Consumer Health Data Privacy Policy

1. Scope and HIPAA Exemption

This Consumer Health Data Privacy Policy applies to consumer health data Marpass, Inc., a Delaware corporation, processes about Washington consumers under the Washington My Health My Data Act (RCW 19.373). Most health information Marpass handles is protected health information (PHI) processed as a HIPAA Business Associate under our Business Associate Agreement (BAA) with covered-entity customers. PHI handled under HIPAA and the BAA is exempt from MHMDA. This policy addresses any consumer health data that is not exempt.

2. Categories Collected, Sources, and Purposes

Where Marpass collects consumer health data that is not HIPAA-exempt (for example, limited inquiries submitted through the public website), the categories may include contact information, the nature of the inquiry, and information voluntarily provided by the consumer. The data is collected directly from the consumer for the purpose of responding to the inquiry, providing information about the service, and complying with applicable law. Marpass does not use consumer health data for advertising or for any unrelated secondary purpose.

3. No Sale, No Unrelated Sharing, Consent

Marpass does not sell consumer health data. Marpass will not collect, share, or process consumer health data beyond what is necessary to provide a product or service the consumer has requested, without obtaining the consumer's separate valid authorization or affirmative consent as required by MHMDA. Processors and subprocessors who handle consumer health data on Marpass's behalf are bound by contract to obligations equivalent to those Marpass owes the consumer.

4. Your Washington Consumer Rights

As a Washington consumer, you have the right to:

• Confirm whether Marpass is collecting, sharing, or selling your consumer health data and access that data.
• Withdraw consent to Marpass collecting or sharing your consumer health data.
• Have your consumer health data deleted, subject to legal record-retention rules and any obligations imposed by the BAA on PHI.
• Appeal a denial of any of these rights through the contact methods below.

To exercise any of these rights, contact us at info[at]marpass.com. We will respond to your request within 45 days, as required by MHMDA.

5. Subprocessors

A current list of subprocessors that may handle data on Marpass's behalf is published at /subprocessors. Subprocessors are bound by contract to handle consumer health data only on Marpass's documented instructions and to obligations equivalent to those Marpass owes the consumer.

6. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will notify consumers of material changes by posting the updated policy on this page and updating the "Last updated" date.