Consumer health data policy — Washington
Current service status: paid subscriptions, billing, trial activation, referral credits and Email/SMS delivery are not yet active. The provisions about them apply when those services are offered and activated; they do not authorise a purchase or charge. Your statutory rights remain protected.
Contents
1. Information covered by this policy
This dedicated policy concerns consumer health data in TaharaSmart when Washington's My Health My Data Act, RCW 19.373, applies. The operator is יהלום זקס. Rights requests: contact@taharasmart.com and the website's data rights centre.
2. Information categories and purposes
Consumer health data may include dates of bodily events and reproductive or sexual health aspects provided through the calendar; personal circumstances such as pregnancy or the postpartum period if entered; results or predictions derived from the data; notes and feedback containing such information; and account identifiers and usage details when linked to the information or used to infer health status.
Precise location provided for time calculations may also fall within the definition of health data in circumstances specified by law. We do not use location to establish geofences around health service providers to track visitors or target advertising to them.
The information is used to operate the calendar and calculations you requested, retain history and settings, provide selected reminders, investigate enquiries or defects and secure this processing. We do not use it for sale, targeted advertising or model training.
3. Sources of information
Sources are information provided by the user, the device when location or permitted technical details are requested, the authentication system for account details, and results the system derives from those data. We do not purchase health information from advertising databases, employers, insurers or data brokers.
4. Categories disclosed and recipients
Calendar data, settings and account information are accessible to hosting and database providers to the extent necessary for processing and storage. Recipient details, limited messages and delivery information are processed by email and SMS providers when requested. Coordinates are processed by a location lookup service when the user requests it. Information included in an enquiry is processed by authorised support personnel as needed to investigate it.
Payment providers process transaction details and the fact of the contractual relationship, not calendar content for billing. Location or account identification may also pass to relevant independent services according to the action requested by the user. Disclosures expressly required by law will be limited to the scope and conditions legally permitted. Disclosure to a processor under a contract and for the requested purpose will be classified according to the statutory definition, not described as unrestricted third-party use.
Third-party categories: independent authentication and location services and a party to whom disclosure is expressly required or permitted by applicable law. We do not sell consumer health data.
5. Collection, sharing and consent
Collection or disclosure will occur to the extent necessary for the product or service you requested, or on the basis of the specific consent required by law. Where sharing consent is required, it will be requested separately from collection consent. General acceptance of terms does not replace it.
We will not add an information category or purpose not disclosed in this policy without prior disclosure and the affirmative consent required by law. Consent can be withdrawn through contact@taharasmart.com or the data rights centre without registering a new account.
6. Rights, deletion and responses
You may request confirmation of whether we collect, share or sell health data about you, access to the data and a list of third parties and affiliates that received it with appropriate contact details; withdraw consent to collection and sharing; and request deletion. We will verify requests reasonably without unlawfully extending the mandatory deadline because of verification.
We will act without undue delay and within 45 days of receiving a request. A one-time extension of up to 45 further days will be used only where permitted and with notice and reasons provided within the initial period. Information in response will be provided free of charge up to twice a year, and otherwise subject to statutory limitations.
Deletion will also cover relevant systems and providers, with notice to recipients required to act. Delayed deletion from backups or archives will not exceed six months after verification of the request and will occur only insofar as permitted. We will not retain complete health data solely on a general claim of business need.
7. Appeals and complaints
You may appeal a refusal through the same data rights centre or by email to contact@taharasmart.com, indicating “Privacy request appeal”. We will respond in writing within 45 days of receiving the appeal with an explanation of the decision. If the appeal is denied, we will provide an online method or contact details for a complaint to the Washington State Attorney General. We will not unlawfully discriminate against a user for exercising a right.