Consumer Health Data Privacy Policy for Washington Residents

Last modified: 11/11/2024

This Washington Consumer Health Data Privacy Policy (“Policy”) describes the practices of Wave Bye Inc. (“Wave Bye” or “We”) for collecting and using Washington residents’ consumer health data. Consumer health data is any data that is linked or reasonably linkable to a specific individual and that identifies that individual’s past, present, or future physical or mental health status that Wave Bye collects or controls the collection of (“consumer health data“).

This Policy applies to the Wave Bye Mobile Application, our website at www.wavebye.co, and any other websites, applications, or other services that link to this Policy. This Policy does not apply to any sites, products, applications, platforms, or other services not directly linking to this Policy.

Please read this Policy carefully to understand our policies and practices regarding your consumer health data and how we will treat it. If you do not agree with our policies and practices, you should not use the sites, products, applications, platforms, or other services linking to this Policy.

Other privacy policy may apply for your personal information that is not consumer health data and if you are not a Washington resident. To view our privacy policy, which describes how we treat other personal information, visit our Privacy Policy [LINK to PRIVACY POLICY URL].

Consumer Health Data We May Collect About You

We collect and use different types of consumer health data from and about you, including:

Information about any of the following:

individual health conditions, treatment, diseases, or diagnoses;
diagnostic testing, treatment, or medication;
social, psychological, behavioral, or medical interventions;
health-related surgeries and procedures;
use or purchase of prescribed medication; or
bodily functions, vital signs, symptoms, or measurements of physical or mental health status.

Gender-affirming care information, which is personal information relating to seeking or obtaining past, present, or future gender-affirming care services, including:

location information that could reasonably indicate a consumer’s attempt to acquire or receive gender-affirming care services;
efforts to research or obtain gender-affirming care services; or
any gender-affirming care information that is derived, extrapolated, or inferred, including from non-health information, such as proxy, derivative, inferred, emergent, or algorithmic data.

Reproductive or sexual health information, which is personal information related to seeking or obtaining past, present, or future reproductive or sexual health services, including:

individual health conditions, status, diseases, or diagnoses;
social, psychological, behavioral, and medical interventions;
health-related surgeries or procedures, including abortions;
use or purchase of medication, including abortion medications;
bodily functions, vital signs, symptoms, or measurements of the information described in this subsection;
diagnoses or diagnostic testing, treatment, or medication; or
medical or nonmedical services related to and provided in conjunction with an abortion, such as associated diagnostics, counseling, supplies, and follow-up services.

Biometric data, meaning data that is generated from the measurement or technological processing of an individual’s physiological, biological, or behavioral characteristics and that identifies a consumer, whether individually or in combination with other data. Biometric data includes, but is not limited to:

imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template can be extracted; or
keystroke patterns or rhythms and gait patterns or rhythms that contain identifying information.

Genetic data, meaning any data, regardless of its format, that concerns a consumer’s genetic characteristics. Genetic data includes, but is not limited to:

raw sequence data that results from the sequencing of a consumer’s complete extracted deoxyribonucleic acid (DNA) or a portion of the extracted DNA;
genotypic and phenotypic information that results from analyzing the raw sequence data; and
self-reported health data that a consumer submits to a regulated entity or a small business and that is analyzed in connection with consumer’s raw sequence data.

Data identifying a consumer seeking health care services. Health care services means any service provided to a person to assess, measure, improve, or learn about a person’s mental or physical health, including but not limited to:

individual health conditions, status, diseases, or diagnoses;
social, psychological, behavioral, and medical interventions;
health-related surgeries or procedures;
use or purchase of medication;
bodily functions, vital signs, symptoms, or measurements of the information described in this subsection;
diagnoses or diagnostic testing, treatment, or medication;
reproductive health care services; or
gender-affirming care services.

Precise location information that reasonably indicates a consumer’s attempt to receive or acquire health services or supplies.
Any inferences of the above categories derived, extrapolated, or inferred from non-health information.

We use these categories of consumer health data for the following purposes:

Fulfilling the purposes for which you provided the data or that were described when it was collected.
Performing the services or providing the goods that you request from us and responding to your questions or requests for information.
Notifying you about changes to our websites, applications, products, or services.
Facilitating services and operations performance, security, and integrity, including:

Undertaking activities to prevent, detect, and investigate security incidents that compromise the availability, authenticity, integrity, or confidentiality of stored or transmitted consumer health data or that otherwise threaten to compromise the performance, security, or integrity of our business; and
Performance analytics, identity verification and authorization, site and application optimization, and quality control.

Recordkeeping and auditing.
Complying with our legal obligations and risk management, audit, investigations and reporting, and other legal and compliance reasons.
Administering customer accounts and preferences.
Measuring or understanding the effectiveness of non-personalized advertising and delivering non-personalized advertising served as part of your current interaction with you.]
Our internal research and product or service design and development.

Consumer Health Data Sources

We collect consumer health data from the following sources:

You, including when you request certain health-related products and services, sign up for email lists or programs, and complete optional surveys about our products and services.
Your device when you visit or interact with our sites, applications, or services, including through cookies, web beacons, and similar technologies that automatically send us information when you browse, use, visit, or otherwise interact with our sites, applications, or services.
Authorized/legal representatives, family members, and caregivers.
Health care providers.
Health insurance companies and other payors.
Payment processors and other financial institutions.
Our business and marketing partners, who provide us with information about consumers who are viewing our content across other websites or applications, purchasing our products, or interacting with our promotions, benefits, or programs.
Other third-party sources, such as data brokers who provide us with information about consumers that may be interested in our products or services.

Consumer Health Data Disclosures

We do not sell your consumer health data.

We may disclose any of the consumer health data categories listed above to processors, service providers, and contractors that help us provide products and services to you and to our affiliates. We may also disclose your consumer health data to other third parties.

We instruct these affiliates, and processors, service providers, and contractors, and other third parties to only use consumer health data as permitted by our contracts with them and consistent with applicable law.

We may also disclose consumer health data as permitted by applicable law, including:

With your consent.
To prevent, detect, protect from, or respond to security incidents, identity theft, fraud, harassment, or malicious or deceptive activities.
To a third party acquiring our assets if Wave Bye sells its business or otherwise is part of a merger, acquisition, bankruptcy, or other transaction involving a third party taking control of our assets or business.
To investigate, report, or take legal action to protect our rights, property, and safety and the rights, property, and safety of others.
To protect your or others’ vital interests, including health and safety.

Your Privacy Rights

You have specific rights with respect to your consumer health data. You have the right to:

Request confirmation that we collect, share, or sell your consumer health data.
Request access to your consumer health data that we have collected or control, including:

a list of all third parties and affiliates that we have shared or sold your consumer health data to; and
the email addresses or other online method to contact those third parties and affiliates.

Withdraw your consent for our collection and sharing of your consumer health data.
Request that we delete your consumer health data.

To exercise any of your rights under Washington consumer health privacy law, including those set out above, please contact us at hello@wavebye.co.

Contact Information

To make an inquiry or comment about this Policy or our privacy practices, contact us at: hello@wavebye.co.