Washington Consumer Health Data Privacy Policy

This Washington Consumer Health Data Privacy Policy supplements the CIRCLED Privacy Policy. It describes how CIRCLED handles “consumer health data” covered by the Washington My Health My Data Act.

CIRCLED is a peer community. It is not a healthcare provider and does not provide medical care, diagnosis, treatment, therapy, or medical advice.

Your choice about what you share
You never have to share information about your physical or mental health to join or participate in CIRCLED. CIRCLED does not require any minimum level of personal disclosure. What you choose to share is up to you.

CIRCLED does not ask you to provide a medical history, diagnosis, treatment information, medication information, or other health information as a condition of membership.

Because CIRCLED is a peer community in which members create their own profiles, posts, comments and messages, a member may nevertheless choose to include information about her physical or mental health in content she creates or in communications she sends to CIRCLED.

1. Consumer health data that may be collected
Under Washington law, “consumer health data” includes personal information that is linked or reasonably linkable to a consumer and identifies the consumer's past, present or future physical or mental health status.

CIRCLED is not designed to collect medical records or other clinical health information.

Consumer health data may nevertheless be present when you voluntarily include health-related information in:

• a written membership application answer;
• your member profile;
• a post or comment;
• a private message to another member; or
• an email or other communication you send directly to CIRCLED.

Depending on what you choose to write, this information may include information about a physical or mental-health condition, symptoms, treatment, diagnosis, medication, bodily functions or measurements, reproductive or sexual health information, gender-affirming care information, or another health-related experience that you choose to mention.

CIRCLED does not require you to provide information in any of these categories.

2. Sources of consumer health data
The principal source of consumer health data covered by this policy is you, when you choose to include health-related information in content or communications you create.

CIRCLED does not purchase consumer health data about members or applicants from data brokers.

CIRCLED does not intentionally create health profiles or health-related inferences about members for advertising, marketing, admission or membership decisions.

3. Why CIRCLED may process this information
CIRCLED does not require health information in order to decide whether you may join CIRCLED, maintain your membership, create a profile, participate in community discussions, or communicate with other members.

Health information may nevertheless be processed when you choose to include it in content or communications that you ask CIRCLED or its community platform to receive, store, display or transmit.

Depending on what you choose to do, this may include:

• storing and displaying content you choose to place in your profile;
• storing and displaying a post or comment to the community audience you choose to address;
• transmitting and storing a private message you choose to send to another member;
• receiving and responding to a communication you send directly to CIRCLED;
• keeping internal administrative records without copying, quoting or summarizing health information you have shared, except where the minimum necessary health information is needed in order to respond to a security incident or to harassment;
• moderating content and enforcing the Circle Code;
• responding to a safety, support or privacy request;
• protecting the security and integrity of CIRCLED and its systems; and
• complying with a legal obligation that applies to CIRCLED, including responding to a lawful request from a court or public authority where applicable law requires disclosure.

CIRCLED does not use consumer health data to provide medical diagnosis or treatment.

CIRCLED does not intentionally use consumer health data for CIRCLED's advertising or marketing.

CIRCLED does not sell consumer health data.

4. What is processed or disclosed, and to whom
CIRCLED uses service providers to operate the community.

Mighty Networks provides the community platform. Information you choose to place in your membership application, profile, posts, comments or private messages is hosted and processed through that platform.

Google Workspace provides CIRCLED's business email service. If you send health-related information directly to CIRCLED by email, that information may therefore be hosted and processed through Google Workspace.

CIRCLED engages these services to provide services for CIRCLED and to support the purposes described in this policy.

Content you choose to make visible to other members is provided to the members who can see that content. A private message you choose to send is provided to the participant or participants you choose to message.

Accordingly, the categories of consumer health data that may be disclosed through CIRCLED are the same categories described in Section 1, to the extent you choose to include that information in content or communications that are provided to another person or processed through CIRCLED's service providers.

CIRCLED may also disclose consumer health data where applicable law requires it.

CIRCLED has no affiliates.

CIRCLED does not sell consumer health data.

Mighty Networks and Google Workspace process this information on CIRCLED's behalf under written terms that limit what they may do with it. Mighty Networks also handles some information for its own purposes, including information about your Mighty Networks account, and may make analytics or advertising-related technologies available on its service, as CIRCLED's general Privacy Policy describes. CIRCLED has not determined whether any consumer health data is included in the information Mighty Networks handles for those purposes of its own. CIRCLED has not identified any third party with which it shares consumer health data, as Washington law defines sharing. If that ever changed, CIRCLED would first make the disclosures and obtain any consent that Washington law requires, as Section 10 describes.

5. Sensitive information and your choices
CIRCLED's joining process separately tells applicants that they do not have to share sensitive information in order to join.

The joining process also contains a separate sensitive-information question.

That question is part of CIRCLED's general privacy arrangements. CIRCLED does not rely on it as consent under the Washington My Health My Data Act.

The CIRCLED Privacy Policy provides additional information about that process and how consent may be withdrawn.

The sensitive-information consent currently described in the general CIRCLED Privacy Policy covers sensitive information that you choose to include in your profile, your written application answer or your posts.

