Consumer Health Data Notice

This Consumer Health Data Notice (the “Notice”) supplements our Privacy Policy and describes how RightPT collects, uses, shares, and protects “consumer health data.” It is intended to comply with state consumer-health-data laws, including Washington’s My Health My Data Act and Nevada’s consumer-health-data law, and applies to consumers in those and other states. RightPT is a technology marketplace, not a healthcare provider.

HIPAA. Where information is Protected Health Information (PHI) that RightPT handles for a HIPAA-covered provider under a Business Associate Agreement, that PHI is governed by the BAA and the provider’s HIPAA notice — not this Notice. This Notice and our Privacy Policy govern other consumer health data.

1. What “Consumer Health Data” Means

“Consumer health data” is personal information linked to you that identifies your past, present, or future physical or mental health. For RightPT, it can include the fact that you seek, schedule, or receive physical therapy; the specialty, condition category, or type of care you look for; your appointment details; health-related information you submit through the Platform (for example, when requesting an appointment); and location information used to find care near you.

2. Consumer Health Data We Collect

• Care you seek or receive — that you search for, book, or receive physical therapy, and the specialty, condition category, or visit type you select.
• Appointment information — dates, provider, location/modality, and status of your Bookings.
• Communications — inquiries and booking-related information you submit through the Platform that may reference your health, symptoms, or reason for visit.
• Location information — approximate location (e.g., city/ZIP) used to find nearby providers; precise location only if you enable it.
• Information you choose to provide — anything health-related you voluntarily enter into the Services.

3. Sources

We collect this data directly from you; from the provider you select (e.g., appointment updates); and automatically from your device (e.g., approximate location and usage), as described in our Privacy Policy.

4. How We Use Consumer Health Data

We use consumer health data as necessary to provide the Services you request — to power search and matching, schedule and manage Bookings, enable messaging with your provider, facilitate payment, support safety and fraud prevention, and comply with law. We do not use consumer health data to infer characteristics about you beyond what is needed to provide the Services. Any use beyond what is necessary to provide the Services is done only with your consent.

5. How We Share Consumer Health Data

5.1 The provider you select. We share the information needed to facilitate your Booking and care with the independent provider you choose.

5.2 Service providers. We share limited data with vendors that perform services for us under contract (such as cloud hosting, communications/SMS, and analytics) and that are restricted from using it for their own purposes. Our payment processor (Stripe) receives payment information, not clinical detail.

5.3 Legal and safety. We may share data to comply with law, respond to lawful requests, or protect rights and safety.

5.4 With your consent or authorization. We share consumer health data for any other purpose only with your consent and, where required by law, your separate valid authorization.

Categories of recipients: the independent provider you select; service providers/processors; and legal, regulatory, or government recipients where required.

6. We Do Not Sell Consumer Health Data

We do not sell your consumer health data, and we do not share or sell it in exchange for anything of value without your separate valid authorization as required by applicable law. We do not collect, use, or share consumer health data beyond what is necessary to provide the Services you request without first obtaining your consent.

7. Consent and Withdrawal

By using the Services to find and book care, you direct us to collect and use consumer health data as necessary to provide those Services. For collection, use, or sharing beyond that, we will request your consent, and any sale or specified sharing requires your separate written authorization. You may withdraw your consent at any time by contacting admin@rightpt.com; withdrawal applies going forward and does not affect processing already carried out.

8. No Geofencing

We do not use geofencing to create a virtual boundary around any healthcare facility or provider location in order to identify or track consumers, collect consumer health data, or send messages or advertisements to consumers based on their proximity to such a location.

9. Your Rights

• Confirm and access — confirm whether we collect, share, or sell your consumer health data and access it.
• List of recipients — obtain a list of the categories of third parties and affiliates with whom we have shared your consumer health data.
• Delete — request that we delete your consumer health data, subject to legal exceptions.
• Withdraw consent — as described in Section 7.

9.1 How to Exercise. Email admin@rightpt.com. (You can also correct much of your profile information directly in your account.) We will verify your identity before fulfilling a request. We respond within the timeframes required by applicable law (generally within 45 days, extendable where permitted). If we deny a request, you may appeal where your state provides an appeal right, and you may contact your state Attorney General.

10. Relationship to HIPAA and Our Privacy Policy

RightPT is not a healthcare provider. For providers who are HIPAA-covered, RightPT may act as a Business Associate as to PHI it processes on their behalf; that PHI is governed by the applicable BAA and the provider’s Notice of Privacy Practices. This Notice and our Privacy Policy govern consumer health data that is not PHI under HIPAA. We may also be subject to the California Confidentiality of Medical Information Act and the FTC Health Breach Notification Rule, with which we comply where applicable.

11. Security and Retention

We maintain administrative, technical, and physical safeguards designed to protect consumer health data, and we retain it only as long as necessary to provide the Services and meet legal obligations, after which we delete or de-identify it. No system is completely secure.

12. Changes to This Notice

We may update this Notice and will post the updated version with a new “Last Updated” date and provide additional notice where required.

13. Contact Us

RightPT (Right Care Marketplace LLC)
Email: admin@rightpt.com | Mailing address: 750 Garden St Unit 30, Milpitas, CA 95035