How Sleep Balance Academy PC handles health related information that is not covered by HIPAA, including what a visit to our store can suggest about you before you are ever a patient. It covers what we collect, who receives it, and the rights you have over it.
Effective
Last updated
Contents
Effective date
1What this notice covers, and which document covers the rest
We publish several documents about your information. Three of them govern what we may do with it, and they do different jobs. Reading the wrong one will give you the wrong answer.
Document
What it governs
Notice of Privacy Practices
Your health information as a patient of Sleep Balance Academy. Your record, your visits, your prescriptions, and everything we do with them. This is the HIPAA instrument and it is the strongest of the three.
Privacy Policy
Everything else we collect from everyone: your account, your orders, your payments, your messages to support, and how we run the site.
This notice
Health related information about you that HIPAA does not reach. Most of it comes from browsing and buying on our public store, before and outside any care relationship.
Washington law requires this document to stand on its own and to be linked from our homepage rather than buried inside a general privacy policy. That is why it is separate. Where this notice and another of our documents both apply to the same information, the one that gives you more protection is the one we follow.
2What consumer health data means
The legal definition is much wider than most people expect. It is not limited to what you tell us about your health. It reaches what can be worked out about your health from things that are not obviously health information at all.
Consumer health data
Information that identifies you, or could be linked to you, and that relates to your past, present or future physical or mental health. It includes a condition, a symptom, a treatment, a medication, a measurement taken from your body, and the fact that you sought or received health care.
Inferred and derived data
A conclusion about your health that we could reach from information that is not itself health information. The law treats the conclusion as health data whether it was drawn by a person, by a rule, or by software, and whether or not anyone actually drew it.
Consumer
You, when you are acting for yourself or your household rather than in a job. Our staff are not consumers of ours for the purposes of this notice, and their information is handled under our employment policies instead.
Some plain examples of how the wider definition works on a store like ours:
You read three pages about a sleep condition and put nothing in your bag. Nothing about your health was typed anywhere, and the pages you opened still suggest a health interest.
You buy an airway product. The purchase is a commercial fact, and it also supports an inference about your breathing, which makes it health data.
You ask through a contact form whether we treat a particular problem. That question is health data from the moment you send it, and you are not a patient yet.
You start a request for a consult and stop before you finish it. The fact that you started is health data, and it is covered by this notice rather than by the Notice of Privacy Practices, because no care relationship began.
3Where HIPAA ends and this notice begins
Sleep Balance Academy PC is a professional corporation that practices medicine. When you become our patient, the information we hold about your care is protected health information under HIPAA, and the Notice of Privacy Practices sets out what we may do with it and what rights you have. Nothing in this notice narrows that, and nothing in this notice gives you less than that document gives you.
State consumer health data laws are written to reach the health related information that HIPAA does not, which for us is mostly what happens on the public store. Where your information is protected health information, HIPAA governs. Where it is not, this notice governs.
Where we cannot tell which side of that line a piece of information sits on, we treat it as the more protected of the two. We would rather over-protect something than argue later about which document applied.
4What we collect
These are the categories of consumer health data we collect. We do not collect a category that is not on this list, and if we ever need to, we will say so here and ask you first.
Category
What it includes
Contact details attached to a health interest
Your name, email address, postal address and phone number, when they are connected to something health related such as an order for an airway product or a question about a sleep problem.
What you look at in our store
The product and education pages you open, what you search for, and what you put in your bag. On a store that sells sleep and airway products, this can suggest a health interest even when you never state one.
What you buy
The items in an order and the fact that you bought them. Your card details go straight to our payment processor and we never hold them.
What you type into a form or a message
Anything you write in a contact form, a product question, a review, or a request for care, including symptoms you choose to describe.
Interest in care, before care begins
That you asked about a consult, started a request and did not finish it, or asked whether we treat a condition. From the point you become a patient, your record is governed by the Notice of Privacy Practices instead.
Device and connection information
Your browser and device type and the network address a request came from, which we use to keep the store working and to detect abuse.
