Consumer Health Data Privacy Policy
Effective Date: September 22, 2026 | Last Updated: October 1, 2026
This Consumer Health Data Privacy Policy explains how North Peak Care PLLC ("North Peak Care," "we," "us," or "our") collects, uses, and protects consumer health data as defined by the Washington My Health My Data Act (chapter 19.373 RCW). It supplements our general Privacy Policy. Where this policy addresses consumer health data, this policy controls.
A note on patient information: Patient documents that pharmacies submit through our platform are protected health information governed by the Health Insurance Portability and Accountability Act (HIPAA) and are exempt from the My Health My Data Act. Our HIPAA practices are described in our Privacy Policy and Security Overview. This policy addresses health data that is not covered by HIPAA — principally health documentation nurses choose to submit to meet a Pharmacy Partner’s requirements, and reports of a nurse’s own injury or exposure.
1. Categories of Consumer Health Data We Collect
We collect the following categories of consumer health data from nurses in the North Peak network:
- Immunization, vaccination, and titer records
- Tuberculosis (TB) screening results
- Drug-screening results
- Other health-screening documentation a nurse chooses to submit to meet a Pharmacy Partner’s requirements
- Information about an injury or exposure a nurse reports to us, such as a needlestick or other exposure during a visit
We do not collect consumer health data from website visitors. Our website contact forms collect only name, email, phone, and company information, and our website does not use cookies or tracking technologies.
2. Purposes of Collection and How the Data Is Used
We collect and use this data only to:
- Transmit health documentation a nurse chooses to submit to the Pharmacy Partner that requires it. These requirements are set by the Pharmacy Partner; North Peak Care does not impose, evaluate, or waive them
- Keep a record of what was submitted and transmitted, as our agreements with Pharmacy Partners and applicable law require
- Record a nurse’s report of an injury or exposure for our records, insurance, and legal purposes
We do not use consumer health data for marketing, advertising, or any purpose other than those listed above. We will not collect additional categories of consumer health data, or use consumer health data for additional purposes, without first disclosing this and obtaining your affirmative consent.
3. Sources of Consumer Health Data
We collect consumer health data from one source only: directly from you, when you upload documents to our secure portal or report an injury or exposure to us.
4. Sharing of Consumer Health Data
We do not sell consumer health data, and we will not sell it.
Pharmacy Partners: When a Pharmacy Partner requires health documentation for access to its visits and you choose to submit it, we transmit it to that Pharmacy Partner. We share it only with your consent, obtained before we share it, and only with the Pharmacy Partner whose requirement it meets. If you do not consent, we do not share it; you will not have access to that Pharmacy Partner’s visits, and your access to other Pharmacy Partners’ visits is unaffected.
Injury and exposure reports: We do not share information about your own injury or exposure with a Pharmacy Partner without your separate written consent, except as the law requires. We may provide it to our insurance broker and insurer where our policy requires notice of a potential claim.
Otherwise, access to your health documents is restricted to you and to authorized North Peak Care administrators, and every access is recorded in an audit log.
Service providers (processors): Our data is stored and processed by Google LLC (Google Cloud Platform, Firebase, and Google Workspace), acting as our processor under contractual restrictions consistent with this policy.
Affiliates: North Peak Care has no affiliates with whom consumer health data is shared.
5. Your Rights
Under the My Health My Data Act, you have the right to:
- Confirm and access: confirm whether we are collecting, sharing, or selling your consumer health data, and access that data, including a list of any third parties and affiliates with whom we have shared it and a means of contacting them
- Withdraw consent: withdraw your consent to our collection or sharing of your consumer health data
- Delete: have your consumer health data deleted. If you request deletion, we will delete it from our systems, including archived and backup systems, notify our processors and any third parties with whom the data was shared, and honor the statutory timelines (deletion within 45 days, with the extensions the Act permits for complex requests and archived systems)
Exercising these rights will not result in discrimination. Note that because a Pharmacy Partner may require certain health documentation, withdrawing consent or requesting deletion may mean you no longer have access to that Pharmacy Partner’s visits; we will tell you if that is the case before completing your request.
6. How to Exercise Your Rights
Email us at scanales@northpeakcare.com from the email address associated with your portal account. We will respond within 45 days. We do not require you to create a new account to exercise your rights.
7. Appeals
If we decline to act on your request, you may appeal by replying to our response with the word "Appeal." Within 45 days of receiving your appeal, we will inform you in writing of any action taken or not taken, with an explanation. If your appeal is denied, you may contact the Washington State Attorney General to submit a complaint at www.atg.wa.gov/file-complaint.
8. How We Protect This Data
Access to consumer health data is restricted to those administrators for whom access is necessary for the purposes described above. We maintain administrative, technical, and physical safeguards including encryption in transit and at rest, role-based access controls, and audit logging of access. See our Security Overview for details.
9. Changes to This Policy
We will not make retroactive material changes to how we handle consumer health data without your affirmative consent. We will post any updates on this page with a revised effective date.
10. Contact Us
If you have questions about this policy, please contact us:
- Email: scanales@northpeakcare.com
- Website: www.northpeakcare.com