Consumer Health Data Privacy Policy

Washington My Health My Data Act · Nevada SB 370 · Connecticut health data provisions

This policy applies only to consumer health data as defined by the Washington My Health My Data Act and comparable state laws. It does not apply to protected health information governed by HIPAA; we are not a HIPAA covered entity. All other information is described in our Privacy Notice.

01Categories of consumer health data we collect

• Individual health conditions, symptoms, status and diagnoses you describe to us, including spinal conditions and prior surgeries.
• Measurements of bodily function and symptoms, including pain location and intensity and neurological symptoms.
• Answers to validated clinical questionnaires (Oswestry Disability Index, Neck Disability Index).
• Medical imaging studies and operative reports you choose to send us.
• Information that identifies you as seeking health care services.

02Purposes for collection and how it is used

• To review your case and provide an orientation-only assessment or second opinion.
• To generate the pre-diagnostic test report requested by you.
• To respond to your enquiry and, at your request, arrange a consultation or procedure.
• To maintain a clinical record of the care and correspondence provided to you.

We collect and use consumer health data only as necessary to provide the service you requested, or with your separate opt-in consent.

03Sources of consumer health data

• Directly from you, through website forms, the pre-diagnostic test, email, WhatsApp or telephone.
• From documents you choose to upload or send, such as imaging studies and operative reports.

We do not obtain consumer health data from data brokers, advertising networks or third-party sources.

04Categories of consumer health data we share

We share the categories listed in section 01 only in the circumstances described in section 05. We do not share consumer health data for advertising, analytics or marketing purposes.

05Third parties and affiliates with whom we share

• Hospital Ángeles del Pedregal (Mexico City) — only if you decide to schedule a consultation or procedure.
• CICOVE clinical and administrative personnel — our own affiliates, bound by professional confidentiality.
• Email and hosting providers acting as processors on our instructions.
• Government or judicial authorities — only where legally required.

06We do not sell consumer health data

We do not sell consumer health data, and we will not do so. Any sale would require your separate written authorization, which we do not seek.

07Your rights

• Confirm and access: ask whether we collect, share or maintain your consumer health data, and obtain a copy.
• List of recipients: obtain a list of all third parties and affiliates with whom we have shared your consumer health data, and contact information for each.
• Delete: ask us to delete your consumer health data from our records, including backups.
• Withdraw consent: withdraw consent to collection and to sharing, separately.

To exercise any of these rights, email contact@cicovespine.us with the subject line "Consumer health data request". We respond within 45 days, and may extend once by 45 days where reasonably necessary, telling you the reason. If we deny a request, you may appeal by replying to our response. If the appeal is denied, you may contact the Washington State Attorney General at atg.wa.gov/file-complaint.

08Where data is processed

Consumer health data is transferred to, processed and stored in Mexico, where CICOVE operates.

09Changes to this policy

If we collect, use or share new categories of consumer health data, or use it for a new purpose, we will update this policy and obtain your consent before doing so.