Consumer Health Data Privacy Notice

This Notice applies to Washington State residents and, where applicable, residents of other states with similar consumer health data privacy laws (including Nevada, Connecticut, and others as enacted). It covers consumer health data we collect about you outside of the HIPAA-regulated treatment relationship, such as data collected through our website, marketing tools, quiz funnels, and analytics platforms.

Data collected and used solely in connection with your treatment as a Covenix patient is governed by our HIPAA Notice of Privacy Practices, not this Notice.

Under the MHMD Act, "consumer health data" means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status. This includes, but is not limited to:

• Individual health conditions, diseases, or diagnoses
• Social, psychological, behavioral, and medical interventions
• Health-related surgeries or procedures
• Use or purchase of prescribed medication
• Bodily functions, vital signs, symptoms, or measurements
• Reproductive or sexual health information
• Gender-affirming care information
• Precise geolocation data that could reasonably indicate a consumer's attempt to acquire or receive health services
• Any information that identifies a consumer seeking health care services

We may collect the following categories of consumer health data through our website and marketing activities:

We use consumer health data for the following purposes:

• To respond to your inquiries and provide information about our programs
• To route quiz leads to appropriate program recommendations
• To send you relevant health and wellness communications (with your consent)
• To improve our website content and user experience
• To operate our CRM and patient acquisition systems (GoHighLevel)
• To comply with legal obligations

We do not sell your consumer health data to third parties for their own marketing purposes.

We may share consumer health data with the following categories of parties:

We do not share consumer health data with data brokers, advertising networks for targeted advertising based on health data, or any party for purposes not described in this Notice without your explicit consent.

If you are a Washington State resident, you have the following rights regarding your consumer health data:

To exercise any of your rights described in this Notice, please contact us using one of the following methods:

We will respond to verifiable consumer requests within 45 days of receipt. We may extend this period by an additional 45 days when reasonably necessary, with notice to you. We will not charge a fee for processing your request unless it is excessive, repetitive, or manifestly unfounded.

We may need to verify your identity before processing your request. We will not require you to create an account to submit a request.

Under the MHMD Act, certain categories of consumer health data are considered "sensitive" and require your affirmative, freely given, specific, informed, and unambiguous consent before collection or sharing. These categories include data related to:

• Mental health conditions
• Reproductive health and fertility
• Gender-affirming care
• Substance use disorders
• HIV/AIDS status
• Precise geolocation indicating health service access

Where we collect sensitive consumer health data, we will obtain your explicit consent prior to collection. You may withdraw this consent at any time by contacting us at [email protected].

We retain consumer health data only as long as necessary to fulfill the purposes described in this Notice, or as required by law. Quiz lead data is retained in our CRM for up to 3 years for marketing and follow-up purposes. Website analytics data is retained per the data retention policies of our analytics providers (typically 14-26 months for Google Analytics; up to 2 years for Meta).

Upon a verified deletion request, we will delete your consumer health data within 45 days, subject to legal retention requirements.

In compliance with the MHMD Act, Covenix Health does not use geofencing technology around any entity that provides in-person health care services for the purpose of identifying, tracking, or collecting consumer health data from consumers who enter or are near such locations.

We may update this Notice from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will post the updated Notice on this page with a revised "Last Updated" date. If we make material changes, we will provide additional notice (such as by email or a prominent notice on our website) before the changes take effect.

If you have questions, concerns, or complaints about this Notice or our consumer health data practices, please contact us:

You also have the right to file a complaint with the Washington State Attorney General's Office if you believe your rights under the MHMD Act have been violated.