Washington State Consumer Health Privacy Policy

Last Updated:
September 15, 2026

Washington State Consumer Health Privacy Policy

This is a separate consumer health data privacy policy required by Washington Law. For information about Haven Health’s broader privacy practices, please review the Haven Health Website Privacy Policy.

1.1. Purpose and Scope. This Washington State Consumer Health Privacy Policy (“MHMD Policy”) describes how Haven Health, Inc. (d/b/a “Haven Health”) collects, uses, and shares consumer health data covered by Washington’s My Health My Data Act (“Washington Law”) through its website located at https://www.havenheadache.com, including its booking form and the email address and phone number listed on the website, as well as Haven’s owned or controlled social media pages and accounts, and the communications we send to you (including email, SMS/text messages, and newsletters) and any tracking technologies used in connection with those communications (collectively, the “Website”). This MHMD Policy applies only to consumer health data collected directly from visitors of the Website, including information a Website visitor directly provides or submits and information passively collected when a visitor accesses the Website. This MHMD Policy does not apply to your medical records or other health information that we handle on behalf of Haven Health’s Affiliated Providers, as defined in the Website Privacy Policy. In particular, it does not cover protected health information (PHI) or any other information that Haven Health receives from those Affiliated Providers as a HIPAA Business Associate, or that is otherwise exempt from Washington Law. That information is instead governed by HIPAA and the privacy practices of the applicable healthcare provider or other covered entity.

1.2. Consumer Health Data We Collect, Sources, and Purposes. 

“Consumer health data” means personal information that is linked or reasonably linkable to a consumer and identifies the consumer’s past, present, or future physical or mental health status, including any information derived or extrapolated from non-health information (such as proxies, derivatives, inferences, or emergent properties) that is used to identify such health status. Depending on what you choose to provide and how you interact with us, we may collect: (i) health-related information you enter or submit through the booking form or other forms on the Website; (ii) contact details you provide when you email or call the email address or phone number listed on the Website, or when you interact with us through our social media pages and accounts; (iii) identifiers and account information that are linked or reasonably linkable to your health status; (iv) website, device, usage, and log information that is linked or reasonably linkable to your health status and that is collected when you access the Website or engage with the communications we send you; and (v) inferences drawn from any of the foregoing that are linked or reasonably linkable to your health status.

We collect this data directly from you - including information you submit through the booking form or other forms on the Website and information you provide when you email or call the email address or phone number listed on the Website or interact with our social media pages and accounts - and through your use of the Website, including through website analytics tools, cookies, pixels, tokens, local storage, log files, and similar technologies that may collect or generate data linked or reasonably linkable to your health status when you access the Website, as well as tracking technologies used in connection with the communications we send you (such as email and SMS/text open and click tracking). Technologies that are strictly necessary to provide the Website or a feature you request through the Website are used on that basis. Where we use cookies, pixels, or similar technologies on the Website or in our communications for marketing or to improve the Website, and those technologies collect consumer health data that is not necessary to provide a product or service you have requested, we will collect and use that data only after obtaining your opt-in consent through a clear affirmative act, and you may decline or withdraw that consent at any time. We do not rely on your acceptance of a general terms of use or this MHMD Policy, on continued browsing, or on similar mechanisms as consent for such collection. For more information about these technologies, please see the Haven Health Website Privacy Policy. 

We collect and use consumer health data only as reasonably necessary to provide the services and features you request; create and manage your account; respond to your inquiries and provide support; personalize and improve health-related features; conduct internal analytics regarding use and performance of the Website; protect the safety, security, and integrity of the Website; and comply with applicable law. We will obtain your consent before collecting, using, or sharing consumer health data for any purpose not described in this MHMD Policy, as required by Washington Law. 

We collect only the consumer health data we reasonably need for the purposes described above. Some parts of the Website let you type in your own text, such as free-text boxes, contact forms, or booking or intake forms. When you use these, please share only the information needed for your request, and avoid entering sensitive health details that are not necessary. If you choose to include extra health information that we did not ask for, we will still protect and handle it in accordance with this MHMD Policy.

