In plain English. This page explains how Leader Health handles "consumer health data" that is not already protected as HIPAA medical-record information — for example, health-related details you share through our website, waitlist, or marketing before or outside a care relationship. Most of your clinical information is protected health information (PHI) held by your care team and governed by our HIPAA Notice, not by this page. We do not sell consumer health data, we do not use it for cross-site ad targeting without your permission, and we do not use geofencing around health-care locations. You can access your consumer health data, withdraw consent, delete it, and appeal a decision by emailing privacy@myleaderhealth.com.
Why this Policy exists and how it fits with our other policies
A growing number of states — including Washington (My Health My Data Act, RCW ch. 19.373), Nevada (SB370, NRS 603A.400–603A.470), Connecticut (Data Privacy Act consumer-health-data provisions), and others — give consumers specific rights over "consumer health data." This Policy is Leader Health's dedicated Consumer Health Data Privacy Policy for that data. It supplements, and should be read together with, our Privacy Policy and HIPAA Notice of Privacy Practices.
Who "we" are. "Leader Health" means LH Ventures LLC dba Leader Health, the technology and administrative-services company that operates the Leader Health platform. Clinical care is delivered by independent licensed clinicians practicing through an Affiliated Provider Network. The Affiliated Provider Network is the HIPAA Covered Entity for your medical record; Leader Health is its Business Associate.
Who this Policy protects. We apply this Policy to residents of every state whose law provides heightened protections for consumer health data. The named laws above are examples; the controlling list is the set of such laws then in effect. Where a specific state law gives you a right this Policy does not name, that right still applies.
Not covered (governed by HIPAA instead). Most information created in the course of your care — your medical record, lab results, prescriptions, clinical messages, and other protected health information — is PHI held by the Affiliated Provider Network and governed by the HIPAA Notice. State consumer-health-data laws expressly exclude PHI and information that a HIPAA covered entity or business associate maintains in the same way as PHI. That information is not the subject of this Policy.
Covered by this Policy. "Consumer health data" means information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status, to the extent that information is not PHI under HIPAA. In practice, this is health-related information Leader Health may collect outside the treatment relationship, such as:
Health interests or conditions you indicate when you join our waitlist, take a pre-account quiz, or contact us before becoming a patient;
The fact that you sought information about, or expressed interest in, a particular therapy category (for example, hormones, weight management, sexual health, or peptides);
Health-related inferences we may derive from your use of the Site that are used to associate you with any of the above; and
Approximate location derived from your IP address, only to the extent it could indicate that you are seeking health-care services.
Health interests and self-reported information you provide through the waitlist, pre-account questionnaires, surveys, reviews, or support messages.
Therapy-category interest (which categories you browsed, selected, or asked about) before a care relationship exists.
Health-related inferences derived from Site activity and used to associate you with a health interest or status.
Approximate (IP-based) location, used only for state-availability routing and security — never precise geolocation tracking for advertising.
We do not seek to collect consumer health data beyond what is necessary to provide the product, service, or information you have requested, except with your consent.
Directly from you (waitlist sign-ups, questionnaires, surveys, support and marketing interactions).
Automatically from your use of the Site (device and usage data, approximate location, and cookies described in our Cookies & Tracking Technologies policy).
From service providers that help us operate the Site (for example, fraud-prevention and identity-verification vendors), under contracts that restrict their use of the data.
We do not purchase consumer health data from data brokers.
Sources of consumer health data
To respond to your request (for example, to add you to a waitlist or tell you when the Service is available in your state);
To operate, secure, and improve the Site;
To communicate with you about the Service, and — only if you have separately opted in — to send marketing;
To prevent fraud and abuse and to comply with law.
We use consumer health data only for these purposes, or as otherwise permitted with your consent.
