CONSUMER HEALTH DATA PRIVACY POLICY

Last Updated: April 5, 2026

This Consumer Health Data Privacy Policy ("CHDPP") is published pursuant to the Washington My Health My Data Act, Chapter 19.373 RCW ("MHMDA"). This policy applies to consumers residing in Washington State and consumers whose consumer health data is collected in Washington State ("Washington Consumers").

This CHDPP supplements, and is separate from, the GetMedKits Privacy Policy. This CHDPP applies solely to consumer health data as defined by the MHMDA and describes how GetMedKits ("we," "us," or "our") collects, uses, and shares consumer health data, and explains the rights of Washington Consumers regarding their consumer health data.

- - - - - - - - - - - - - - - - - - - -

DEFINITION OF CONSUMER HEALTH DATA

Under the MHMDA, "consumer health data" means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status. This includes, but is not limited to, individual health conditions, treatment, diseases, or diagnosis, social, psychological, behavioral, and medical interventions, health-related surgeries or procedures, use or purchase of prescribed medication, bodily functions, vital signs, or symptoms, diagnoses or diagnostic testing, treatment or medication information, gender-affirming care information, reproductive or sexual health information, biometric data, genetic data, precise location information that could reasonably indicate a consumer's attempt to acquire or receive health services or supplies, and data that identifies a consumer seeking health care services.

Consumer health data does NOT include protected health information governed by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and related regulations, publicly available information, or deidentified or aggregated data that we maintain in deidentified form and do not attempt to reidentify.

- - - - - - - - - - - - - - - - - - - -

1. CATEGORIES OF CONSUMER HEALTH DATA COLLECTED AND PURPOSES FOR COLLECTION

We collect the following categories of consumer health data from Washington Consumers and use it for the following purposes:

Category: Health conditions, diseases, and diagnoses

Examples: Cancer type, cancer stage, other health conditions disclosed in booking forms or intake forms, information entered in the "health goal" free-text field on our booking page

Purpose: To facilitate physician review and prescribing decisions, to connect you with appropriate healthcare providers, to coordinate prescription fulfillment, and to communicate with you about your service

Category: Treatment and medication information

Examples: Current medications and supplements, current cancer treatments (chemotherapy, radiation, immunotherapy), prescription history through our service

Purpose: To enable the prescribing physician to conduct a drug interaction review, to determine appropriate medications and dosing, to coordinate prescription compounding and fulfillment

Category: Bodily functions, vital signs, and symptoms

Examples: Weight, symptoms described during intake or on calls

Purpose: To enable weight-based dosing calculations, to facilitate physician clinical review

Category: Surgical and procedure information

Examples: Prior surgeries or procedures disclosed during intake

Purpose: To enable comprehensive physician review of your health history

Category: Health-related purchase information

Examples: Records of medication kits purchased through our service, kit level selected

Purpose: To process and fulfill orders, to manage billing and refunds, to coordinate pharmacy compounding, to provide customer support

Category: Precise location information that could indicate a consumer seeking health services

Examples: IP address collected by website analytics tools when visiting health-related pages on our website, shipping address provided for medication delivery

Purpose: IP address is collected by Meta Pixel and Google Analytics for advertising measurement and website analytics; shipping address is collected solely for medication delivery

Category: Data identifying a consumer seeking health care services

Examples: Booking a consultation on our website, submitting an intake form, communicating with us about health-related services

Purpose: To provide the telehealth coordination services you requested, to communicate with you about your appointment and service

- - - - - - - - - - - - - - - - - - - -

2. CATEGORIES OF SOURCES FROM WHICH CONSUMER HEALTH DATA IS COLLECTED

We collect consumer health data from the following sources:

Directly from you: When you submit information through our website forms (booking page, intake forms), during telephone calls with our patient coordinators, via text messages or emails you send to us, and through any other direct communications.

From our technology platforms: Our HIPAA-compliant CRM platform processes and stores your communications and form submissions. Meta Pixel and Google Analytics collect technical data (IP address, pages visited, browsing behavior) when you visit our website.

