Washington consumer health data privacy policy

About this document

Version history

This policy describes Alessia's practices under the Washington My Health My Data Act.

1. Categories, purposes and use

Alessia is a professional portfolio service, not a patient health service or electronic health record. Information that identifies or could reasonably identify a patient is prohibited. Alessia also prohibits users from intentionally entering information about their own physical or mental health, disability, wellbeing, diagnosis, treatment or other consumer health data.

Alessia does not intentionally collect consumer health data as part of the standard Service. Because collection under Washington law includes receiving, accessing, retaining, inferring, deriving or otherwise processing consumer health data, prohibited or incidentally received categories could include:

• a user's physical or mental health, disability, symptoms, diagnosis, treatment or medication mentioned in a reflection, recording, document or support request;
• reproductive or sexual-health information about the user;
• biometric or precise-location information that identifies or reveals the user's health status;
• professional activity or leave information that reveals or permits an inference about the user's health; and
• account, device or identifier information linked or reasonably linkable to one of those categories.

A prominent link to this policy is provided on the alessiahq.com homepage, as Washington law requires. Alessia does not sell consumer health data; any future sale would require your valid written authorization under RCW 19.373, which Alessia does not seek.

If Alessia receives prohibited consumer health data, it uses the information only as necessary to contain and resolve the incident, respond to the person, secure the Service, delete the information, retain a minimised incident record or comply with law. Alessia does not use consumer health data for personal health tracking, advertising, insurance or clinical decisions, health-location geofencing, or automated education, employment, credentialling or progression decisions.

Alessia will not collect or use an additional category of consumer health data, or use consumer health data for an additional purpose, without first updating this policy and obtaining the consumer's affirmative consent where Washington law requires it.

2. Sources

Prohibited or incidental consumer health data could come from:

• the user, through optional text, reflection, recording, attachment or support request;
• an Institution-controlled assessment or document;
• a supervisor or assessor named in the portfolio; or
• content the user selects for an AI-assisted or transcription feature.

Alessia does not acquire consumer health data from data brokers or advertising networks.

3. Categories shared and recipients

Alessia does not sell consumer health data. It does not share consumer health data with affiliates and currently has no affiliates with which it shares such data. It does not share consumer health data with third parties for advertising or their own purposes.

If disclosure is necessary to respond to an incident, protect legal rights or comply with law, consumer health data from any category listed in section 1 could be disclosed to professional advisers, courts or public authorities. Alessia will not share an additional category of consumer health data or share it with an additional category of third party without first updating this policy and obtaining the consumer's consent where Washington law requires it.

4. Washington consumer rights

Subject to Washington law, a consumer may ask Alessia to:

• confirm whether Alessia collects, shares or sells consumer health data about them;
• provide access to the data, including a list of all third parties and affiliates with which it has been shared or to which it has been sold and a means of contacting them;
• withdraw consent to collection or sharing; and
• delete the data.

Email privacy@alessiahq.com with the subject “Washington Consumer Health Data Request”. Do not include patient information or unnecessary portfolio evidence in the request. Alessia will use commercially reasonable measures to authenticate the request. A consumer does not need to create a new account to make a request, although Alessia may require use of an existing account where appropriate.

Where an Institution decides why and how the information is handled, its consumer health data policy and request process apply. Contact the Institution first; Alessia will assist it as a processor. This does not limit any right to contact Alessia where Washington law requires Alessia to respond directly.

Alessia will respond without undue delay and within 45 days after receiving the request. Alessia may extend that period once by up to 45 additional days where reasonably necessary and will explain the extension within the initial period. Information is provided without charge up to twice each year, subject to the rules for manifestly unfounded, excessive or repetitive requests.

For an authenticated deletion request, Alessia will delete the requested consumer health data from its records and network and notify each affiliate, processor, contractor or other third party with which it shared the data. Deletion from archived or backup systems may be delayed only as necessary to restore those systems and for no longer than six months after authentication of the request.

If Alessia refuses to act, the consumer may appeal by emailing legal@alessiahq.com with the subject “Washington Consumer Health Data Appeal”. Alessia will provide a written appeal response within 45 days. If the appeal is denied, the response will explain how to contact the Washington Attorney General.

Alessia International Ltd is located at 27 Old Gloucester Street, London, WC1N 3AX, United Kingdom. Privacy questions may be sent to privacy@alessiahq.com.