Consumer Health Data Privacy Policy

This policy is about one narrow thing: information you give us before you are anyone’s client — when you use a booking or contact form on a therapy practice’s page to ask about care. Washington’s My Health My Data Act calls that consumer health data and requires a policy of its own. It is separate from our Privacy Policy, which covers everything else.

If you are already a client of a practice that uses Suithera, this policy is not about your records. Those are protected health information, the practice is responsible for them, and we hold them only on that practice’s instructions under a business associate agreement. See Privacy Policy and our BAA.

1. What we collect, why, and how it is used

Two forms collect consumer health data:

• A practice’s booking request form. Your name, email address, phone number, and whatever you choose to write in the free-text note — which may say why you are seeking care. We collect it for one purpose: to pass your request to the practice you contacted, so that practice can respond to you. We also use your email address to send you one confirmation that the request went through.
• A contact form on a practice’s website. Whatever fields that practice’s form asks for, as you fill them in. Same single purpose: delivering your message to that practice.

That is the whole use. We do not advertise to you with it, we do not sell it, and we do not build a profile of you from it. It is encrypted where it is stored.

2. Where it comes from

From you, directly, when you submit one of those two forms. We do not buy consumer health data, and we do not collect it from data brokers, advertising networks or any other outside source.

3. What we share

The same information described in section 1, and only for the purpose described there. We do not share a category of consumer health data that we do not collect.

4. Who receives it

The practice you contacted. That is the point of the form. Each practice is a separate business, independent of Suithera, and once your message reaches them their own privacy practices apply to what they do with it.

Our service providers, who process it on our instructions and for no purpose of their own:

• Microsoft Corporation — Microsoft Azure hosting, database and storage; Azure Communication Services for the confirmation email we send you. Contact: microsoft.com/privacy.

Affiliates: none. Suithera is the trade name of Su Information Technologies LLC, a Colorado limited liability company. There is no parent, no subsidiary and no affiliated entity that receives consumer health data.

We do not share consumer health data with advertisers, analytics companies or data brokers. We do not sell it, and we will not — a sale would require your signed authorization under Washington law, and we do not ask for one.

5. Your rights, and how to use them

Write to privacy@suithera.com from any address and say what you want. You may:

• Confirm and access — ask whether we are collecting, sharing or selling consumer health data about you, get a copy of it, and get the list of every third party and affiliate it has reached, with a way to contact them.
• Withdraw consent — tell us to stop collecting and sharing it.
• Delete it — we delete it from our records and tell the service provider above and the practice you contacted to do the same. Encrypted database backups roll off on a 14-day cycle, so a copy can survive there for up to two weeks after we delete it; nothing is restored from them in the meantime. Our long-term audit archive never held your name, contact details or message in the first place — only the fact that a request was made.
• Appeal — if we refuse a request we will tell you why and how to appeal it, and we answer an appeal in writing within 45 days. If we refuse the appeal we will give you a way to contact the Washington Attorney General to submit a complaint.

We answer within 45 days and will tell you if we need the further 45 days the law allows. It is free, up to twice a year.

One limit worth stating plainly. If you have since become a client of the practice, your treatment record belongs to that practice and is governed by HIPAA and by state medical-records law — we cannot delete a clinician’s record of your care on our own, and a request under this policy does not reach it. Ask the practice directly; our Privacy Policy explains that route.

6. Changes

If we ever want to collect, use or share a category of consumer health data that is not described above, or for a purpose not described above, we will disclose it here and ask for your consent before doing it — not afterwards.

Questions: privacy@suithera.com.