Washington Consumer Health Data Notice
This Consumer Health Data Privacy Notice describes how Rimkus Consulting Group, Inc. and its applicable subsidiaries and affiliates collect, use, share, and protect consumer health data under Washington’s My Health My Data Act. It supplements the general Privacy Notice. This Notice does not apply to information exempt from the Act, including protected health information governed by HIPAA or information processed in an employment context.
The applicable Rimkus subsidiaries and affiliates referenced above include: Rimkus Consulting Group, Inc., Rimkus New York, PLLC, Rimkus AE, Inc., Rimkus Forensics New York, PLLC, Core Human Factors, Inc., Core Human Factors, LLC (see also separate notice at www.corehf.com), or as otherwise identified in any additional information that may be provided at the time of collection of such information.
Contact: Andrea Mirin, Global Privacy Officer, Rimkus Consulting Group, Inc., 12140 Wickchester Lane, Suite 300, Houston, Texas 77079, USA; [email protected].
Consumer Health Data We May Collect
Depending on the services and interaction, Rimkus may collect consumer health data that identifies or can reasonably be linked to a consumer and reveals past, present, or future physical or mental health status. Categories may include:
- health conditions, diagnoses, symptoms, treatments, medications, medical history, family medical history, and medical insurance information;
- genetic, biometric, reproductive-health, or other health-related information provided in connection with an assignment, study, program, event, or service;
- demographic or biographical information when it is used to identify or infer health status; and
- internet, device, location, usage, or other electronic-network information when it identifies or may reasonably be used to infer a consumer’s health status or that a consumer is seeking health care services or products.
Sources of Consumer Health Data
We may collect consumer health data directly from consumers; through our websites, applications, communications, programs, events, and services; from clients that engage us to perform consulting, research, file-review, or related services; from service providers and vendors; from industry, patient, or professional groups and associations; and from publicly available websites and social media where permitted by law.
Why We Collect and Use Consumer Health Data
We may collect and use consumer health data to provide services requested by a consumer or our clients; perform consulting, research, analysis, file review, studies, programs, or other professional services; operate and administer our business; communicate about relevant services or opportunities with consent where required; maintain security, prevent fraud, and respond to incidents; comply with legal, contractual, and regulatory obligations; and establish, exercise, or defend legal claims.
How We May Share Consumer Health Data
We may share the categories of consumer health data described above with:
- Rimkus subsidiaries and affiliates involved in providing or supporting the relevant services;
- service providers and vendors that perform services on our behalf, including information-technology, hosting, security, storage, analytics, communications, research-support, and professional-service providers;
- clients that engaged Rimkus to conduct research, review files, or perform consulting or related services involving the consumer health data;
- professional advisers, regulators, law-enforcement authorities, courts, and other parties where disclosure is permitted or required by law; and
- transaction counterparties or successor entities in connection with a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar corporate transaction, where permitted by law.
Consent and Authorization
Except where collection or sharing is necessary to provide a service requested by our client (subject to client’s contractual relationship with the consumer), a service requested by the consumer, or another statutory exception applies, Rimkus will obtain the consumer’s separate, affirmative consent before collecting or sharing consumer health data. We will obtain valid written authorization before selling consumer health data. Rimkus does not currently sell consumer health data.
We will not collect, use, or share additional categories of consumer health data, or use consumer health data for additional purposes not described in this Notice, without first obtaining any consent required by law.
Geofencing
Rimkus does not use geofences around entities that provide in-person health care services to identify or track consumers seeking health care, collect consumer health data, or send health-related messages or advertisements in violation of applicable law.
Your Rights
Subject to applicable exceptions, a consumer may request to:
- confirm whether Rimkus is collecting, sharing, or selling the consumer’s health data and access that data;
- receive a list of the third parties and affiliates with whom Rimkus has shared or sold the consumer’s health data, including available contact information;
- withdraw consent to collect or share consumer health data; and
- delete consumer health data concerning the consumer, including requesting deletion by processors, affiliates, and other third parties as required by law.
To exercise a right, email [email protected]. We may authenticate the request using reasonable methods. We will respond without undue delay and within 45 days, subject to a permitted extension of up to 45 additional days with notice. If we deny a request, we will provide the reason and instructions for appealing. Appeals may be submitted through the same email address, and we will respond within the period required by law.
Security and Access Controls
Rimkus maintains administrative, technical, and physical safeguards appropriate to the volume and nature of consumer health data. Access is limited to employees, processors, and contractors for which access is necessary to further the purposes described in this Notice or to provide requested products or services.
Changes to This Notice
We may update this Notice from time to time. If we make material changes to the categories of consumer health data collected or shared, or to the purposes of collection or sharing, we will obtain consent where required before applying the changes.