Conclusions that could be drawn
Anything on this list that supports an inference about your health. The law treats the inference as health data whether or not we draw it, so we treat it that way too.
5Where it comes from
From you. Everything you type, buy, ask, or send us.
From your device, as you use the store. Which pages your browser asked for, and the technical details every website receives in order to answer a request.
From the companies that help us run the store. The companies that ship your order, take your payment, and deliver our email tell us what they have to for their part of the job: that a payment succeeded, that a parcel was delivered, that a message bounced.
Not from your clinical record. If you are our patient, your clinical record is held under the Notice of Privacy Practices. It is not a source for this notice, and we do not pull from it to market to you.
We do not buy consumer health data. We do not obtain it from a data broker, an advertising network, or a list vendor, and we do not append information about you from an outside source.
6Why we collect it, and what we do not do with it
We collect and use consumer health data for these purposes and no others:
to show you the store, keep your bag, and remember your preferences
to take, fulfill, support and correct an order, including a return, a refund or a recall
to answer a question you send us and to keep a record of what we told you
to arrange care you have asked for, and to hand you over to the clinical side properly
to keep the site secure, to prevent fraud, and to investigate abuse of the service
to meet a legal obligation, including product safety reporting, tax records, and responding to a lawful request
to understand how the store is used
We do not use consumer health data to advertise to you, to build a profile for an advertising network, to decide what price you are shown, or to make an automated decision about you that has a legal or similarly significant effect.
The law does not let us quietly add a purpose. If we ever want to use consumer health data for something that is not on the list above, we have to add it to this document and get your agreement before we start, not after.
7Who receives it
7.1 Who we share it with
Companies that do a job for us. The carriers that deliver your order, the processor that takes your payment, the service that delivers our email, and the companies that host and protect the site. They act on our instructions under a written contract, they may only use it to do the job we hired them for, and they may not sell it or use it for themselves.
Professional advisors. Our accountants and our lawyers, who are bound by their own duties of confidentiality.
When the law requires it. A court order, a subpoena, a regulator acting within its authority, a mandatory safety report, or an urgent situation where sharing is necessary to protect someone from serious harm. We tell you when we are permitted to tell you, and we give only what is actually required.
If the business changes hands. If our business is sold or merged, the buyer takes on this notice as it stands. We tell you before your information moves, and a buyer cannot use it in a way this notice does not allow without asking you.
Washington law also requires us to name any affiliated company that receives consumer health data, rather than describing it by category. No affiliated company receives consumer health data from us. If that ever changes, we will name the company in this document before any information reaches it.
7.2 Who we do not share it with
We do not share consumer health data with an advertising network, a data broker, a social media platform, a lead generator, or anyone who wants it to market to you. We do not run advertising or analytics tags on our sites at all, which is set out in our Cookie and Tracking Notice.
7.3 The list you can ask for
You can ask us for the list of the specific third parties and affiliates that received consumer health data about you, together with a way to contact each of them. We give you that list as part of an access request, and section 11 explains how to make one.
8We do not sell consumer health data
We do not sell consumer health data. Not for money, and not for anything else of value.
This is worth more than one sentence, because the law treats a sale of health data differently from anything else, and the difference is easy to miss.
A sale is not something you can agree to by clicking a banner, ticking a box at checkout, or continuing to use the site. It requires a separate written authorization that you sign. That authorization has to be distinct from any other permission you have given us, has to name exactly what data is being sold and who is buying it, has to expire within one year, has to be revocable by you at any time, and we have to give you a copy of it.
We do not ask anyone to sign one. We will never make care, an order, a price, or anything else conditional on you signing one. If we ever intend to sell consumer health data, we have to come and ask you, in that form, first.
9We do not use a geofence
We do not draw a virtual boundary around a hospital, a clinic, a pharmacy, a doctor's office, or any other place that provides health care in person.
Specifically, we do not use any such boundary to work out who is seeking health care, to track anyone going to or from one of those places, to collect health data from people near one, or to send anyone a message, a notification or an advertisement because of where they were.