From our healthcare provider partners: Our independently licensed physician network may generate consumer health data in the course of reviewing your intake and making prescribing decisions.

From our pharmacy partner: Our licensed U.S. compounding pharmacy may generate consumer health data in the course of compounding and dispensing your prescription medications.

- - - - - - - - - - - - - - - - - - - -

3. CATEGORIES OF CONSUMER HEALTH DATA SHARED

We share the following categories of consumer health data:

Health conditions, diseases, diagnoses, treatment information, medication information, bodily functions (weight), symptoms, and surgical/procedure information: shared with licensed healthcare providers (for physician review and prescribing) and compounding pharmacy (for prescription fulfillment).

Health-related purchase information: shared with payment processor (for transaction processing) and compounding pharmacy (for order fulfillment).

Technical data associated with visits to health-related pages (IP address, pages visited, browsing behavior): shared with advertising and analytics platforms (for advertising measurement and website analytics).

Data identifying a consumer seeking health care services (name, contact information, booking data): shared with CRM platform (for appointment management and communications), healthcare providers (for clinical coordination), compounding pharmacy (for prescription fulfillment and shipping), and shipping carrier (for medication delivery).

- - - - - - - - - - - - - - - - - - - -

4. THIRD PARTIES AND SPECIFIC AFFILIATES WITH WHOM CONSUMER HEALTH DATA IS SHARED

We share consumer health data with the following categories of third parties:

Licensed Healthcare Providers: Independently licensed physicians and nurse practitioners who conduct clinical review and prescribing.

Compounding Pharmacy: A licensed U.S. compounding pharmacy that prepares and ships prescription medications.

Payment Processor: A third-party payment processor that processes transactions and provides fraud detection services.

Customer Relationship Management Platform: A HIPAA-compliant CRM and communications platform used for appointment management, communications, form data processing, and call recording storage.

Advertising and Analytics Platforms: Meta Platforms, Inc. (receives IP address, pages visited, browsing behavior, and cookie identifiers via Meta Pixel deployed on our landing page, booking page, and thank-you page, for advertising measurement and campaign optimization) and Google LLC (receives IP address, pages visited, browsing behavior, and cookie identifiers via Google Analytics, for website analytics).

Shipping Carrier: A shipping carrier that receives name and shipping address for medication delivery.

Legal Authorities: Federal, state, or local government agencies, law enforcement, or courts (when required by law, subpoena, court order, or government investigation).

We do not share consumer health data with any corporate affiliates. GetMedKits has no corporate affiliates.

Upon verified request, we will provide you with the specific names of all third parties to whom we have shared your consumer health data during the preceding twelve months.

- - - - - - - - - - - - - - - - - - - -

5. HOW TO EXERCISE YOUR RIGHTS

Under the MHMDA, Washington Consumers have the following rights regarding their consumer health data:

Right to Confirm Collection: You have the right to confirm whether we are collecting or sharing your consumer health data.

Right to Access: You have the right to access the consumer health data we have collected about you.

Right to Delete: You have the right to request that we delete consumer health data we have collected from you, including data held by our processors and contractors. Upon receiving a verified deletion request, we will delete your consumer health data within 30 days, or within 60 days if reasonably necessary, and will direct our processors to do the same. Certain data may be retained where required by applicable law (including HIPAA medical records retention requirements and tax recordkeeping obligations).

Right to Withdraw Consent: You have the right to withdraw your consent for the collection or sharing of your consumer health data at any time. Withdrawal of consent will not affect the lawfulness of any processing conducted prior to your withdrawal. If you withdraw consent for the collection of consumer health data necessary to provide our services, we may no longer be able to provide those services to you.

Right to a List of Third Parties: You have the right to request a list of all third parties and specific affiliates to whom we have shared your consumer health data during the preceding twelve months.

Right to Non-Discrimination: We will not discriminate against you for exercising any right under the MHMDA. We will not deny services, charge different prices, provide a different quality of service, or otherwise penalize you for exercising your rights.

