Washington Consumer Health Data Privacy Policy
This Washington Consumer Health Data Privacy Policy supplements the Thymos Health Privacy Policy and applies to Consumer Health Data subject to the Washington My Health My Data Act ("MHMDA") that is collected by Thymos Health, Inc. or Thymos Provider Group, PC.
1. Important Scope and Healthcare Exemptions
Much of the health information maintained by Thymos is governed by HIPAA, Washington healthcare privacy law, or other healthcare laws and is therefore exempt from the MHMDA.
The MHMDA generally does not apply to:
- Protected Health Information governed by HIPAA;
- healthcare information collected, used, or disclosed in accordance with applicable Washington healthcare privacy law;
- qualifying records protected by 42 C.F.R. Part 2;
- qualifying research information;
- qualifying de-identified healthcare information; and
- certain information originating from and intermingled with exempt healthcare information when maintained by a HIPAA covered entity or Business Associate.
This Policy applies only to Consumer Health Data that is not exempt and is otherwise subject to the MHMDA.
For PHI and medical records, please review the Thymos Provider Group Notice of Privacy Practices and the main Thymos Health Privacy Policy.
2. Consumer Health Data We May Collect
Depending on how you interact with Thymos, non-exempt Consumer Health Data may include:
Health Interests and Healthcare-Seeking Activity
Information indicating or potentially suggesting that an individual:
- visited particular health or disease-related content;
- sought information about autoimmune disease or related healthcare;
- requested or downloaded health-related educational materials;
- interacted with a healthcare-related webpage or feature; or
- otherwise demonstrated an interest in obtaining or learning about healthcare services.
Health Conditions and Health-Related Information
Where not otherwise exempt, this may include information relating to:
- health conditions;
- symptoms;
- diagnoses;
- treatments;
- medications;
- bodily functions;
- laboratory or diagnostic information;
- mental or behavioral health;
- reproductive or sexual health;
- genetic information;
- nutrition;
- sleep;
- activity;
- environmental health; or
- other information used to identify or infer a person's past, present, or future health status.
Derived or Inferred Consumer Health Data
Consumer Health Data may include health information derived or inferred from other data, including through analytics, algorithms, or interaction with health-related content.
Location Information
Thymos does not currently collect continuous or background precise GPS location through its mobile application.
A patient may manually provide a physical location where needed for telehealth care.
If location information were used in a manner that constitutes Consumer Health Data under Washington law and is not otherwise exempt, this Policy would apply.
3. Why We Collect and Use Consumer Health Data
Where the MHMDA applies, we may collect and use Consumer Health Data to:
- provide a product, resource, healthcare service, or other service that you request;
- provide health-related educational content;
- respond to inquiries;
- understand how public website content is used;
- improve the functionality and performance of our Services;
- maintain security;
- prevent fraud and misuse;
- administer accounts or requested services;
- communicate with you;
- comply with legal obligations; and
- perform other purposes disclosed to you for which consent is obtained when required.
We collect Consumer Health Data where:
- it is necessary to provide a product or service you requested; or
- you provide the consent required by applicable law.
4. Sources of Consumer Health Data
We may obtain Consumer Health Data from:
- You, including information you submit or actions you take.
- Your browser or device, including interaction with public website content and technical information.
- Thymos websites and digital services, through information generated when you interact with them.
- Healthcare providers and organizations, but only at your request or authorization and typically subject to healthcare-law exemptions described above.
- Service providers, where they support Thymos's requested services or permitted operations.
5. Consumer Health Data We May Share
Where information is subject to MHMDA, categories of Consumer Health Data that may be shared as necessary to provide requested services or with consent where required may include:
- healthcare-seeking information;
- health interests;
- health-related website interactions;
- health conditions or symptoms;
- diagnostic or treatment-related information;
- health measurements;
- manually provided location relevant to care;
- health-related communications;
- information identifying that a health-related service or resource was requested; and
- derived or inferred health information.
Much of Thymos's actual clinical sharing occurs within HIPAA-regulated healthcare activities and is therefore outside the scope of this Policy.
6. Categories of Recipients and Specific Affiliates
Where Consumer Health Data subject to the MHMDA is shared as necessary to provide a requested service or with appropriate consent, recipients may include:
- healthcare professionals and healthcare organizations;
- laboratories, pharmacies, imaging providers, and similar healthcare-service providers;
- technology and infrastructure processors;
- authentication and security providers;
- customer-service providers;
- analytics and website-infrastructure providers;
- payment processors;
- records-transfer providers; and
- governmental, regulatory, or legal recipients where legally permitted or required.