1.3. Consumer Health Data We Share.

We may share any of the categories of consumer health data described in Section 1.2 with the recipients listed below. Where sharing is necessary to provide the services you request, no additional consent is required. For any other sharing, including sharing with advertising or marketing partners, we will obtain your separate consent before sharing your consumer health data, as required by Washington Law. We do not sell consumer health data in exchange for monetary or other valuable consideration. Data that we deidentify so that it cannot reasonably be used to infer information about, or otherwise be linked to, a consumer or device is not consumer health data under Washington Law; where we share such deidentified data (for example, with advertising partners), we take reasonable measures to prevent re-identification, publicly commit to maintain and use it only in deidentified form, and contractually require recipients to do the same. Recipient categories are:

  • service providers and processors that support hosting, storage, authentication, transcription or voice processing, analytics, error monitoring, security, maintenance, customer support, and the delivery and measurement of the communications we send you (such as email and SMS/text messaging providers);
  • Haven Health personnel and contractors who need access to operate, support, secure, or improve the Website; and
  • Haven Health’s affiliates, including its Affiliated Providers, that share common branding with Haven Health, for purposes of providing, supporting, coordinating, or improving the Website; and
  • social media platforms and advertising or marketing partners in connection with our social media pages and accounts and the communications we send you, only where we have obtained your separate consent as described above; and
  • government authorities or other recipients when required by law or valid legal process.

1.4. Your Washington Consumer Health Data Rights. 

  • Confirmation and Access: You may confirm whether Haven Health is collecting, sharing, or selling your consumer health data and access the consumer health data we maintain about you.
  • Third-Party and Affiliate List: You may request a list of the third parties and affiliates with whom Haven Health has shared your consumer health data. For each third party on the list, we will include an active email address or other online mechanism you may use to contact them. Where we have shared your consumer health data with affiliates, including Haven Health’s Affiliated Providers, those affiliates will be identified on this list.
  • Withdrawal of Consent: You may withdraw consent to the collection of your consumer health data, the sharing of your consumer health data, or both. Because some collection and use of consumer health data is strictly necessary to provide the Website and the features you request, that processing does not rely on your consent and will continue so that you can keep using the Website; withdrawing consent stops only the collection, use, or sharing that is based on your consent, such as for marketing or to improve the Website. Withdrawal of consent will not affect the lawfulness of any processing conducted prior to your withdrawal.
  • Deletion: You may request that Haven Health delete your consumer health data. We will notify processors, affiliates, and other third parties to whom we have sent the data of your deletion request as required by Washington Law.
  • Nondiscrimination: We will not discriminate against you for exercising your rights under Washington Law.  
  • Appeals: If we deny your request, you may appeal within a reasonable time by using the request methods in Section 1.5 and including “APPEAL” in the email subject line or written request. Within 45 days after receiving an appeal, we will notify you in writing of the action taken or not taken and explain our decision. If we deny your appeal, we will provide an online mechanism, if available, or another method for contacting the Washington Attorney General.

1.5. How to Exercise Your Rights and Contact Us.

To exercise any right described in this MHMD Policy, submit a request by email or mail using the information below. Please provide enough information for us to authenticate your request using commercially reasonable efforts. We will respond to your request within 45 days of receipt. When reasonably necessary, we may extend this period by an additional 45 days, in which case we will inform you of the extension and the reason for it within the initial 45-day period. You may also use these methods to ask questions about this MHMD Policy.

  • Email: compliance@havenheadache.com (please include “Privacy Request” in the subject line)
  • Mail: Haven Health, Inc., Attn: Privacy Officer, 177 Post St, Floor 2, San Francisco, CA 94108

Last updated: September 15, 2026. We may update this MHMD Policy as required by Washington Law and will post the revised version on our website.  

‍