Effective Date: August 7, 2026
This policy applies to consumer health data and exists separately from our general Privacy Policy, because Washington's My Health My Data Act and similar state laws require a distinct, separately linked policy for this category of information.
It applies in addition to our Privacy Policy, not instead of it. Where the two differ on consumer health data, this policy governs.
It is written for residents of Washington and Nevada, and for anyone else whose state grants similar rights. If you live elsewhere in the United States we will still honor the requests described below wherever we reasonably can.
CompaHealth helps families coordinate care after a hospital discharge. Because of what we do, much of the information you give us could be interpreted as consumer health data, and we treat it that way rather than drawing fine lines around it.
Specifically, our waitlist survey asks:
We also collect your email address so we can reach you. Linked to the answers above, that contact detail makes the information identifiable, which is what brings it within scope.
We run Google Analytics and associated advertising pixels on our website, described further in our general Privacy Policy.
We use consumer health data to understand whether CompaHealth is a fit for your situation, to prioritize families who are in the middle of a discharge right now, and to contact you about joining. We also use it in aggregate to understand the problems families face after a discharge, which shapes what we build.
We do not use consumer health data for targeted advertising.
We share consumer health data only with service providers who process it on our behalf, under contract, for the purposes described above:
We do not sell consumer health data. Under Washington's My Health My Data Act, selling consumer health data requires your separate, signed authorization, and we do not seek one. If that ever changes we will ask for valid written authorization first, and you will be free to refuse.
We may disclose information if required by law, or to protect the rights, safety, or property of CompaHealth or others.
You have the right to:
To exercise any of these, email [email protected]. Tell us what you are asking for and give us enough detail to find your records. We may need to verify your identity before we act, and we will only use what you send us for that purpose.
We will respond within 45 days. If we need more time we will tell you why within that period, and take no more than a further 45 days.
If you withdraw consent or ask us to delete your data, we will also tell our service providers to delete it, and we will stop contacting you about the waitlist.
If we decline a request, we will tell you why. You may appeal by replying to the same address with the word "appeal" in the subject line, and a different person will review it.
If your appeal is also denied, you may file a complaint with your state attorney general:
Our Privacy Policy currently states that waitlist responses are kept indefinitely. We are reviewing how long we should keep consumer health data specifically, and when we set a defined period we will update this policy and our Privacy Policy at the same time.
CompaHealth is not a covered entity or a business associate under HIPAA, and the waitlist survey is not governed by HIPAA. That is a statement about our regulatory status, not a claim that we do not collect health information. As set out above, we do.
If we later help arrange a specific appointment or service on a patient's behalf, that work is governed by a separate HIPAA authorization the patient signs at the time.
If we start collecting a new category of consumer health data, or begin using or sharing it for a new purpose, we will update this policy and obtain fresh consent before doing so, as required. We will update the effective date above whenever this policy changes materially.
Questions about this policy, or about consumer health data generally:
Email: [email protected]
← Back