Specific Thymos affiliates that may receive Consumer Health Data are:
Thymos Health, Inc.
Thymos Provider Group, PC
Processors are contractually required to process covered information consistently with applicable law and Thymos's instructions.
7. Analytics and Advertising
Public portions of the Thymos website may use analytics and infrastructure services to understand website performance and use.
Thymos does not configure these technologies to capture the values users enter for fields such as first name, last name, email address, telephone number, or state on the Autoimmune Guide form.
Thymos does not permit advertising or analytics trackers in the clinical mobile experience once a person begins:
- patient registration;
- intake;
- symptom questionnaires;
- clinical scheduling;
- payment-for-care; or
- authenticated patient functionality.
Thymos does not upload patient lists or health-derived prospect lists to advertising platforms for Customer Match, Custom Audiences, lookalike audiences, retargeting, or similar audience-building.
Thymos does not send advertising platforms conversion events reflecting disease-specific page visits, Autoimmune Guide downloads or submissions, commencement of intake, or similar health-derived activities.
8. Sale of Consumer Health Data
Thymos does not sell Consumer Health Data.
Thymos does not exchange Consumer Health Data for money or other valuable consideration in a manner that constitutes a sale under the MHMDA.
If this practice were ever to change, Thymos would first implement the separate written authorization process required by applicable law.
9. Global Privacy Control
Thymos recognizes applicable browser-based universal opt-out preference signals, including Global Privacy Control, where required by law.
Thymos does not use GPC-signaling visitors' information in a manner inconsistent with an applicable legally recognized opt-out preference.
10. Your Washington Rights
For Consumer Health Data subject to the MHMDA, you may have the right to:
- confirm whether Thymos is collecting, sharing, or selling Consumer Health Data about you;
- access Consumer Health Data about you;
- receive a list of third parties and affiliates with whom covered Consumer Health Data has been shared or sold, together with applicable contact information;
- withdraw consent to future collection or sharing where processing is based on consent;
- request deletion of covered Consumer Health Data;
- appeal a refusal to act on an applicable request; and
- exercise these rights without unlawful discrimination.
Because PHI and other healthcare information may be exempt from MHMDA, requests concerning your medical record may instead be handled under HIPAA, Washington healthcare privacy law, and the Thymos Provider Group Notice of Privacy Practices.
11. How to Exercise Your Rights
You may submit a request by contacting:
Email: privacy@thymoshealth.com
Phone: (415) 379-0745
You may also use Thymos's applicable privacy or account-deletion request mechanisms.
We may take commercially reasonable steps to authenticate your identity.
You are not required to create a new account solely to exercise MHMDA rights, although Thymos may ask you to authenticate through an existing account where appropriate.
12. Deletion Requests
Where the MHMDA applies to information covered by a valid deletion request, Thymos will:
- delete the covered Consumer Health Data from its applicable records and systems;
- notify applicable affiliates, processors, contractors, and other recipients of the deletion request where required; and
- require applicable recipients to honor the request as required by law.
Where covered Consumer Health Data exists in archived or backup systems, deletion may be delayed for the period permitted by Washington law, which may be up to six months following authentication of the request.
A MHMDA deletion request does not require destruction of PHI, medical records, or other information that is exempt from MHMDA and retained pursuant to healthcare law.
13. Response and Appeal Process
Thymos will respond to authenticated requests within the period required by applicable law.
If Thymos declines to act on an applicable MHMDA request, you may appeal by contacting:
Please include "Washington Privacy Appeal" in the subject line.
Thymos will respond to an appeal within the period required by law and, where required, provide information about how to contact the Washington Attorney General if the appeal is denied.
14. Security
Thymos limits access to Consumer Health Data to workforce members and processors where reasonably necessary for the applicable purpose.
We maintain administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of Consumer Health Data.
15. Changes to This Policy
If Thymos proposes to collect, use, or share additional categories of Consumer Health Data subject to the MHMDA, or to use such data for materially additional purposes, Thymos will update this Policy and obtain affirmative consent before the new collection, use, or sharing where required by law.
16. Contact
Thymos Health Privacy Office
Thymos Health, Inc.
Thymos Provider Group, PC
Attn: Nilesh Bhandari, COO and Privacy/Security Officer
679 S. Eliseo Dr.
Greenbrae, CA 94904
Phone: (415) 379-0745
Email: privacy@thymoshealth.com
See also our Privacy Policy.