Practice policies

Washington Consumer Health Data Privacy Policy

Effective Date: May 26, 2026 · Last Updated: July 15, 2026

This Washington Consumer Health Data Privacy Policy supplements our Privacy Policy and applies only to “Consumer Health Data” as defined by Washington’s My Health My Data Act (MHMDA), to the extent that such data is not protected health information governed by HIPAA.

What Is Consumer Health Data?

Under the Washington My Health My Data Act (effective March 31, 2024), “consumer health data” means personal information that is linked or reasonably linkable to a consumer and that a regulated entity uses to identify a consumer’s past, present, or future physical or mental health status. This includes, but is not limited to: health conditions or symptoms described in communications with us, the type of healthcare service you are seeking, location data from which health status could be inferred, and searches related to health conditions or medications.

What Consumer Health Data We Collect Through This Website

Through drraynadvorak.com, we may collect the following consumer health data:

  • Health questions or concerns submitted through our contact or inquiry forms.
  • The category of health service you appear to be seeking, based on how you describe your inquiry or which service pages you visit.
  • Appointment type or category selected through our online scheduling tool.

Consumer health data collected through clinical intake, electronic health records, or in-person care is separately governed by our HIPAA Notice of Privacy Practices.

How We Use Consumer Health Data

We collect consumer health data through this website solely for the following purposes:

  • To respond to your inquiry and provide information about our services.
  • To facilitate appointment scheduling and coordinate your care.
  • To comply with applicable legal and regulatory requirements.

We do not use consumer health data for behavioral advertising, algorithmic profiling, or any purpose unrelated to your direct care or inquiry.

How We Share Consumer Health Data

We do not sell consumer health data. We may share consumer health data with the following limited categories of third parties, solely to facilitate your care or inquiry:

  • Calendly (appointment scheduling) — subject to Calendly’s own privacy practices.
  • ChARM Health (electronic health record and patient portal) — governed by a HIPAA Business Associate Agreement.
  • Email service providers — for delivery of communications you have requested.

All third parties who handle consumer health data are contractually required to use it only to provide services to us and are prohibited from using it for their own independent purposes.

Your Rights Under the Washington My Health My Data Act

Washington consumers have the following rights with respect to their consumer health data:

  • Right to Confirm: You may request confirmation of whether we collect, share, or sell your consumer health data.
  • Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.
  • Right to Delete: You may request deletion of your consumer health data. Certain data may be retained where required by law or necessary for healthcare operations.
  • Right to Appeal: If we decline to act on your request, you may appeal our decision by contacting our Privacy Officer. We will respond within 45 days and provide a written explanation for any denial.

We will not retaliate against you for exercising your MHMDA rights.

How to Exercise Your Rights

To exercise any of the rights above, please contact our Privacy Officer:

Dr. Rayna Dvorak, ND, LAc — Privacy Officer
Email: hello@drraynadvorak.com
Phone: (480) 463-4066
Mail: 11656 98th Ave NE, Kirkland, WA 98034

We will respond to verifiable consumer requests within 45 days of receipt. If we require additional time, we will notify you in writing of the extension and the reason for it.

Relationship to Other Notices

This Policy applies only to consumer health data collected through this website and general business interactions, to the extent not covered by HIPAA. Protected health information maintained in connection with clinical care is exclusively governed by our HIPAA Notice of Privacy Practices. General website data practices are described in our Privacy Policy.

Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or applicable law. The effective date at the top of this page reflects the most recent revision. Previous versions are available upon request at hello@drraynadvorak.com.