Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy explains how Mill Creek Skin & Laser Center (“Mill Creek,” “we,” “us,” or “our”) collects, uses, and discloses consumer health data subject to the Washington My Health My Data Act, Chapter 19.373 RCW.

This policy applies to consumer health data covered by that law. The Act contains exemptions for certain information governed by HIPAA, Washington Chapter 70.02 RCW, and other specified health privacy laws. Information that falls within an exemption is handled under the law that governs that information.

1. Categories of Consumer Health Data We Collect

Depending on how you interact with Mill Creek, we may collect:

• Information about treatments, services, procedures, products, or consultations you request or express interest in receiving.
• Information identifying or reasonably linking you to an effort to seek health care or aesthetic health services.
• Appointment and consultation information associated with a treatment or health-related service.
• Health concerns, symptoms, treatment history, goals, or other health-related information you voluntarily provide.
• Communications about treatments, procedures, consultations, or health care services.
• Photographs or other information you voluntarily provide when a consultation or service specifically requests them.
• Transaction information associated with health-related products or services.
• Website or online activity that identifies or is reasonably linked to a person seeking health care services, when such information is collected.
• Precise location information only when such information is collected and reasonably linked to an attempt to obtain health care services.
• Health-related inferences, if any are created from information you provide or from permitted interactions with our services.

We do not intentionally create health inferences from unrelated information for independent advertising purposes.

2. Purposes for Collection and Use

We collect and use consumer health data for purposes that include:

• Responding to treatment, consultation, and service inquiries.
• Scheduling, confirming, and managing appointments.
• Providing products or services you request.
• Evaluating and responding to treatment inquiries and service interests.
• Communicating with you regarding requested services.
• Maintaining records associated with your requests.
• Processing transactions associated with requested services.
• Protecting our systems and preventing fraud, misuse, or security incidents.
• Meeting legal, regulatory, licensing, and professional obligations.
• Other purposes clearly disclosed to you when consent is requested.

When Washington law requires affirmative consent for a particular collection, use, or sharing activity, we obtain the required consent before beginning that activity.

3. Categories of Sources

We may collect consumer health data from:

• You directly.
• Website forms you submit.
• Appointment, scheduling, and practice management systems.
• Email, telephone, text message, chat, and other communications with us.
• Information you provide during requests for products or services.
• Service providers processing information on our behalf.
• Your permitted interactions with our website and online services.

4. Categories of Consumer Health Data We Share

When permitted by law and necessary for the purposes described in this policy, categories of consumer health data disclosed to a third party or processed by a service provider may include:

• Contact information associated with a treatment or health care request.
• Appointment or consultation information.
• Treatment or service interests.
• Health information voluntarily submitted in connection with a requested service.
• Communications related to requested health care services.
• Transaction information associated with requested services.

We do not sell consumer health data. We do not authorize consumer health data to be provided to third-party advertising networks for their independent targeted advertising purposes without the authorization or consent required by applicable law.

5. Categories of Recipients and Specific Affiliates

Consumer health data may be processed or disclosed, as permitted by law, to the following categories of recipients when reasonably necessary for the purposes described above:

• Appointment scheduling, practice management, and patient communication providers.
• Health care professionals and personnel involved in providing requested services.
• Website hosting, information technology, cybersecurity, and data storage providers acting on our behalf.
• Email, telephone, and text communication providers acting on our behalf.
• Payment or financing providers involved in transactions you request.
• Professional advisers when disclosure is necessary for legal, accounting, insurance, compliance, or similar services.
• Government agencies, courts, regulators, or other recipients when disclosure is required or permitted by law.
• Analytics or marketing providers only to the extent permitted by applicable law and the consent choices presented to you.

Specific affiliates: As of the Last Updated date, Mill Creek does not identify a separate corporate affiliate with whom it shares consumer health data for the affiliate’s independent purposes. If this changes, we will update this policy before any newly covered collection, use, or sharing that requires prior disclosure or consent.

A service provider acting only as our processor and following our documented instructions is treated according to the processor provisions of Washington law.

6. Your Washington Consumer Health Data Rights

Subject to applicable law, Washington consumers have the right to:

• Confirm whether we are collecting, sharing, or selling consumer health data concerning you.
• Access consumer health data concerning you.
• Receive a list of third parties and affiliates with whom consumer health data has been shared or sold, together with an active email address or other online contact mechanism when required by law.
• Withdraw consent for future collection or sharing when processing is based on consent.
• Request deletion of consumer health data concerning you.
• Appeal a refusal to take action on a consumer health data request.

7. How to Submit a Request

Submit a Washington consumer health data request using any of the methods below. For email requests, use the subject line “Washington Consumer Health Data Request.”

Business	Mill Creek Skin & Laser Center
Address	15111 Main St A101 & A201, Mill Creek, WA 98012
Email	skincare@millcreekskinlaser.com
Phone	(425) 382-8899

 

We may take commercially reasonable steps to authenticate a request before acting on it. You are not required to create a new account to exercise rights under the Washington My Health My Data Act.

8. Response Timing and Appeals

We respond to authenticated consumer health data requests without undue delay and within 45 days after receipt. Where reasonably necessary because of the complexity or number of requests, the response period may be extended once for up to 45 additional days. If an extension is needed, we will provide notice during the initial response period and explain the reason for the extension.

Information provided in response to a request is provided without charge up to twice annually per consumer, subject to the exceptions permitted by law for manifestly unfounded, excessive, or repetitive requests. Deletion from archived or backup systems may be delayed as permitted by Washington law.

If we decline to act on a request, you may appeal by emailing skincare@millcreekskinlaser.com with the subject line “Appeal of Washington Consumer Health Data Request.” We will respond to an appeal within 45 days. If an appeal is denied, we will provide information about contacting the Washington State Attorney General to submit a complaint.

9. Consent and Changes in Collection or Use

When consent is required by Washington law, the consent request will identify the categories of consumer health data involved, the purpose of collection or sharing, the categories of entities involved, and how consent may be withdrawn. Consent for sharing, when required, will be separate and distinct from consent for collection.

If we intend to collect additional categories of consumer health data or use existing consumer health data for additional purposes not disclosed in this policy, we will make the required disclosure and obtain affirmative consent before beginning that activity when Washington law requires it.

10. Data Security and Access Controls

We restrict access to consumer health data to personnel, contractors, and processors whose access is reasonably necessary for the purpose for which the information was collected or to provide a product or service you requested. We maintain administrative, technical, and physical safeguards appropriate to the nature and volume of the consumer health data we handle.

11. Contact Information

Business	Mill Creek Skin & Laser Center
Address	15111 Main St A101 & A201, Mill Creek, WA 98012
Email	skincare@millcreekskinlaser.com
Phone	(425) 382-8899