Washington State Consumer Health Data Privacy Policy

Introduction

This Washington State Consumer Health Data Privacy Policy (“Privacy Policy”) supplements other applicable privacy notices of Deloitte LLP and its affiliates (“Deloitte”), and describes how Deloitte (also referred to below as "we", "us" and "our") processes consumer health data that is subject to the Washington State My Health My Data Act.

As used in this Privacy Policy, “Deloitte Network” refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee (“DTTL”), its network of member firms and their related entities.  DTTL and each of its member firms are legally separate and independent entities.  Please see www.deloitte.com/about for a detailed description of the legal structure of DTTL and its member firms.

Consumer health data collection and use

Consumer health data is personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status, such as: (i) individual health conditions, treatment, diseases, or diagnosis; (ii) social, psychological, behavioral, or medical interventions; (iii) health-related surgeries or procedures; (iv) use or purchase of prescribed medication; (v) diagnoses or diagnostic testing, treatment, or medication; (vi) information relating to researching, obtaining, or seeking gender affirming care services; (vii) reproductive or sexual health information; (viii) data that identifies a consumer seeking health care services or status; or (ix) information used to associate or identify a consumer with the information described in (i) - (viii) above that is derived or extrapolated from non-health information.

We may collect and use your consumer health data with your explicit consent or as reasonably necessary to provide services that you have requested, such as personal tax services. This may include using your consumer health data to establish and maintain our relationship with you (including acting upon any of your requests), to customize or improve services offered to you, to comply with applicable legal, regulatory or professional requirements, and to protect our rights or property and that of our users.

Consumer health data sources

We may collect consumer health data directly from you or a third party associated with you, such as your employer. 

Consumer health data sharing

We may share your consumer health data with the third parties identified below.

Third parties with whom we may share consumer health data

We may share your consumer health data with:

• members of the Deloitte Network;
• those persons whom you have requested us to share your consumer health data, such as your spouse or civil partner; and
• law enforcement, regulatory or other government agencies, or to other third parties to comply with legal, regulatory, or national security obligations or requests.

Your consumer health data rights

You may have choices about how your consumer health data is collected, used and shared under the Washington State My Health My Data Act, including the right to request that we confirm whether we process your consumer health data or that we delete your consumer health data.  You may also withdraw your consent to our collection or sharing of your consumer health data.

To exercise any of your rights under the Washington State My Health My Data Act regarding your consumer health data, complete our Personal Information Request Form. You may also appeal a denial of your request by completing the Personal Information Request Appeal Form.

Verification of consumer health data requests

For certain consumer health data requests, we must first verify your identity before processing your request. To do so, we may ask you to provide us with your full name, contact information, and relationship to Deloitte. Depending on your request, we may ask you to provide additional information. Once we receive this information, we will then review it and determine whether we are able to match it to the information Deloitte maintains about you to verify your identity.

Changes to this Privacy Policy

We may modify or amend this Privacy Policy from time to time at our discretion. When we make changes to this Privacy Policy, we will amend the revision date at the top of this page and such modified or amended Privacy Policy shall be effective as to you and your consumer health data as of that revision date. We encourage you to periodically review this Privacy Policy to view any updates.

Contact information

If you have any questions or concerns regarding your privacy or processing of your consumer health data, please contact us at USPrivacyQuestions@deloitte.com.