PracticeHQ Consumer Health Data Privacy Policy
Instrument: PRIV-01-CHD | Version: 2026-09-04.2 | Effective date: September 9, 2026
Vytivo, Inc. provides this policy for consumer health data subject to Washington’s My Health My Data Act in our direct PracticeHQ activities. It addresses the Act’s required categories, sources, uses, recipients and rights. HIPAA-protected or other legally exempt practice records are governed by their applicable practice notice and protections; a practice relationship does not exempt all account or website data.
1. Consumer health data, sources and uses
The following categories apply when the information identifies or can reasonably be linked to you and identifies your past, present or future physical or mental health, including seeking health services. We do not collect every category from every person.
| Category | Sources | Collection and use purposes |
|---|---|---|
| Account and relationship information revealing that you seek or receive health services, including a practice affiliation, service request or invitation | You; the inviting practice; authorized administration; your account interactions | Establish the requested practice connection, authenticate access, route communications and administer the requested service |
| Health facts you include in a direct support or rights request, and associated contact or case information | You; a person lawfully acting for a request; a practice or service provider helping resolve it | Respond to the request, troubleshoot the identified issue, correct information, handle a complaint and fulfill applicable rights |
| Consent, notice, preference, withdrawal and request records that reveal health-service participation or choices | Your document and service interactions; the practice; legal-document and request systems | Carry out the choice, retain evidence of its scope and support requests and compliance |
| Device, session, access, error or transaction information that reveals seeking or receiving a health service, including account-linked network information or payment references | Your use of the requested service; infrastructure, security and billing systems; you or the relevant practice | Maintain requested functions, authenticate, prevent misuse, investigate errors, reconcile disclosed charges and protect the service |
| Health information or inferences contained in the preceding records, including physical or mental conditions, treatment, medications or sensitive health matters you communicate | The preceding sources and information directly derived from those interactions | Perform the same requested support, routing, rights or security function, not create an independent cross-practice clinical profile |
Collection is limited to what is necessary for a product or service you request, supported by the consent required by the Act, or otherwise permitted by an applicable statutory provision. Consent for collection is distinct from any separately required consent for sharing. This policy is not consent.
2. Data shared and recipients
We share the categories above only to the extent the particular recipient needs them for the described, lawfully authorized purpose. Recipient categories are the named practice and its authorized personnel for requested routing or assistance; another recipient you specifically direct; professional advisers, public authorities or claim participants when an applicable legal exception permits the particular disclosure; and a lawful business successor when the Act permits that transaction and its applicable safeguards are met.
Contracted processors may handle these categories for hosting, authentication, secure communications, support, legal-document storage, security or billing on our behalf under purpose-limited instructions and required protections. A processor acting within those instructions is distinct from an independent third party; its contract cannot authorize a use inconsistent with this policy.
Specific affiliates with which we share consumer health data for their independent use: none under the processing described in this policy. An affiliate acting solely as a contracted processor is subject to the processor limits above, not an independent-use permission. The purposes described here do not include consumer-health-data sale, independent affiliate marketing or targeted advertising. A new independent affiliate recipient must be specifically identified before sharing; new categories or purposes require the advance disclosure and affirmative consent required by the Act. A sale, if ever separately proposed, requires its distinct statutory authorization and is not authorized by this policy.
3. Access, withdrawal, deletion and appeals
Contact privacy@mypracticehq.com or Vytivo, Inc. — Privacy, 1007 N Orange St, Suite 3990, Wilmington, DE 19801. Identify the request and provide information reasonably needed to verify it; do not email unnecessary clinical records. You do not need to create an account or use a special form.
You may request confirmation of whether we collect, share or sell your consumer health data and access to that data; a list of the third parties and affiliates with which we have shared or sold it, with the required contact information; withdrawal of applicable consent; and deletion. Required deletion includes downstream notices to processors, contractors, affiliates and other third parties as the Act requires. A permitted archived/backup deletion delay may not exceed six months after authentication of the request and does not permit resumed unrelated use.
We respond within 45 days of receiving a request. One additional 45-day period is permitted when reasonably necessary; we explain the extension and reason within the initial period. Information is provided free up to twice annually, subject to the Act’s exception for manifestly unfounded, excessive or repetitive requests. We use reasonable authentication, explain a permitted refusal and do not unlawfully discriminate for exercising rights.
To appeal a refusal, reply to the decision or email the same privacy address and state that you are appealing. We respond in writing within 45 days. If we deny the appeal, we provide the online complaint mechanism or other method by which you may contact the Washington Attorney General. The Attorney General also accepts complaints through its website at www.atg.wa.gov. A complaint to us is not a prerequisite to exercising an independent complaint right.