This is not a setting we could change. The practice is unlawful in Washington, we do not do it anywhere, and we do not permit any company working for us to do it on our behalf.
10Your rights
You have all of the following rights over consumer health data about you:
Confirm. Ask whether we are collecting, sharing or selling consumer health data about you, and get a straight answer.
Access. Get a copy of the consumer health data we hold about you, together with a list of every third party and affiliate we shared or sold it to and a way to contact each of them.
Delete. Ask us to delete it. We delete it from our records, and we tell everyone we shared it with to delete it as well. Where a copy sits in a backup, deletion can take longer while those backups cycle through, and never longer than six months from the day we confirm your request.
Withdraw consent. Where we rely on your consent to collect or share, you can take that consent back at any time. It stops future collection and sharing. It does not undo something that already happened lawfully, and it does not delete anything on its own, so tell us if you want deletion too.
Appeal a refusal. If we refuse a request, we tell you why in writing and you can appeal. If we refuse the appeal, we tell you that too, in writing and with our reasons, and we give you a way to complain to your state attorney general.
Not be treated differently. We will not charge you more, give you less, delay your order, or affect your care because you used one of these rights.
You do not need an account to make a request, and we will not make you create one. Requests are free, up to twice a year. If a request is clearly excessive or repetitive we may charge a reasonable fee or decline it, and if we do, we have to explain why and you can appeal that decision.
11How to make a request, and what happens next
There is no self-service portal for this. You make a request by writing to us, and a person handles it.
Send an email to support@sleepbalanceacademy.com with the subject line "Consumer health data request".
Tell us which right you are exercising, and give us the email address or the order number you used with us so we can find the right records.
We may ask you for enough information to be confident that you are who you say you are. We ask for the least we can, we use it only for that check, and we do not keep it afterwards. If we genuinely cannot confirm your identity we will tell you, and we will not act on the request, because handing your health data to the wrong person is the worse outcome.
We answer within 45 days. If the request is complicated and we need longer, we tell you inside those first 45 days, we tell you why, and we take at most 45 more.
If you disagree with our decision, reply to it within 45 days and say so. We answer an appeal in writing within 45 days.
If you want your request handled as both a consumer health data request and a request under your rights as a patient, say so and we will treat it as both. They are governed by different rules and you should not have to know which one applies.
12How long we keep it, and who can see it
We keep consumer health data for as long as we need it for the purpose we collected it for, and then we get rid of it. Some records we have to keep for longer because the law says so, such as the record of a sale, a tax record, or a product safety report. Where that applies, we keep the record and not more than the record.
Inside our company, access is limited to the people who need it to do their job, and the people who work for us are trained on handling health information. Information is encrypted while it travels to us and while we store it. We keep our security practices under review, and we do not publish the details of them here, because a public description of how a system is defended is useful mainly to the people trying to get past it.
13If you do not live in Washington or Nevada
These rights come from state law, and not every state has passed one. We apply this notice to everyone in the United States anyway. The commitments that matter most here, that we do not sell your health data, that we do not use a geofence, and that we do not hand it to advertisers, are not written per state, and it would be strange to make you prove where you live before we behave properly.
We sell and ship within the United States.
14Changes to this document
We update this document when what we do changes, when the law changes, or when we find wording that is unclear. Every version is kept, and each one records the date it took effect.
How you find out depends on how much changed. A correction that does not change your rights is simply published. A change that does affect your rights is announced before it takes effect. A change that materially alters what you agreed to is not applied to you by silence: we ask you to accept it, and continuing to browse the site is not treated as acceptance.
If you want a copy of an earlier version, or want to know what changed and when, write to support@sleepbalanceacademy.com and we will send it to you.
To make a consumer health data request, email support@sleepbalanceacademy.com with the subject line "Consumer health data request", or write to our business address. If you are not satisfied with how we handled it, you can appeal by replying to our decision, and you can complain to your state attorney general.
