submit an appeal, we will respond within 45 days, in writing, with our reasons. If we deny your appeal, you may contact the attorney general of your state. For Washington residents, the Washington Attorney General can be reached at https://www.atg.wa.gov/file-complaint.

10. Children

The Services are not directed to individuals under 18, and we do not knowingly collect Consumer Health Data from individuals under 18. If we learn that we have collected Consumer Health Data from a person under 18, we will delete it. Where a parent or guardian has shared information about a minor dependent in the course of obtaining the Services for the dependent, the parent or guardian may exercise the rights described above on the dependent's behalf.

11. Changes to this Policy

We may update this policy from time to time. We will post the revised policy on our website and update the "Last Updated" date. Where a change is material and required by law, we will obtain renewed consent.

12. Contact

If you have questions about this policy or our handling of Consumer Health Data, please contact us at hello@wellwardhealth.com or at the mailing address above.