Last Updated: March 28, 2024
We collect Consumer Health Data from individuals in Washington. Our collection of Consumer Health Data is covered by the Washington My Health My Data Act (“WA MHMD”). In addition to our Privacy Notice at https://curology.com/privacy/ and other Curology Privacy Notices or Addendums, this Washington Health Privacy Notice only applies to individual consumers who are residents of the state of Washington, or individuals whose Consumer Health Data is collected in the state of Washington (“Health Data Subjects,” or “you”).
“Consumer Health Data” means personal information that is linked or reasonably linkable to a particular individual and that identifies that individual’s past, present, or future physical or mental health status. However, the following categories of information are not Consumer Health Data and not covered by this Washington Health Privacy Notice:
Protected Health Information (“PHI”), as defined by the Health Insurance Portability and Accountability Act (“HIPAA”);
Health care information collected, used, or disclosed in accordance with WA Revised Code § 70.02 (“Medical Records – Health Care Information Access and Disclosure”);
Publicly available information;
Deidentified data; or
Information otherwise excluded from the scope of WA MHMD.
This Washington Health Privacy Notice provides the following information to individuals in Washington:
Categories of Consumer Health Data we collect;
Purposes for which we collect Consumer Health Data;
How we use Consumer Health Data;
Categories of sources from which we collect Consumer Health Data;
Categories of Consumer Health Data we share;
Categories of third parties and specific affiliates with whom we share Consumer Health Data;
How Health Data Subjects can exercise their rights under WA MHMD:
The right to confirm if we are collecting, sharing, or selling the Health Data Subject’s Consumer Health Data
The right to access Consumer Health Data
The right to delete Consumer Health Data
The right to withdraw consent for the collection and/or sharing of Consumer Health Data
The right to appeal our decisions on requests to exercise any of these rights.
This Washington Health Privacy Notice does not apply to the information of individuals acting in an employment context, such as job applicants, employees, or contractors to Curology, Inc., David Lortscher, MD, P.C. (DBA Curology Medical Group), Skin Specialty Solutions, Inc., Personalized Skin Solutions, Inc., our fully owned and operated brands, including Agency, and our provider and related entities (“Curology”).
We may collect the following categories of Consumer Health Data with your consent, or to the extent necessary to provide a product or service that you requested. We only collect the categories of Consumer Health Data described in this Washington Health Privacy Notice.
Individual health conditions, treatment, diseases, or diagnosis
Social, psychological, behavioral, and medical interventions
Health-related surgeries or procedures
Use or purchase of prescribed medication
Symptoms, or measurements of other health data
Diagnoses, treatment, or medication
Gender-affirming care information;
Reproductive or sexual health information
Precise location information that could reasonably indicate an individual attempt to acquire or receive health services or supplies (home address)
Data that identifies a consumer seeking health care services
Any other information used to associate or identify an individual with any category of health data that is derived or extrapolated from nonhealth information (such as proxy, derivative, inferred, or emergent data by any means, including algorithms or machine learning).
We collect Consumer Health Data from the following sources:
Directly from you;
Inferences from your activity using our services;
From our affiliates (businesses that share common branding and ownership with Curology);
From our business partners (companies that we have a pre-existing commercial relationship with);
From our advertising partners.
We only use Consumer Health Data as described in this Washington Health Privacy Notice. We may use Consumer Health Data to fulfill the purposes listed below.
We only collect and use Consumer Health Data for the purposes described in this Washington Health Privacy Notice. We may collect and use Consumer Health Data for the folowing purposes:
To provide teledermatology and related services to our Patient Users via our licensed medical providers (including those who provide healthcare services, drugs, or medical devices);
To verify your identity as the holder of an account with us;
To administer your account, process payments, troubleshoot issues, and provide you with customer support;
To communicate with you about the services, and to deliver any administrative notices or alerts and communications relevant to your use of the services;
To allow you to participate in sweepstakes, contests, or other promotions;
To market our services that we believe may be of interest;
To tailor the features, performance and support of the services to you and your preferences;
To provide, operate, analyze usage of, and improve the services, including performing research and development;
To investigate, detect, deter, prevent, report, defend against, or take other action regarding security incidents, abusive behavior, suspected fraud, malicious or illegal activities, or violations of our Terms of Service or other policies;
To make sure our terms, policies, and agreements with you and any third parties are enforced;
To comply with applicable laws and regulations.
We may share each of the categories of Consumer Health Data described above with your consent, or to the extent necessary to provide a product or service that you requested.