We collect and share consumer health data only (a) as necessary to provide a product or service you have requested, or (b) with your consent. Where the law requires opt-in consent for a particular collection or sharing that is not necessary to provide what you requested, we obtain that consent first, separately from any other transaction or acknowledgment, and you may decline without losing access to unrelated parts of the Service. We do not sell consumer health data, and we would not do so without your separate valid authorization.
We do not sell consumer health data. We do not share consumer health data for cross-context (targeted) advertising without your affirmative authorization. Where we share consumer health data to operate the Service, we share only the categories below, only with the categories of recipients below, and only under contracts that limit their use of the data:
| Category of consumer health data | Categories of recipients | Purpose |
|---|---|---|
| Waitlist and interest data; self-reported health interests | Technology/hosting and communications service providers; customer-support tools | Deliver the Site and respond to your request |
| Site activity and health-related inferences (non-PHI pages) | Analytics providers (and, only with your consent, advertising partners) | Measure and improve the Site |
| Identity/fraud-signal data | Identity-verification and fraud-prevention providers | Prevent fraud and abuse |
| Any consumer health data, as required | Government or legal authorities | Comply with law or lawful process |
| Any consumer health data | Leader Health corporate affiliates | Operate the business, under this Policy |
We do not share consumer health data with the Affiliated Provider Network, Pharmacies, or Labs under this Policy; information shared with them to deliver your care is PHI governed by HIPAA, not by this Policy.
8. No geofencing
We do not use a geofence around any location that provides in-person health-care services to identify or track you, to collect consumer health data from you, or to send you notifications, messages, or advertisements related to your consumer health data or health-care services.
Your rights
Subject to your state's law, you have the right to:
Confirm and access — confirm whether we are collecting, sharing, or selling your consumer health data, and access that data (including a list of the third parties and affiliates with whom we have shared it);
Withdraw consent — withdraw consent to our collection and sharing of your consumer health data at any time;
Delete — have your consumer health data deleted; when you do, we will direct our service providers, processors, and any third parties with whom we shared it to delete it as well;
Appeal — appeal a denial of any request; and
Non-discrimination — exercise these rights without being denied goods or services, charged a different price, or provided a different level of service (except where the data is necessary to provide what you requested).
Withdrawing consent or deleting your consumer health data does not affect our lawful processing before your request, and does not reach information we must retain under law or that is PHI governed by HIPAA.
How to exercise your rights
Email privacy@myleaderhealth.com with the subject line "Consumer Health Data Request" and tell us which right you wish to exercise and your state of residence. You may also submit a request through your account dashboard. We will verify your identity before responding. An authorized agent may submit a request on your behalf; we will verify the agent's authority and your identity.
We respond within the time your state's law requires — generally 45 days, which we may extend once by an additional 45 days when reasonably necessary, with notice to you. If we deny your request, we will explain why, and you may appeal by replying with "Consumer Health Data Appeal" in the subject line; we will respond to appeals within the time your state's law requires.
Data security
We use administrative, technical, and physical safeguards designed to protect consumer health data against unauthorized access, disclosure, alteration, and destruction, including encryption in transit and at rest, access controls on a need-to-know basis, and vendor due diligence. No system is perfectly secure.
Retention
We keep consumer health data only as long as necessary for the purposes described in this Policy, after which we delete or de-identify it. Where you request deletion, we act on it as described in Section 9, except for information we are required to retain by law.
Enforcement
Some state consumer-health-data laws — including the Washington My Health My Data Act — are enforceable by the state attorney general and, in some cases, by consumers directly under the state's consumer-protection law. Nothing in this Policy waives any right or remedy available to you under your state's law.
Changes to this Policy
We may update this Policy. If we make material changes, we will post the updated Policy with a new "Effective Date" and, where required, notify you. Your continued use of the Site after the Effective Date constitutes acceptance.
Contact
Privacy team: privacy@myleaderhealth.com Mailing address: Leader Health, c/o LH Ventures LLC, 321 S Persimmon St, Tomball, TX 77375
