Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy is required by the Washington My Health My Data Act (“MHMDA”) and applies to “consumer health data” as that law defines it. It supplements our general Privacy Policy; where this policy and the Privacy Policy differ on consumer health data, this policy controls. Although MHMDA is a Washington law (and Nevada has a similar law), we apply the protections described here to all Labcoat users, wherever you live.

Labcoat is a direct-to-consumer service and is not subject to HIPAA. We are not a healthcare provider, health plan, or business associate of one.

We collect the following categories of consumer health data, and only to provide our service to you:

• Health profile data: date of birth/age, gender, weight, height, body fat percentage, and pregnancy status.
• Health conditions and history: chronic conditions and the medical history you choose to enter.
• Medications: the medications you choose to enter.
• Lifestyle information: lifestyle and risk factors you choose to enter.
• Lab reports: the lab report files you upload (PDFs or images), the test values extracted from them, and the context you provide (such as the reason for your lab visit, blood draw date, and weight or blood pressure at the time of the draw).
• Chat content: the questions you ask the AI assistant and any files you attach to the conversation.
• Health-related inferences: the AI-generated explanations, summaries, and insights derived from the above.

We collect consumer health data from a single source: directly from you, when you create your health profile and upload or enter information. We do not receive your consumer health data from healthcare providers, labs, insurers, data brokers, or any other third party.

We use consumer health data only to:

• Analyze your lab reports and generate AI-powered explanations and summaries;
• Power the chat assistant so you can ask questions about your results;
• Personalize your analysis (for example, age- and sex-appropriate reference ranges); and
• Maintain your account and legally required records, such as consent audit trails.

We do not use consumer health data for advertising, marketing, or any purpose beyond providing the service to you.

We share consumer health data only with the service providers (“processors”) required to operate Labcoat. We share it for processing on our behalf, under contract, and not for their own purposes.

Categories shared: your uploaded lab files, relevant health profile data, and your chat questions are shared for AI analysis; your full profile, reports, chat history, and consent records are shared for storage.

Categories of third parties (and specific entities) we share with:

• Artificial intelligence provider — Google LLC (Gemini API). Receives your lab files, relevant health profile data, and chat questions to generate analysis. We use Google’s paid API tier, under which Google does not use your data to train its models; Google may retain API data for up to 55 days solely for abuse monitoring and policy enforcement.
• Database and storage provider — Supabase, Inc. Stores your account, health profile, lab reports, chat history, and consent records, encrypted in transit and at rest, with row-level security so only your account can access your records.

Our payment processor, Stripe, receives your email and purchase details only — it never receives consumer health data. We have no corporate affiliates with whom we share consumer health data, and we do not share it with advertisers, data brokers, or analytics providers. We may disclose data if required by valid legal process, and will notify you unless legally prohibited.

We have never sold, and will never sell, your consumer health data. MHMDA prohibits the sale of consumer health data without a separate, valid authorization; we simply do not engage in any sale, so no such authorization is sought or needed.

With respect to your consumer health data, you have the right to:

• Confirm and access the consumer health data we have collected about you, including a list of the third parties with whom it has been shared (those third parties are named in Section 5);
• Withdraw consent to our collection and sharing of your consumer health data;
• Delete your consumer health data; and
• Appeal a refusal to act on a request.

You can access and delete your data directly from your dashboard, or exercise any of these rights by emailing privacy@labcoat.net. Because every consent is necessary to provide the service, withdrawing consent means you will no longer be able to use Labcoat. We respond to verified requests within 30 days. If we decline a request, you may appeal by replying to our response; if we deny your appeal, you may contact the Washington State Attorney General. We will never discriminate against you for exercising these rights.

We do not use geofences around any healthcare facility, and we do not use location data to identify, track, collect data from, or send notifications to consumers related to their consumer health data.

For any question about this policy or to exercise your rights: privacy@labcoat.net.