Consumer Health Data Privacy Notice

This Washington Consumer Health Data Privacy Notice (“Notice”) is provided by Xenter, Inc. (“Xenter,” “we,” “us,” or “our”) in accordance with the Washington My Health My Data Act (MHMD), RCW 19.373. It applies to “consumer health data”, as that term is defined under MHMD, that we collect through XenME and related Xenter consumer applications and services (the “Services”) from Washington residents and from individuals whose consumer health data is collected in Washington.

This Notice is maintained separately from Xenter’s other privacy notices, as required by MHMD, and contains only the disclosures required under the Act. For information about our broader privacy practices, see the XenME Consumer Privacy Notice, available at xenter.io/xenme/privacy.

1. Categories of Consumer Health Data We Collect, and Our Purpose for Collecting It

We collect the following categories of consumer health data for the purpose of providing the Services you request — specifically, retrieving, combining, and displaying your health, claims, and wearable/fitness data in one place, and enabling you to share that information with recipients you choose:

• Health and clinical records, such as diagnoses, medications, laboratory results, clinical notes, and immunization records;
• Insurance and claims information, such as coverage details, claims history, and plan benefits;
• Wearable and fitness data, such as heart rate, heart rate variability, sleep data, blood oxygen levels, activity and step counts, and stress or recovery scores; and
• Precise location data associated with workouts or activity tracked by a connected wearable or fitness platform.

2. Categories of Sources From Which We Collect Consumer Health Data

• Directly from you;
• Your healthcare providers, through a connection you authorize;
• Your health plan(s), through a connection you authorize;
• Health information networks and exchanges used to locate and retrieve your records where a direct connection is unavailable; and
• Wearable and fitness platforms you connect, such as Garmin, Apple Health, and Whoop.

3. Categories of Consumer Health Data We Share

We share the following categories of consumer health data:

• The health, claims, and wearable/fitness data described in Section 1, but only with recipients you direct us to share with through the Services (for example, when you generate a shareable link or export your record); and
• De-identified or aggregated consumer health data, which we may share with service providers for analytics and product improvement purposes.

We do not sell consumer health data.

4. Categories of Third Parties and Specific Affiliates With Whom We Share Consumer Health Data

• Service providers that host, secure, and support the Services under contractual data protection obligations; and
• Specific Xenter affiliates with access to consumer health data: no affiliate has access.

We do not share consumer health data with any other category of third party except as described above, as required by law, or as you separately direct.

5. Your Rights Under MHMD

• Right to confirm whether we are collecting, sharing, or selling your consumer health data, and to access that data.
• Right to withdraw your consent for our collection and/or sharing of your consumer health data at any time.
• Right to request deletion of your consumer health data, including from any archived or backup systems.
• Right to appeal a denial of any of the above requests.

We will not collect or share your consumer health data without your affirmative, opt-in consent, except to the extent necessary to provide a Service you have requested. Consent to share your consumer health data is separate and distinct from consent to collect it. We do not sell consumer health data without your separate, valid authorization. We do not engage in geofencing around healthcare facilities to collect consumer health data.

6. How to Exercise Your Rights

To exercise any of the rights described in Section 5, contact us using the information below. Please include “MHMD Request” in the subject line of your email.

• Email: privacy@xenter.io
• Web form: xenter.io/privacy-request
• Toll-free phone: 1-888-238-7204

We will use a secure and reliable method to verify your identity before responding to your request, and will respond within the time periods required by MHMD.

If we deny your request, you may appeal by emailing privacy@xenter.io with “MHMD Appeal” in the subject line. If your appeal is denied, you may submit a complaint to the Washington State Attorney General.

7. Contact

Xenter, Inc.

344 West 13800 South, Suite 400

Draper, Utah 84020, United States

• Email: privacy@xenter.io