Consumer Health Data Privacy Policy
This policy is published by KP Innovations LLC dba DrWell ("DrWell," "we," or "us") for the website at www.drwell.com and the DrWell services (the "Service"). It explains how we collect, use, and share consumer health data and what rights you have. It applies to consumers protected by the Washington My Health My Data Act, the Nevada consumer health data law, the Connecticut Data Privacy Act's consumer health data provisions, and similar laws. It supplements our Privacy Policy (www.drwell.com/privacy-policy) and our Cookie Policy (www.drwell.com/cookie-policy). If this policy and the Privacy Policy differ on consumer health data, this policy controls.
This policy does not cover protected health information ("PHI") that is governed by HIPAA. PHI that your Medical Group or Provider holds is covered by their Notice of Privacy Practices.
What is consumer health data
Consumer health data is personal information that identifies your past, present, or future physical or mental health status, including health conditions and treatments, medications and prescriptions, purchases of health products and services, biometric data, and information that we derive or infer from such data, including from pages you view about a treatment.
What we collect and why
| Category | Examples | Why we collect it |
|---|---|---|
| Health information you provide | Medical history, current conditions, medications, treatment history, height and weight, and answers to intake questionnaires | So Providers can evaluate you, prescribe when appropriate, and care for you |
| Orders and prescriptions | Products and treatments you order, prescriptions sent to a pharmacy, shipping details | To fulfill your orders and process refunds and support requests |
| Browsing activity related to health | Pages you view about a treatment, searches and clicks, form activity on our public website, and inferences about your interests | To run and secure the website, understand how it is used, and, only if you allow it, measure and deliver our advertising |
| Identity verification information | Driver's license image and number | To verify that you are the patient, prevent fraud, and meet our clinical and legal obligations |
| Biometric data | A selfie and the facial geometry derived from it, compared to your license photo | To verify your identity when our standard cross-check cannot. See Biometric Data below |
| Communications | Messages you send us or your Provider about your care or an order | To respond to you and coordinate your care |
| General location | City and state inferred from your IP address | To confirm that the Service is available in your state and apply the correct laws |
Where it comes from
- You, when you create an account, complete intake, place an order, verify your identity, or contact us.
- Your devices and browser, automatically, when you use our website.
- Your Medical Group, Providers, Pharmacies, and Labs, when they send us information needed to provide your care or fulfill your order.
- Our identity verification vendor, which tells us whether you were verified.
- Our payment processor, which confirms payments and refunds.
Your consent
Collection. When you start intake, create an account, or submit identity verification, we ask for your consent to collect and use the consumer health data needed for that purpose. Your consent to collect is separate from your consent to share. Using the website does not by itself give us consent to collect or share consumer health data, other than the technical information the website needs to operate.
Sharing. We share consumer health data with advertising and analytics companies only if you accept the matching category in our cookie banner. We do not need your consent to share data that is necessary to provide the service you asked for, such as sending a prescription to a pharmacy.
New uses. If we want to collect, use, or share consumer health data for a purpose or category not described here, we will first update this policy and ask for your consent.
You can withdraw your consent at any time, as described under Your rights.
Who we share it with
| Category of recipient | Specific recipients | Data shared | Purpose |
|---|---|---|---|
| Medical Groups and Providers (affiliated medical practices) | Your Medical Group and the Providers who treat you | Health information, orders, identity information, communications | Evaluation, treatment, and prescribing |
| Pharmacies and Labs | DiRx Health and other pharmacies in our network, and laboratories you use | Health information needed to fill a prescription or run a test, your name, shipping address | Fulfillment of your prescriptions and tests |
| Identity verification vendor | Vouched | Driver's license image and number, selfie, biometric data | Verifying your identity |
| Payment processor | Finix | Purchase and payment information | Processing payments and refunds |
| Service providers that work on our behalf | Providers of hosting, security, email and text messaging, customer support, and customer records, including HubSpot | Contact information and the health information needed for the service | Operating the Service under contracts that limit their use of the data |
| Analytics providers (only after you accept the Analytics category) | Google Analytics, HubSpot, PostHog (including session replay with form fields masked), Wistia | Identifiers, device information, pages viewed, and actions on our public website | Understanding how the website is used |
| Advertising partners (only after you accept the Advertisement category) | Meta, Google, LinkedIn, Reddit, Microsoft Advertising, NextRoll and its advertising partners, Vibe, Quorum, and our call and lead tracking service | Identifiers, device information, and pages viewed on our public website, which can indicate interest in a treatment | Measuring and delivering our advertising |
| Government and legal | Regulators, courts, and law enforcement | Information required by law or valid legal process | Legal compliance and protecting rights and safety |
| Business transfers | A buyer or successor in a merger, acquisition, or sale of assets | Information held by DrWell | Continuing the Service, with this policy continuing to apply |
We do not run advertising or analytics technologies in the DrWell web application or on pages where you enter health information. We do not send your intake and questionnaire answers, medical records, or prescription information to advertising or analytics companies.
