Washington Consumer Health Data Privacy Policy
M3 Mental Health and Pain Review · M3MentalHealth.org
M-3 Information, LLC · 155 Gibbs Street, Rockville, MD 20850
Effective Date / Last Modified: July 8, 2026
This Consumer Health Data Privacy Policy is provided under Washington’s My Health My Data Act, RCW ch. 19.373 (“MHMDA”), and applies to “consumer health data” we collect from Washington consumers and from persons whose consumer health data is collected in Washington. As a matter of practice, M-3 Information, LLC and its subsidiaries, affiliates, and operating ventures (“M3,” “we,” “us,” or “our”) extend these protections to all users of the M3 Mental Health and Pain Review, including residents of Nevada, whose consumer health data is protected under Nevada Senate Bill 370, and residents of Connecticut, whose consumer health data is protected under the Connecticut Data Privacy Act. This Policy supplements our general Privacy Policy, our Terms and Conditions, and, where protected health information subject to HIPAA is involved, our Notice of Privacy Practices, each posted at M3MentalHealth.org. In the event of a conflict regarding consumer health data of a Washington or Nevada consumer, this Policy controls.
1. Consumer Health Data We Collect
“Consumer health data” means personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. When you use the M3 assessment, we collect:
your responses to the M3 Checklist (which screens for symptoms associated with depression, anxiety, bipolar disorder, and PTSD) and the optional PEG pain scale;
the scores, severity ranges, and reports generated from those responses; and
account information used to deliver and retrieve your report, such as name, email address or phone number, and date of birth.
2. Sources of Consumer Health Data
Consumer health data comes directly from you when you complete an assessment and when you create or access your account. We do not purchase consumer health data, and we do not collect it from data brokers or infer it from your activity on other websites.
3. How We Use Consumer Health Data
We collect and use consumer health data only for the following purposes:
to generate, deliver, and let you securely retrieve your assessment report and history;
to provide customer support you request;
to operate, maintain, and secure the service, including fraud and abuse prevention; and
to comply with legal obligations.
We do not use consumer health data for advertising, including targeted advertising, and we do not process it for purposes not disclosed in this Policy without first obtaining your consent.
4. How We Share Consumer Health Data; No Sale
We do not sell consumer health data, and we will not sell it without the valid written authorization MHMDA requires, which is separate from consent and revocable. We share consumer health data only:
at your direction or with your consent (for example, if you choose to share your report with a healthcare provider);
with service providers (processors) that help us operate the service under written contracts that limit their use of the data to our documented instructions and require its protection and deletion; and
where required by law, legal process, or to protect vital interests as permitted by MHMDA.
A current list of the third parties and affiliates, if any, with whom your consumer health data has been shared, and the purpose of the sharing, is available on request through the contact methods in Section 9.
Deidentified data. Information that has been deidentified in accordance with recognized standards, including 45 C.F.R. § 164.514, so that it cannot reasonably be linked to you is not consumer health data under MHMDA. Our use of deidentified data for research and related purposes is described in Section 4 of our general Privacy Policy; we do not attempt to re-identify deidentified data and we contractually prohibit recipients from doing so.
5. Consent
We collect and process your consumer health data with your consent, obtained through a clear, affirmative, opt-in action before you begin the assessment, separate from any other transaction. We obtain separate consent before collecting or sharing consumer health data for any purpose beyond what is necessary to provide the service you requested. Consent obtained through deceptive design (“dark patterns”) is not valid consent, and we do not use such designs.
6. Your Rights
You have the right to:
confirm whether we collect, share, or sell your consumer health data, and access that data, including a list of all third parties and affiliates with whom we have shared it and an active email address or other online mechanism to contact those third parties;
withdraw your consent to our collection and sharing of your consumer health data; and
request that we delete your consumer health data, including from our archives, backups, and processors.
We will respond within 45 days of receipt of a verified request, extendable once by an additional 45 days where reasonably necessary, in which case we will notify you of the extension and the reason. Exercising your rights is free up to twice per year. We will not discriminate or retaliate against you for exercising any right under this Policy.
7. How to Exercise Your Rights; Appeals
To exercise any right, email support@m3mentalhealth.org from the email address associated with your account, or use the access, export, and deletion tools available in your account at any time. We may need to verify your identity before acting on a request; we will use the verification method least burdensome to you.
Appeals. If we decline to act on your request, we will tell you why and how to appeal. You may appeal by replying to our decision or emailing support@m3mentalhealth.org with the subject line “Appeal.” We will respond to your appeal in writing within 45 days with the reasons for our decision. If your appeal is denied, you may contact the Washington Attorney General at www.atg.wa.gov/file-complaint (Washington consumers) or the Nevada Attorney General (Nevada consumers).
8. Data Security; No Geofencing
We protect consumer health data with encryption in transit and at rest, role-based access controls limited to personnel who need the data to provide the service, and the other administrative, technical, and physical safeguards described on our Security & Interoperability page at M3MentalHealth.org. We restrict internal access to consumer health data to those employees, processors, and contractors for whom access is necessary to provide the service or their assigned duties.
We do not implement, and we prohibit our service providers from implementing on our behalf, any geofence around a facility that provides in-person health care services for the purpose of identifying or tracking consumers, collecting their consumer health data, or sending them notifications, messages, or advertisements, as prohibited by RCW 19.373.030.
9. Contact
M-3 Information, LLC · 155 Gibbs Street, Rockville, MD 20850 · 301-641-8045 · support@m3mentalhealth.org · Contact form at m3mentalhealth.org/contact.html.
Changes to this Policy will be posted at M3MentalHealth.org with an updated Effective Date.
IF YOU ARE IN CRISIS OR THINKING OF HARMING YOURSELF, CALL OR TEXT 988 (SUICIDE & CRISIS LIFELINE), CALL 911, OR GO TO YOUR NEAREST EMERGENCY ROOM.