Consumer Health Data Privacy Notice — MyEyes

1. Overview

This Consumer Health Data Privacy Notice (“Health Data Privacy Notice”) supplements the Privacy Notice (our general privacy notice available at myeyes.net/privacy) and explains MyEyes Corporation’s (“MyEyes”, “we”, “us”, or “our”) collection, use, and disclosure of “consumer health data” as defined under and subject to the applicable laws in the state of Washington and Nevada. This Health Data Privacy Notice applies when you interact with us through the Services ("Services", meaning our eye health monitoring services, including the Site, the App, and related healthcare coordination activities), and applies solely to Washington and Nevada residents or individuals whose consumer health data was collected in Washington or Nevada who interact with us in an individual or household capacity. Capitalized terms not defined in this Health Data Privacy Notice have the meanings given to them in the Privacy Notice.

For more information regarding our data processing practices of non-consumer health data, please refer to our Privacy Notice.

2. Consumer Health Data We Collect

We may collect or receive the following categories of consumer health data through the Site ("Site", meaning our website and online platform operated by MyEyes), the App, and our health care monitoring Services:

Eye Health and Diagnostic Data. Intraocular pressure (IOP) and other health measurements, eye condition diagnoses (e.g., glaucoma), glaucoma status, and other eye-health-related information.
Medical History and Treatment Information. Health and history, medical treatment or diagnosis by a healthcare professional, treatment information from prescribing healthcare providers, and prescription/medication information related to your eye care.
Patient Identification and Demographic Inputs. Birthdate, gender, and age that you provide to us or that we receive from Healthcare Partners, which we use for patient identification and healthcare compliance purposes.

3. Sources From Which We Collect Consumer Health Data

The sources from which we may collect your consumer health data are:

Directly from you. When you create an account, register for our Services, download or use the App, use health monitoring equipment and connect that equipment directly or indirectly to our systems, or when you share health-related information in communications with us (e.g., customer-service inquiries or telephone calls).
From Healthcare Partners. Healthcare partners ("Healthcare Partners", meaning healthcare providers, referring physicians, partner institutions using their healthcare systems, and other healthcare entities with whom we coordinate patient care) may provide us with patient referral data, health records, eye condition diagnoses, treatment information, and medical history to facilitate the Services.
Generated by us. When we derive information from your healthcare measurements or other data, such as trends or monitoring results provided to you or your healthcare provider. We retain ownership of any proprietary analytical methods, algorithms, or aggregated and de-identified insights derived from such data.

4. Purpose for Collecting Consumer Health Data

We collect and use consumer health data for the following purposes:

To provide our Services, including collecting and displaying your eye health data through the Site and App.
To facilitate communication of your health data to your referring healthcare provider or prescribing physician, as applicable.
To support and improve our products and services, including analyzing product effectiveness, product development, quality assurance, conducting internal research and reporting, and analyzing de-identified or aggregated data for analytics purposes.
To respond to your customer-service inquiries or other communications with us, including telephone support regarding proper use of devices and applications we provide as part of the Services.
To comply with legal obligations, including responses to valid legal process such as subpoenas, court orders, or regulatory demands.
To detect or prevent fraud, security incidents, or activity that is illegal under applicable law.
In connection with a merger, acquisition, or sale of all or substantially all of our assets, where consumer health data is among the assets evaluated or transferred.
For other purposes with your prior consent.

5. What Consumer Health Data We Disclose; Whom We Disclose It To

We may disclose consumer health data to the following categories of recipients for the purposes described below:

Service Providers. We disclose consumer health data to companies and individuals that perform services on our behalf ("Service Providers"), including cloud hosting and infrastructure providers, information technology services, customer-support tools, and shipping/logistics providers.
Healthcare Partners. We may disclose consumer health data to Healthcare Partners, including referring physicians and partner institutions, for the purpose of coordinating your health care monitoring Services.
Law Enforcement and Legal Proceedings. We may disclose consumer health data to law enforcement agencies, government authorities, or parties involved in legal proceedings ("Law Enforcement and Legal Proceedings") when required by valid legal process, such as a subpoena, court order, or enforceable regulatory demand, or to respond to claims related to our products or services.
Professional Advisors. We may disclose consumer health data to legal counsel, auditors, or other professional advisors ("Professional Advisors") where necessary in connection with legal claims, compliance obligations, or the professional services they provide to us.
Corporate Transactions. We may disclose consumer health data in connection with corporate transactions ("Corporate Transactions", including a merger, acquisition, reorganization, divestiture, financing, or sale of all or substantially all of our assets), including during due diligence or negotiation of any such transaction, where consumer health data is among the assets evaluated or transferred.
With Your Consent. We may disclose consumer health data to other recipients when we have your prior consent to do so.

