Washington Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy is provided under Washington's My Health My Data Act (MHMDA) and applies to "consumer health data" we collect from Washington consumers. We extend these protections to all M3 users as a matter of practice. It supplements our general Privacy Policy.

1. Consumer health data we collect

When you use the M3 assessment, we collect the health information you provide and the results we generate, including:

• Your responses to the M3 Checklist and the optional PEG pain scale;
• The scores and severity ranges generated from those responses (your report);
• Account information used to deliver and retrieve your report (name, email or phone, date of birth).

2. Where the data comes from

Consumer health data comes directly from you when you complete the assessment and create or access your account. We do not purchase consumer health data.

3. How we use it

We use consumer health data only to generate your report, let you securely retrieve your history, provide customer support, and operate and secure the service. We do not use it for advertising.

4. How we share it

We do not sell consumer health data. We share it only:

• with your direction or consent (for example, if you choose to share your report with a healthcare provider);
• with service providers (processors) who help us operate the service under contracts that limit their use of the data; and
• where required by law.

5. Consent

We collect and process your consumer health data with your consent, obtained through a clear, affirmative opt-in before you begin the assessment. We obtain separate consent before sharing your consumer health data for any purpose not necessary to provide the service, and we will not sell consumer health data without your valid written authorization.

6. Your rights

You have the right to:

• confirm whether we collect, share, or sell your consumer health data, and access it — including a list of any third parties and affiliates with whom it has been shared;
• withdraw your consent to our collection and sharing of your consumer health data; and
• request that we delete your consumer health data, including from our processors.

We will respond within 45 days (extendable once by 45 days where permitted). We will not discriminate against you for exercising these rights.

7. How to exercise your rights

Email support@m3mentalhealth.org with your request. You can also access, export, or delete your record from your account at any time.

8. Data security

We protect consumer health data with encryption in transit and at rest, role-based access controls, and other safeguards described on our Security & Interoperability page. We do not use geofencing around health-care locations.

9. Contact

M-3 Information, LLC · Contact us · support@m3mentalhealth.org