“Share” under the WA MHMD means to release, disclose, disseminate, divulge, make available, provide access to, license, or otherwise communicate Consumer Health Data to a third party or affiliate. However, “share” does not include (i) disclosure of Consumer Health Data to provide goods or services in a manner consistent with the purpose for which we collected the Consumer Health Data; (ii) disclosure to a third party with whom you have a direct relationship when the disclosure is for the purpose of providing a product or service you if we maintain control and ownership of the data, and the third party uses the data only at our direction and consistent with your consent and for the purpose for which it was collected; or (iii) disclosure or transfer of Consumer Health Data to a third party as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in compliance with WA MHMD. The term “third party,” as used in this Washington Health Privacy Notice, means a person who is not a consumer, an entity regulated under WA MHMD, a processor, or an affiliate of an entity regulated under WA MHMD.
We may share Consumer Health Data to the following categories of third parties and specific affiliates:
Advertisers and advertising networks;
Business partners;
Affiliates of Curology;
Social media companies; and
Internet cookie information recipients, such as analytics and behavioral advertising services
Health Data Subjects have the following rights under WA MHMD:
The right to confirm if we are collecting, sharing, or selling your Consumer Health Data;
The right to access your Consumer Health Data;
The right to delete your Consumer Health Data;
The right to withdraw consent for the collection and/or sharing of your Consumer Health Data;
The right to appeal our decisions on requests to exercise any of these rights.
If you are a Health Data Subject, you can submit a request to exercise your rights under WA MHMD by sending an email to privacy@curology.com or hello@curology.com with the subject line “Health Privacy Rights Request” or by visiting our online portal at https://app.curology.com/information-request. You may submit a rights request, free of charge, up to two times per year.
To protect your privacy, we may need to authenticate your identity before we respond to your rights request. All Consumer Requests must provide sufficient information that allows us to reasonably verify you are the individual about whom we collected the Consumer Health Data or that you are a person authorized to make a request on behalf of the individual about whom we collected the Consumer Health Data. This may include: (1) filling out the interactive webform; or (2) verifying one or more of the following: full first & last name; date of birth; shipping address on file; phone number; last 4 Digits of Credit Card; PayPal email account; guardian information; name of provider; last transaction charge; and/or any other appropriate individualized data point. You must also describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.
If you do not complete the verification process, we may be unable to process your request. Any information you provide to authenticate your identity will only be used to process your rights request and not for any other purpose. If you have a password-protected online account with us, we may require you to submit your rights request securely through that account. Please be aware that we do not accept or process rights requests submitted through other means not outlined in this Washington Health Privacy Notice.
We will respond to your rights request within 45 days, though in certain cases we may inform you that we will need up to another 45 days to act on your request. If we suspect fraudulent or malicious activity, we will delay taking action on your request until we can appropriately verify your identity and the request as authentic. If you believe our response to your rights request is insufficient, you can appeal our decision by submitting an appeal request via the same method used to submit your initial request, and we will inform you of our final decision within 45 days.
We reserve the right to charge a reasonable fee or take other appropriate action in response to requests from a Health Data Subject that are manifestly unfounded, excessive, or repetitive.
If you believe any of your Consumer Health Data is inaccurate or incomplete, you may review and correct some Consumer Health Data about yourself by logging into your online account with us and visiting your “Account Details” page or you may submit a request to correct it by emailing us at hello@curology.com or privacy@curology.com.
WA MHMD defines a “sale” as the exchange of Consumer Health Data for monetary or other valuable consideration, excluding exchange (i) to a third party as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of our assets that complies with the requirements and obligations in WA MHMD; or (ii) by us to a processor when such exchange is consistent with the purpose for which the Consumer Health Data was collected and disclosed to the consumer. As required by law, we only sell Consumer Health Data after we have obtained a valid authorization from the Health Data Subject(s) whose Consumer Health Data is involved in the sale. If you have previously authorized us to sell your Consumer Health Data, you can revoke that authorization at any time by following the instructions listed on your original authorization. If you do not have your original authorization, you can contact us at privacy@curology.com for information on how to revoke your authorization.
We reserve the right to amend this Washington Health Privacy Notice at our discretion and at any time. When we make material changes to this Washington Health Privacy Notice, we will post the updated version on our website and update the Last Updated date. Your continued use of our website and services following the posting of changes constitutes your acceptance of such changes.
If you have any questions or concerns regarding this Washington Health Privacy Notice, contact us at privacy@curology.com.