We may disclose any of the categories of consumer health data identified in this Health Data Privacy Notice to the recipients listed above, limited to what is reasonably related to the applicable purpose. We contractually prohibit such third parties from collecting or using your health data over time and across different Internet websites or online services for their own independent purposes unrelated to the services they provide on our behalf.

We do not sell your consumer health data. If we ever intend to sell or share your consumer health data for purposes other than those described in this Health Data Privacy Notice, we will first obtain your affirmative authorization as required by applicable law.

6. Your Rights

If you are a resident of Washington or Nevada, you have the right to:

confirm whether we are collecting, sharing, or selling your consumer health data, and access such data;
receive a list of all third parties with whom we have shared or sold your consumer health data, including an active email address or other online mechanism you may use to contact them;
delete your consumer health data, subject to certain exceptions as permitted by applicable law (such as where retention is required for legal compliance, to complete an ongoing transaction, to detect or prevent fraud, to exercise or defend legal claims, or for other purposes permitted by law);
withdraw your consent to our collection and sharing of your consumer health data, which we will process within a commercially reasonable timeframe. Please note that withdrawing consent may affect our ability to provide you with certain services, and will not affect the lawfulness of any processing conducted prior to your withdrawal.

How to Exercise Your Rights

You may submit a request (as provided below) to exercise any of the rights described above. You may also submit a consumer request on behalf of your minor child, or if you are a guardian or hold a similar legal authority, on behalf of the individual subject to such arrangement. The consumer request must:

Provide sufficient information that allows us to reasonably verify that you are the person about whom we collected consumer health data.
Describe the request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

Once we receive a consumer request, we will take commercially reasonable actions to authenticate the identity of the person exercising the request, including comparing any such identification data provided against the consumer health data requested. We may authenticate a request by asking for the requestor’s name, phone number, and email.

We cannot respond to your request or provide you with consumer health data if we cannot verify your identity to make the request and confirm that the consumer health data relates to you. We also reserve the right to decline any request where we have a reasonable basis to believe the request is fraudulent.

Making a consumer request does not require you to create an account with us, but we may require authentication of the consumer that is reasonable considering the nature of the consumer health data requested.

To exercise the rights described above, please submit a consumer request to us by emailing legal@myeyes.net.

Initial Request Format and Timing

We endeavor to respond to a consumer request within 45 days of its receipt. For Nevada residents submitting access requests, we will respond within 60 days. If we require more time (for a maximum total of 90 days from receipt for Washington residents, or as otherwise permitted by Nevada law), we will notify you within the initial response period that we require more time and will provide a reason for the delay.

We do not charge a fee to process or respond to your consumer request unless the request is manifestly unfounded, excessive, or repetitive. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing the request.

If we determine that we will not act on a request, we will provide a response to you that includes the basis of our reasoning. If the reasoning is our inability to authenticate the request, we will explain the efforts we took to authenticate the request and why we were unable to do so.

Appeal Response Format and Timing

If we decide that we cannot comply with your initial consumer request, you have the right to appeal our decision. Any appeal should be sent to the place where the initial consumer request was sent. The appeal should clearly indicate that it is an appeal of an initial consumer request and should include the initial consumer request along with our response explaining why we cannot comply with the initial consumer request.

We will review all appeals and provide a response within 45 days of receipt of the appeal, or within such longer period as permitted by applicable law. In our response to your appeal we will inform you of any action taken or not taken, along with an explanation of the reason in support of the response. If your appeal is unsuccessful, you can contact the appropriate regulatory enforcement authorities to submit a concern or lodge a complaint.

7. Non-Discrimination

We will not discriminate or retaliate against you for exercising any of your rights under applicable consumer health data privacy laws. This means we will not deny you goods or services, charge you different prices or rates, or provide you with a different level or quality of goods or services because you exercised your rights under this Health Data Privacy Notice, except where your consumer health data is necessary or reasonably required for us to provide a particular good or service at a particular level of quality.

8. Modification of This Health Data Privacy Notice

This Health Data Privacy Notice may be modified from time to time. The date this Health Data Privacy Notice was “last updated” is at the top of this page. If we make a material change to this Health Data Privacy Notice, we will publish the updated notice to the Site and, where required by applicable law, obtain your consent before collecting or using your consumer health data for any new purposes. Any modifications will be effective as of the "last updated" date posted at the top of the revised notice, except that material changes that require your consent under applicable law will not take effect until such consent is obtained. We advise you to frequently check this Health Data Privacy Notice for any changes. We may also provide notice of such changes to you in other ways, at our discretion, such as by displaying a notification banner on the homepage of the Site, through an in-app notification in the App, or by emailing you at the email we have on file for you.