We may share data that has been de-identified or aggregated so that it cannot reasonably identify you. We do not try to re-identify it.
You can request a current list of the specific third parties and affiliates that received your consumer health data, with their contact information, by emailing privacy@drwell.com. Our Privacy Policy and Cookie Policy also list the advertising and analytics companies we use.
We do not sell consumer health data
We do not sell consumer health data that identifies you. If we ever wanted to, we would first obtain your signed valid authorization as the law requires. We do not use a geofence around any facility that provides in-person health care.
Biometric data
If our standard identity cross-check does not verify you, we may require a selfie at checkout. We and our identity verification vendor compare it to the photo on your driver's license using facial geometry. Before we capture it, we tell you what is collected and why, and ask for your consent. We use it only to verify your identity and prevent fraud. We do not sell it, profit from it, or use it for advertising. We delete your selfie and the facial geometry derived from it when verification is complete, and within 30 days at the latest. See the Biometric Information section of our Privacy Policy.
Minors
A minor may receive care through the Service only through an account created and managed by a parent or legal guardian, and only where the DrWell Provider determines in the Provider's discretion that the minor is eligible. The parent or guardian gives consent for the minor's consumer health data and may exercise the rights below for the minor. We do not collect consumer health data directly from a child under 13, and we do not knowingly sell or share the personal information of anyone under 16.
Your rights
You have the right to:
- Confirm whether we are collecting, sharing, or selling your consumer health data.
- Access your consumer health data, including a list of all third parties and affiliates with whom we have shared it, with their contact information.
- Withdraw your consent to our collection or sharing of it.
- Have it deleted.
How to ask. Email privacy@drwell.com, call 833-837-9355, or write to DrWell Privacy Office, 2100 Webster St, #429, San Francisco, CA 94115. To withdraw consent for advertising and analytics, you can also select "Your Privacy Choices" at the bottom of any page or the cookie icon at the bottom left. We may need to verify your identity before acting on your request.
Timing. We respond within 45 days of receiving your request. If we need more time, we may extend that period once by up to 45 more days and will tell you why within the first 45 days.
Deletion. When we delete your consumer health data, we delete it from our records and notify our affiliates, processors, contractors, and other third parties that received it, so they delete it too. Data held in archives or backups may take up to six months to be deleted. We may keep information that the law requires us to keep, such as medical and transaction records, and we will tell you what we kept and why.
Appeals. If we decline your request, you may appeal by emailing privacy@drwell.com with the subject line "Privacy Appeal." We respond in writing within 45 days of receiving your appeal. If we deny your appeal, you may contact your state attorney general to submit a complaint. In Washington, you can do so at www.atg.wa.gov/file-complaint.
We do not treat you differently for exercising these rights.
Security
We use administrative, technical, and physical safeguards appropriate to the sensitivity of consumer health data. We limit access to the employees, processors, and contractors who need it to do their jobs, and we require our processors to protect it by contract.
How long we keep it
We keep consumer health data only as long as needed for the purposes above or as the law requires. Medical records are kept as required by the laws of your state. The retention periods for the main types of data are in the Data Retention Policy section of our Privacy Policy.
Changes to this policy
We may update this policy. The "Last updated" date above shows the latest version. If a change adds a category of consumer health data or a purpose for using or sharing it, we will ask for your consent before applying it to you.
Contact
Questions about this policy: privacy@drwell.com, 833-837-9355, or DrWell Privacy Office, 2100 Webster St, #429, San Francisco, CA 94115.
%20(1)%20(1)%20(1).png)