Washington Consumer Health Data Privacy Policy
Last updated: August 21, 2025
Introduction
This Washington Consumer Health Data Privacy Policy (the “Washington Consumer Health Data Privacy Policy”) supplements the information contained in Oar Health, Inc.’s (“Oar,” “we,” “our,” or “us”) Privacy Policy and applies to personal data defined as “consumer health data” subject to the Washington State My Health My Data Act (“WA MHMDA”). This Washington Consumer Health Data Privacy Policy applies only to individual consumers who are residents of the state of Washington or individuals whose consumer health data is collected in the state of Washington. In the event of a conflict between any other policy, statement, or notice and this Washington Consumer Health Data Privacy Policy, this policy will control with respect to consumer health data collected under WA MHMDA.
Consumer Health Data
“Consumer health data” means personal information that is linked or reasonably linkable to a particular individual and that identifies that individual’s past, present, or future physical or mental health status. However, the following categories of information are not consumer health data and are not covered by this Washington Consumer Health Data Privacy Policy:
Protected Health Information (“PHI”), as defined by the Health Insurance Portability and Accountability Act (“HIPAA”);
Health care information collected, used, or disclosed in accordance with WA Revised Code § 70.02 (“Medical Records – Health Care Information Access and Disclosure”);
Publicly available information;
Deidentified data; or
Information otherwise excluded from the scope of WA MHMDA.
Please note that data practices concerning health care information collected by independent medical practitioners (each, a “Provider”) and its affiliates are described in the terms and privacy disclosures specific to those services, namely, the Provider’s Notice of Privacy Practices.
Oar will not collect additional categories of consumer health data without providing you notice. As further described below, we do not “sell” any categories of consumer health data for monetary or other valuable consideration.
Categories of Consumer Health Data We Collect
As described in our Privacy Policy, the data we collect depends on the context of your interactions with Oar, the choices you make (including your privacy settings), the products and features you use, and applicable law. Because consumer health data is defined very broadly, many categories of data we collect could also be considered consumer health data.
We may collect the following categories of consumer health data with your consent or to the extent necessary to provide a product or service that you requested. We only collect the categories of consumer health data described in this Washington Consumer Health Data Privacy Policy:
Individual health conditions, treatment, diseases, or diagnosis;
Social, psychological, behavioral, and medical interventions;
Health-related surgeries or procedures;
Use or purchase of prescribed medication;
Bodily functions, vital signs, symptoms, or measurements of other health data;
Diagnoses or diagnostic testing, treatment, or medication;
Reproductive or sexual health information;
Data that identifies a consumer seeking health care services; and
Any other information used to associate or identify an individual with any category of health data that is derived or extrapolated from nonhealth information (such as proxy, derivative, inferred, or emergent data by any means, including algorithms or machine learning).
Examples of consumer health data may include:
Health information you choose to provide via our “Qualify for Treatment” form.
Other information that may be used to infer or derive data related to the above or other health information.
Sources of Consumer Health Data
As described further in our Privacy Policy, we collect personal data (which may include consumer health data) directly from you, including from forms or surveys you complete, products and services you purchase, and from your interactions with our products and services, including inferences from your activity using our services. We may also collect personal data (which may include consumer health data) from our business partners and service providers and from publicly available sources.
Purposes for Our Collection of Consumer Health Data
We only collect and use consumer health data for the purposes described in this Washington Consumer Health Data Privacy Policy. Primarily, we collect and use consumer health data as reasonably necessary to communicate with you and to provide you with the products and services you have requested. We may also collect and use consumer health data for the following purposes:
Provide Services. To provide you services, including allowing you to sign up for an account and interact with our screening tool.
Customer Service. We may use your consumer health data to respond to your requests for technical support, online services, product information or to any other communication you initiate, including requests, inquiries, and complaints.
Security and Repairs. We may use consumer health data for security purposes, such as for loss prevention and to protect against unauthorized disclosure of consumer health data, as well as detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity. We also may use consumer health data for debugging to identify and repair errors that impair existing intended functionality.
With your Consent. We may use your consumer health data for any other purpose with your consent.
We will not process consumer health data for purposes that are neither reasonably necessary nor compatible with the purposes for which the consumer health data is processed as described in this Washington Consumer Health Data Privacy Policy without your consent.
Sharing of Consumer Health Data
We may share consumer health data with your consent or as reasonably necessary to provide a product or service that you have requested. “Share” under the WA MHMDA means to release, disclose, disseminate, divulge, make available, provide access to, license, or otherwise communicate consumer health data to a third party or affiliate. However, “share” does not include (i) disclosure of consumer health data to provide goods or services in a manner consistent with the purpose for which we collected the consumer health data; (ii) disclosure to a third party with whom you have a direct relationship when the disclosure is for the purpose of providing a product or service to you, if we maintain control and ownership of the data, and the third party uses the data only at our direction and consistent with your consent and for the purpose for which it was collected; or (iii) disclosure or transfer of consumer health data to a third party as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in compliance with the WA MHMDA. The term “third party,” as used in this Washington Consumer Health Data Privacy Policy, means a person who is not a consumer, an entity regulated under the WA MHMDA, a processor, or an affiliate of an entity regulated under the WA MHMDA.
We may share consumer health data with the following categories of third parties and specific affiliates:
Business partners or service providers, such as those providing analytics and technology services;
Affiliates, parents, and subsidiary organizations of Oar;
Potential or actual buyer or other successor in interest; and
Other third parties (such as law enforcement or government regulators) where required by, or otherwise permitted by, law.
How to Exercise Your Rights
If you are covered by the WA MHMDA, then you have certain rights with respect to consumer health data, including:
The right to confirm whether we are collecting, sharing, or selling your consumer health data;
The right to access a copy of the consumer health data we have about you;
The right to delete your consumer health data;
The right to withdraw consent for the collection and/or sharing of your consumer health data, subject to certain exceptions;
The right to appeal our decisions on requests to exercise any of these rights.
You can request to exercise such rights by contacting our privacy support team at privacy@oarrx.com (with the subject line “Health Privacy Rights Request”). You may submit a rights request, free of charge, up to two times per year. We will respond to your rights request within 45 days, though in certain cases we may inform you that we will need up to another 45 days to act on your request.
If your request to exercise a right is denied, you may appeal that decision by contacting our privacy support team at privacy@oarrx.com. If your appeal is unsuccessful, you can raise a concern or lodge a complaint with the Washington State Attorney General at www.atg.wa.gov/file-complaint.
Sales of Consumer Health Data
We do not “sell” consumer health data as defined by the WA MHMDA as the exchange of consumer health data for monetary or other valuable consideration, excluding exchange (i) to a third party as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of our assets that complies with the requirements and obligations in the WA MHMDA; or (ii) by us to a processor when such exchange is consistent with the purpose for which the consumer health data was collected and disclosed to the consumer.
Changes to this Washington Consumer Health Data Privacy Policy
We reserve the right to amend this Washington Consumer Health Data Privacy Policy at our discretion and at any time. When we make material changes to this Washington Consumer Health Data Privacy Policy, we will post the updated version on our website and update the Last Updated date. Your continued use of our website and services following the posting of changes constitutes your acceptance of such changes.
Contact Information
If you have any questions or comments about this Washington Consumer Health Data Privacy Policy, the ways in which Oar collects and uses your information described above and in the Privacy Policy, your choices and rights regarding such use, or wish to exercise your rights, please do not hesitate to contact us at:
Phone: (201) 308-3120
Website: https://www.oarhealth.com/
Email: privacy@oarrx.com
Postal Address:
Oar Health
10 Jay St, Suite 102
Brooklyn, NY 11201
