Washington Consumer MHMDA Policy

The Washington My Health, My Data Act ("MHMDA") provides consumers residing in Washington and consumers whose consumer health data is collected in Washington (“Washington Consumers”, "you", or "your") with specific rights regarding their consumer health data.

This Consumer Health Data Privacy Policy (“WA Policy”) supplements the SBBC Health Privacy Policy ("Policy") and applies solely to Washington Consumers. This WA Policy also explains your rights regarding your consumer health data and how you can exercise those rights. This WA Policy describes the practices of SBBC Health and its subsidiaries and affiliates (“SBBC Health”, “we”, “us” or “our”) that link to the WA Policy regarding the collection, processing and use of consumer health data we collect from Washington Consumers.

At SBBC Health, we strive to help consumers achieve their goals by providing access to an array of insurance products. In doing so, we may collect and/or use the consumer health data of Washington Consumers. In this WA Policy, consumer health data has the meaning described below and excludes certain information subject to other laws.

1. Definitions Consumer health data is defined for purposes of this WA Policy and the MHMDA as personal information that is linked or reasonably linkable to a Washington Consumer and that identifies the Washington Consumer's past, present, or future physical or mental health status. Consumer health data may include, for example, information collected directly from you if you use certain services available on our sites or information that you voluntarily provide, such as information you provide in response to a written or verbal questionnaire or on an online form. We may also collect or receive consumer health data about you through or from our business partners and service providers that perform services for us or for you, or to offer our products and services to you. Under the MHMDA and the unique consumer rights described below, consumer health data does not include: Publicly available information, such as information from government records, information we reasonably believe you made available to the general public, or unrestricted information you have disclosed or made available; Deidentified or aggregated consumer information we maintain in deidentified form and do not attempt to reidentify except as required or permitted by law; Health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA); and Personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (“FRCA”) and the Gramm-Leach-Bliley Act (“GLBA”). We separately provide notices required under other state and federal laws, such as GLBA and HIPAA in connection with products and services subject to those laws.

2. Overview of Consumer Health Data Practices, Consumer Health Data We Collect:

A. We may collect and/or use the following types of consumer health data. Individual health conditions, treatments, diseases, or diagnosis This may include medical conditions, health history, history of diagnosis, symptoms, and other medical information, inpatient and outpatient care, medical recommendations, referrals, and consultations. Data that identifies a consumer seeking health care services This may include personal information relating to consulting with a physician, height and weight information, tobacco use information or records of your communications and other requests with us or one of our partner companies.

B. Sources of consumer health data and business purposes for collection and use. We collect your consumer health data directly from you and/or the agents you interact with when applying for or seeking information about our products and services. We may collect and/or use your consumer health data for the following business purposes: A purpose you direct. You direct us to collect and/or use your consumer health data to process your insurance product application; recommend insurance products and services to you; and provide insurance product quote information. Legal and regulatory compliance. For example, this may include preventing, detecting, or protecting against illegal activity, such as noncompliance with applicable laws and regulations.

C. Consumer health data we share. For purposes of the MHMDA, we may share your consumer health data with our affiliates, and related companies including insurance companies and their agents so they can provide accurate insurance quotes to you.

3. Your privacy choices And Rights: Subject to certain legal limitations and exceptions, you may be able to exercise some or all of the following rights:

A. Right to confirm and access You may have the right to request us to confirm whether we collect your consumer health data and to disclose the consumer health data we collect about you.

B. Right to delete You may have the right to request us to delete any of your consumer health data we collect and retain (and direct our processors and contractors to do the same).

C. Exceptions We may deny your request if retaining the consumer health data is reasonably necessary for us to: Prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any activity that is illegal under Washington state law or federal law; Preserve the integrity or security of systems; or Investigate, report, or prosecute those responsible for any such action that is illegal under Washington state law or federal law. Other legal limitations and exceptions may also apply.

D. Exercising your rights How to Submit A Request to Exercise Your Rights To exercise any of the rights described above, you may contact us at the following email: [email protected]. Exercising Your Right to Confirm and Access, and Delete Only you or your authorized agent may make an authenticated consumer request to confirm and access or delete your consumer health data. If you use an authorized agent to submit an authenticated consumer request on your behalf, we will require you to provide additional information as described below. You may make an authenticated consumer request on behalf of your minor child. In order to authenticate your identity to process your request, we will request your full name, street address, city, zip code, phone number, and email address. If the information you provided us does not match our records, in certain circumstances we may request additional information from you.

E. Response timing and format We endeavor to respond to an authenticated consumer request to confirm and access or delete within forty-five (30) days of its receipt. If we require more time (up to 30 additional days), we will inform you of the reason and extension period in writing. We will deliver our written response by mail or electronically, at your option. The response we provide will also explain the reasons we cannot comply with a request, if applicable. We do not charge a fee to process or respond to your authenticated consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

4. Changes to our WA Policy

We reserve the right to amend this WA Policy at our discretion and at any time. When we make changes to this WA Policy, we will post the updated WA Policy on the website and update the WA Policies effective date. Changes to the WA Policy will not affect our use of previously provided consumer health data. Contact information If you have any questions about this WA Policy, the ways in which we may collect and use your consumer health data described in this WA Policy, and your choices and rights regarding such use, please feel free to contact us by: Sending an email request to: [email protected] Sending a letter at: www.coverlinker.com SBBC Health, LLC, Attn: Legal Dept. Mailing/Billing Address 571 S Washington, Afton, Wyoming 83110. Appealing our decision about your rights If we have denied your request to exercise your rights under the MHMDA, you may appeal our denial. Please submit your appeal request by: Sending an e-mail request to [email protected]

Last revised: October 21, 2024