Right to Appeal: If we deny your request to exercise any right, you may appeal our decision. If we deny your appeal, you may file a complaint with the Washington State Attorney General at atg.wa.gov.

How to Submit a Request:

Email: [email protected] (include "MHMDA Request" in the subject line)

Phone: +1 (346) 220-0227

Mail: GetMedKits, 4523 Marilee Chris Ct, Sugar Land, TX 77479

We will acknowledge your request within five (5) business days. We will respond to your request within the timeframe required by the MHMDA. We may ask you to verify your identity before fulfilling your request to prevent unauthorized access to your consumer health data.

- - - - - - - - - - - - - - - - - - - -

6. CONSENT

We collect consumer health data only after obtaining your affirmative consent. Consent for the collection of consumer health data is obtained when you voluntarily submit information through our website forms, book a consultation, submit an intake form, or otherwise voluntarily provide health-related information to us through any communication channel.

We obtain separate consent before sharing consumer health data with third parties for purposes beyond what is necessary to provide the services you requested. You may withdraw consent at any time by contacting us using the methods listed in Section 5.

We do not collect, use, or share categories of consumer health data or use consumer health data for purposes not disclosed in this CHDPP without first disclosing the additional categories or purposes and obtaining your affirmative consent.

- - - - - - - - - - - - - - - - - - - -

7. SALE OF CONSUMER HEALTH DATA

We do not sell consumer health data. If we ever seek to sell consumer health data in the future, we will first obtain a valid written authorization from you that is separate and distinct from the consent described in Section 6. Any such authorization would be signed by you, describe the consumer health data to be sold, identify the purpose of the sale and the buyer, include an expiration date not to exceed one year, and clearly state your right to revoke the authorization at any time. We would retain a copy of any such authorization for six years.

- - - - - - - - - - - - - - - - - - - -

8. GEOFENCING

We do not implement any geofence around any entity that provides in-person health care services. We do not use geofencing to identify or track consumers seeking health care services, collect consumer health data from consumers near health care facilities, or send notifications, messages, or advertisements to consumers related to their health data or health care services based on proximity to a health care facility.

- - - - - - - - - - - - - - - - - - - -

9. DATA SECURITY

We implement reasonable administrative, technical, and physical safeguards to protect consumer health data from unauthorized access, use, disclosure, alteration, or destruction. These safeguards include SSL/TLS encryption, secure hosting, firewalls, role-based access controls, and contractual data protection requirements with service providers that process consumer health data.

- - - - - - - - - - - - - - - - - - - -

10. PROCESSOR AND CONTRACTOR REQUIREMENTS

Any processor or contractor that processes consumer health data on our behalf is contractually required to adhere to the requirements of the MHMDA, to process consumer health data only as instructed by us for the purposes disclosed in this CHDPP, and to implement reasonable security measures to protect consumer health data.

- - - - - - - - - - - - - - - - - - - -

11. ENFORCEMENT

Under Section 11 of the MHMDA (RCW 19.373.070), any violation of the MHMDA is a per se violation of the Washington Consumer Protection Act (RCW 19.86). Violations are enforceable by the Washington State Attorney General and through private right of action. The Washington State Attorney General can be contacted at atg.wa.gov.

- - - - - - - - - - - - - - - - - - - -

12. CHANGES TO THIS POLICY

We may update this Consumer Health Data Privacy Policy to reflect changes in our practices or changes in applicable law. When we make material changes, we will update the "Last Updated" date at the top of this policy. We will not collect, use, or share additional categories of consumer health data or use consumer health data for additional purposes not disclosed in the then-current version of this CHDPP without first updating this policy and obtaining your affirmative consent.

- - - - - - - - - - - - - - - - - - - -

13. CONTACT US

For questions about this Consumer Health Data Privacy Policy or to exercise any right under the MHMDA:

Email: [email protected] (include "MHMDA Request" in the subject line)

Phone: +1 (346) 220-0227