Consumer Health Data Privacy Notice

This notice supplements Harmonide's Privacy Policy and describes how Harmonide handles “consumer health data” under applicable state consumer-health-data laws. It applies to health-related personal information that may not be subject to HIPAA.

Consumer health data we may collect

Depending on the service requested and information voluntarily provided through an approved channel, we may collect:

• information identifying a person as seeking healthcare or healthcare-navigation services;
• health conditions, diagnoses, symptoms, treatments, procedures, medications, tests, imaging, vital information, and care history;
• clinician, facility, appointment, referral, and second-opinion information;
• health-insurance, prior-authorization, claim, denial, billing, and payment information;
• accessibility, language, travel, and family-coordination information related to care;
• records and timelines received from the individual, authorized representatives, clinicians, facilities, health plans, laboratories, pharmacies, portals, and record services;
• information about a person's relationship to a patient or involvement in care;
• information entered into a Harmonide form or Guide that identifies or can reasonably be linked to a person seeking care; and
• inferences used to route a request to an appropriate nonclinical service category.

Harmonide does not intentionally collect precise location data to infer visits to healthcare facilities and does not use geofencing around healthcare facilities.

Sources

We collect consumer health data directly from the person seeking services; from an authorized family member, caregiver, guardian, proxy, or other representative; from clinicians, facilities, health plans, laboratories, pharmacies, portals, and record services at the person's direction or as otherwise permitted by law; from service providers supporting an authorized request; and from information entered into our website, forms, or Guide.

Why we collect and use it

We collect and use consumer health data only as reasonably necessary to provide a service the consumer requested or for another purpose disclosed with any consent required by law. Purposes may include evaluating a request; providing navigation and advocacy; organizing records and timelines; coordinating appointments and communications; supporting insurance, billing, family, language, and travel logistics; maintaining authorizations; documenting the engagement; securing our systems; and complying with law.

We do not use consumer health data for targeted advertising, data-broker activity, or individualized pricing based on predicted willingness to pay.

Consumer health data we may share

At the consumer's direction, with authorization, or as necessary to provide a requested service, we may share the minimum consumer health data reasonably needed with:

• clinicians, facilities, laboratories, pharmacies, and other care services;
• health plans, benefits administrators, billing offices, and authorized financial-assistance resources;
• family members, caregivers, guardians, proxies, translators, and other authorized recipients;
• travel, lodging, transportation, and logistics services when requested;
• contracted processors providing secure case management, records transfer, communications, scheduling, document management, payment, hosting, security, or other operations; and
• government authorities or other parties where disclosure is required or permitted for law, legal process, fraud prevention, security, or protection from serious harm.

The current public website uses Netlify for website hosting and form processing, Google Fonts for font delivery, and — only when a user selects a translation language — Google Translate for in-browser page translation. This notice will be updated with the full production processor categories before the site opens to the public.

Affiliates

Harmonide currently shares consumer health data with no affiliate by default, and no affiliate is currently listed. If a consumer affirmatively requests a separate physician consultation through an affiliated or related medical practice, Harmonide will first disclose the relationship, identify the specific practice, obtain the required consent or authorization, and explain the separate clinical engagement. Any such affiliate will be listed in this notice before sharing begins.

Sale of consumer health data

Harmonide does not sell consumer health data. Harmonide will not sell consumer health data without the separate written authorization required by applicable law. Harmonide does not condition a requested service on an authorization to sell consumer health data.

Your rights

Subject to applicable law, a consumer may have the right to:

• confirm whether Harmonide is collecting, sharing, or selling the consumer's health data;
• access that data;
• obtain a list of third parties and affiliates with whom the data has been shared or sold;
• correct inaccurate data;
• withdraw consent from future collection or sharing;
• request deletion, including deletion through processors and other parties as required by law; and
• appeal a refusal to act on a request.

How to exercise a right

Email privacy@harmonide.com with the subject “Consumer Health Data Request.” Do not send medical records or sensitive identifiers by ordinary email. We may ask for information reasonably necessary to authenticate identity, authority, and the request. A consumer is not required to create a new account to exercise a right.

We will respond within the period required by applicable law. If we deny a request, the response will explain the reason, any right to appeal, and how to submit an appeal. Appeals may be sent to privacy@harmonide.com with the subject “Privacy Appeal.” If an appeal is denied, the consumer may contact the applicable state attorney general.

Consent and withdrawal

Where consent is required, the request will describe the categories of consumer health data, the purpose, the categories of recipients, and how to withdraw consent. Consent to share consumer health data will be obtained separately from consent to collect it where required. A consumer may withdraw consent for future collection or sharing by emailing privacy@harmonide.com. Withdrawal does not affect processing already completed lawfully and may prevent Harmonide from continuing a requested service.

Security and access

Harmonide limits access to consumer health data to personnel and processors who need it for an authorized purpose and uses safeguards appropriate to the volume and nature of the information. Processors handling consumer health data must act under written terms that limit processing to Harmonide's instructions and require appropriate confidentiality and security.

Changes to this notice

Harmonide will post material changes before collecting, using, or sharing additional categories of consumer health data or using the data for materially different purposes. We will obtain affirmative consent where required.

Contact

privacy@harmonide.com. A mailing address will be published when Harmonide's legal entity is finalized.