Consumer Health Data Privacy Policy

Overview

This Consumer Health Data Privacy Policy explains how Crown & Core Wellness Spa + Salon collects, uses, shares, and protects consumer health data, as defined by the Washington My Health My Data Act (RCW 19.373). It applies to consumer health data collected through our website, forms, phone, and in-person visits, and supplements our Privacy Policy.

Categories of consumer health data we collect

• Health conditions, symptoms, and wellness goals you share with us (for example, recovery, stress, sleep, skin, or scalp concerns).
• Screening and intake information, such as relevant medical history, medications, allergies, pregnancy status, and contraindications for services like hyperbaric oxygen therapy, IV wellness, or cryotherapy.
• Information about health-related services you request or receive, including weight management, hormone, IV, and recovery services.
• Biometric or body measurement data where a service requires it.
• Inferences about health status derived from the services you book.

Why we collect and use it

We collect and use consumer health data only with your consent or as necessary to provide a product or service you have requested.

• To respond to your inquiry and determine whether a service is appropriate for you.
• To schedule, prepare for, and safely deliver the services you request.
• To maintain records required for safe practice and legal compliance.
• To communicate with you about your appointments and care.

Sources of consumer health data

• Directly from you, through website forms, intake documents, phone calls, and in-person conversations.
• From our providers, based on services delivered to you.
• From healthcare professionals or others you authorize to share information with us.

Consumer health data we share

We share consumer health data only with your consent or as necessary to provide the services you request. Categories of data we may share include contact details, service requests, and screening information needed to deliver or support your service.

Categories of third parties and affiliates

Crown & Core does not currently share consumer health data with affiliates.

• Scheduling, intake, and client-management platforms.
• Licensed clinical partners or medical directors who oversee applicable services.
• Payment processors.
• Website hosting and secure form-processing providers.
• Government authorities where required by law.

No sale of consumer health data

We do not sell consumer health data. We will not sell consumer health data without a valid, signed authorization from you as required by Washington law.

No geofencing

We do not implement geofences around facilities that provide in-person health care services for the purpose of identifying, tracking, collecting data from, or sending health-related notifications to consumers.

Your rights

• Confirm whether we collect, share, or sell your consumer health data, and access that data.
• Receive a list of all third parties and affiliates with whom we have shared your consumer health data, and their contact information.
• Withdraw consent to our collection and sharing of your consumer health data.
• Request deletion of your consumer health data, including from our archives and backup systems, and have us notify processors and third parties of the deletion.
• Be free from discrimination for exercising these rights.

How to exercise your rights

You may submit a request by calling us at 425.754.1309 or through the contact form on our Contact page. Please indicate "Consumer Health Data Request" in your message. We will verify your identity using commercially reasonable methods and respond within 45 days, which may be extended by an additional 45 days when reasonably necessary, with notice to you. Requests are free of charge up to twice per year.

Appeals

If we decline to take action on your request, you may appeal by contacting us through the same methods and writing "Appeal" in your message. We will respond in writing within 45 days, explaining any action taken or not taken and the reasons. If your appeal is denied, you may contact the Washington State Attorney General at atg.wa.gov/file-complaint.

Security and access

We restrict access to consumer health data to employees, contractors, and processors who need it to provide the services you request, and we maintain administrative, technical, and physical safeguards appropriate to the sensitivity of the data.

Changes to this policy

If we make material changes to how we collect, use, or share consumer health data, we will update this policy and obtain your consent where required.