Members may also choose to write sensitive information in comments, private messages or direct communications to CIRCLED. CIRCLED does not require you to do so.

Because members themselves create profiles, posts, comments and messages, CIRCLED cannot technically prevent a member from typing health information into member-created content.

If you do not want health information about you to be processed through CIRCLED, please do not include that information in content you create or communications you send.

6. Artificial intelligence
Some features made available by Mighty Networks can use artificial intelligence services. Those Mighty Networks AI features are currently turned off for CIRCLED.

CIRCLED also uses general-purpose artificial intelligence assistants for administrative, drafting and organizational work.

CIRCLED's current safeguard is that identifiable member personal information is not intentionally included in that work. Any future use of these assistants involving identifiable member personal information would require CIRCLED first to establish the contractual and data-transfer safeguards required for that use.

CIRCLED does not intentionally provide identifiable consumer health data to general-purpose artificial intelligence assistants for profiling, advertising, marketing, or decisions about whether a person may join or participate in CIRCLED.

Further information about CIRCLED's use of artificial intelligence is available in the main CIRCLED Privacy Policy.

7. Your Washington rights
Subject to the Washington My Health My Data Act and applicable exceptions, you may have the right to:

• confirm whether CIRCLED is collecting, sharing or selling consumer health data concerning you;
• access consumer health data concerning you;
• receive a list of third parties and affiliates with whom covered consumer health data has been shared or sold, together with contact information you can use to reach them;
• withdraw consent from future collection or sharing of consumer health data concerning you; and
• request deletion of consumer health data concerning you.

You do not need to create a new CIRCLED account to exercise these rights.

To make a request, email:

privacy@joincircled.com

You may write “Washington Health Data Request” in the subject line if convenient, but you do not lose your rights if you do not use those words.

CIRCLED may request information reasonably necessary to authenticate you and your request.

CIRCLED will respond to a request without undue delay. CIRCLED's general Privacy Policy promises a response within one month, and that promise applies to a Washington request too. Washington law separately requires a response in all cases within 45 days after CIRCLED receives the request. CIRCLED will promptly take steps to authenticate the request; authentication does not extend the 45-day period.

Where permitted by law and reasonably necessary because of the complexity or number of requests, the 45-day period may be extended once by a further 45 days. CIRCLED will tell you within the first month, and in no case later than the initial 45-day period, if an extension is necessary and explain why. The longer period for complex requests described in CIRCLED's general Privacy Policy does not apply to a Washington consumer health data request.

8. Deletion
If you make an authenticated request to delete consumer health data covered by Washington law, CIRCLED will process the request as required by the Washington My Health My Data Act.

Where required, CIRCLED will delete covered consumer health data from its records, including applicable archived and backup systems, and will notify applicable affiliates, processors, contractors and other third parties with whom consumer health data has been shared of the deletion request.

Those recipients are required by Washington law to honor applicable deletion requests subject to the requirements of that law.

Where covered consumer health data is stored on an archived or backup system, deletion may be delayed as permitted by Washington law to enable restoration of that system, but the delay will not exceed six months from authentication of the deletion request.

Because CIRCLED relies on third-party platforms for parts of its service, fulfilling a deletion request may require CIRCLED to take action or submit requests through those providers.

CIRCLED's internal preservation procedures do not override a deletion obligation imposed by applicable law.

9. If CIRCLED refuses a request
If CIRCLED refuses to take action on a Washington consumer health data request, you may appeal the decision.

You may appeal by replying to CIRCLED's decision or by emailing:

privacy@joincircled.com

Please state that you wish to appeal the decision.

The appeal process is available through the same privacy contact used for the original request.

CIRCLED will respond to the appeal in writing within 45 days after receiving it and explain any action taken or not taken and the reasons for the decision.

If an appeal is denied, CIRCLED will also provide an online mechanism, if available, or another method through which you may contact the Washington Attorney General to submit a complaint.

CIRCLED will not unlawfully discriminate against you for exercising rights provided by the Washington My Health My Data Act.

10. Changes to what CIRCLED collects or how it is used
CIRCLED will not collect, use or share additional categories of consumer health data not disclosed in this policy, or collect, use or share consumer health data for additional purposes not disclosed in this policy, without first making the disclosures and obtaining any affirmative consent required by Washington law.

11. Sale of consumer health data
CIRCLED does not sell consumer health data.

If that practice were ever to change, CIRCLED would first comply with the authorization and other requirements imposed by applicable law.

12. Security and access
Other than information you choose to make available to other members as described in Section 4, CIRCLED restricts access to consumer health data to those of its personnel for whom access is necessary to provide the community and related services you have requested.

Consumer health data you place on the community platform, or send to CIRCLED by email, is also held on systems operated by the service providers named in Section 4. CIRCLED administers who holds a CIRCLED account with each of those providers, but does not administer those providers' internal staff access to the systems they operate.

CIRCLED maintains administrative, technical and physical data-security practices intended to protect the confidentiality, integrity and accessibility of consumer health data appropriate to the volume and nature of the consumer health data involved.

13. Contact us
Questions about this policy, consumer health data, or your Washington privacy rights may be sent to:

privacy@joincircled.com

This Washington Consumer Health Data Privacy Policy supplements CIRCLED's general Privacy Policy.