Washington Consumer Health Data Privacy Notice

This Consumer Health Data Privacy Policy describes how ID.me collects, uses and discloses certain information, including your Consumer Health Data, both online and offline, and the choices you can make about that information. We respect your concerns about privacy, and value our relationship with each of our users, it is for this reason that ID.me will never sell, rent, or trade your Consumer Health Data, and why we take measures to safeguard your Personal Information as we work to become the identity verification layer of the internet.

What consumer health data is collected?

As described in the What Information We Collect About You section of our Privacy Policy, the Personal Information we may collect and retain depends on the context of your interactions with ID.me and the choices you make (including your privacy settings), the products and features you use, your location, and applicable law. Because consumer health data is defined very broadly, many of the categories of data we collect could also be considered consumer health data.

We may collect certain Biometric Information. Biometric Information is a form of Personal Information related to biometric characteristics which may be used to identify you. As used in this policy, Biometric Information includes any "biometric identifiers" or "biometric information" as defined under applicable law, through your interactions ith ID.me we may collect Biometric Information such as fingerprints or facial geometry. See our Consent for ID.me to Collect Biometric Data for additional information on our handling of your Biometric Information.

We may collect information about your use of ID.me Rx. We may collect information from or about your use of ID.me Rx in several ways through your use the Service, including when you choose to share information with us by entering it through our Services, through the postings that you may publish, through data partners and ID.me Rx Plan Administrators, through your pharmaceutical purchases when using the Services, through pharmacy benefit managers, and by using automated processes. This information may include health information about you relating to your use of ID.me Rx, such as the aggregate prescription pricing and discounts obtained, the location of the pharmacy at which the prescriptions are purchased, and details about how you use and interact with ID.me Rx. We also collect approximate location information that could reasonably indicate your attempt to acquire or receive health supplies. Information related to ID.me Rx can be found in the Rx section of our Privacy Policy.

Why is consumer health data collected and used?

We collect and use consumer health data for the purposes described in the How We May Use Your Information and Why section of our Privacy Policy. Primarily, we collect and use consumer health data as reasonably necessary to provide you with our Services. This may include verifying your identity, meeting contractual obligations, to provide you with requested Services, and to detect and prevent fraud.

We may use consumer health data for other purposes for which you give your consent – for example, for advertising or marketing purposes. See the Your Choices, Rights and Controls section of our Privacy Policy and the How to Exercise Your Rights section below for more details regarding your privacy rights and choices.

Sources of consumer health data

As described further in the What Information We Collect About You section of the Privacy Policy, we collect Personal Information (which may include consumer health data) directly from you, from third parties, and from publicly available sources.

Who is your consumer health data shared with?

We may share each of the categories of consumer health data described above for the purposes described in Who We Share Your Information With and Why section of our Privacy Policy. In particular, we may share Personal Information, including consumer health data, with your consent or as reasonably necessary to validate your identity, or with a third party to help us provide our Services.

As necessary for the purposes described above, we share consumer health data with the following categories of third parties:

• Partners and other service providers. We may provide your Personal Information to third parties such as government agencies, telecommunications networks, financial institutions or other trusted and reliable sources of information. Our provision of your Personal Information to the foregoing parties is solely to verify your identity and eligibility for ID.me Services. We have established relationships with Registration Authorities similar to the entities described above whereby the Personal Information you provide to us will be transmitted to them using industry standard encryption tools, designed to protect such information from unauthorized access.
• Service providers. Vendors or agents (“processors”) working on our behalf may access consumer health data for the purposes described above.
• Parties to a corporate transaction. We may disclose consumer health data as part of a corporate transaction or proceeding such as a merger, financing, acquisition, bankruptcy, dissolution, or a transfer, divestiture, or sale of all or a portion of our business or assets.
• Government agencies. As described in our Privacy Policy and our Law Enforcement Requests Report, we disclose data to law enforcement or other government agencies when we believe doing so is necessary to comply with applicable law or respond to valid legal process.
• Other third parties. In certain circumstances, it may be necessary to provide data to other third parties, for example, to comply with the law or to protect our rights or those of our customers.

How to exercise your rights?

You may exercise your rights by contacting logging into your account to close your account, delete your selfie image or revoke previously given consent. The Your Choices, Rights and Controls section of our Privacy Policy outlines what choices you have about how we used your information. You can also contact our member support center.

If your request to exercise a right under the MHMDA is denied, you may appeal that decision by contacting us at privacy@id.me. If your appeal is unsuccessful, you can raise a concern or lodge a complaint with the Washington State Attorney General at www.atg.wa.gov/file-complaint.