Consumer Health Data Privacy Policy
Last updated: July 26, 2026
Effective Date: July 26, 2026
This Consumer Health Data Privacy Policy ("Policy") describes how Cortexa Holdings, Inc. ("Cortexa," "we," "us," or "our") collects, uses, shares, and protects Consumer Health Data as defined by the Washington My Health My Data Act, RCW 19.373 et seq. ("MHMDA") and similar state laws.
This Policy applies to Washington residents and residents of other states with similar consumer health data privacy laws. For information about our general privacy practices, please see our Privacy Policy.
1. Consumer Health Data We Collect
"Consumer Health Data" means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status.
We may collect the following categories of Consumer Health Data:
| Category | Examples | Source |
|---|---|---|
| Health Services Data | Information indicating a consumer is seeking mental health services | Provided by healthcare practice customers |
| Appointment Information | Appointment dates, session history, billing codes (CPT) | Customer EHR systems |
| Payment Information | Payment for services, insurance/payer information | Customer EHR systems, billing systems |
| Client Identifiers | Name, date of birth, contact information (email address, phone number) | Customer EHR systems |
| Precise Location Data | We do NOT collect precise location data | N/A |
| Biometric Data | We do NOT collect biometric data | N/A |
2. How We Collect Consumer Health Data
We collect Consumer Health Data:
(a) From Healthcare Practice Customers: When therapy practices use our platform, they may authorize us to access appointment scheduling, session records, and billing information (including CPT codes), insurance/payer data, and client contact information from their systems.
(b) Directly from Consumers: We do not typically collect Consumer Health Data directly from patients/consumers. Our services are provided to healthcare practices, not directly to consumers.
3. Purpose of Collection
We collect and use Consumer Health Data for the following purposes:
- Providing practice analytics, CRM, and workflow automation services to healthcare practice customers
- Processing appointments and scheduling
- Generating practice analytics and insights
- Processing payments and billing
- Complying with legal obligations
We do NOT use Consumer Health Data to:
- Sell Consumer Health Data
- Train artificial intelligence or machine learning models
- Target advertising to consumers
- Make employment, credit, or insurance decisions
4. How We Share Consumer Health Data
We may share Consumer Health Data with:
| Category of Recipient | Purpose | Consumer Health Data Shared |
|---|---|---|
| Cloud Infrastructure Providers | Data hosting and storage | All categories listed in Section 1 |
| AI Service Providers | Generating de-identified analytics | De-identified data only (no Consumer Health Data transmitted) |
| Payment Processors | Processing transactions | Billing information |
We do NOT:
- Sell Consumer Health Data;
- Share Consumer Health Data for advertising purposes;
- Share Consumer Health Data with data brokers.
5. Consent
We obtain consent for Consumer Health Data processing through our agreements with healthcare practice customers, who are responsible for obtaining appropriate authorizations from their patients.
If you are a Washington resident whose Consumer Health Data we process, you have the right to:
- Withdraw consent for future collection and sharing;
- Request that we stop collecting or sharing your Consumer Health Data.
6. Your Rights
Washington residents have the following rights:
(a) Right to Know/Access: You may request confirmation of whether we are collecting, sharing, or selling your Consumer Health Data, and access to such data.
(b) Right to Deletion: You may request deletion of your Consumer Health Data.
(c) Right to Withdraw Consent: You may withdraw consent for future collection and sharing of Consumer Health Data.
(d) Right to Appeal: If we deny your request, you may appeal the decision.
7. How to Exercise Your Rights
To exercise your rights, contact us at:
- Email: [email protected]
- Mail: Cortexa Holdings, Inc., 310 E 46th Street, Apt 21V, New York, NY 10017
We will respond to your request within 45 days. We may request additional information to verify your identity.
Note: Because we primarily process Consumer Health Data on behalf of healthcare practices (our customers), we may direct your request to the appropriate practice for fulfillment.
8. Geofencing Prohibition
Cortexa does NOT use geofencing technology to:
- Establish a virtual boundary around any physical location providing in-person healthcare services
- Identify or track consumers seeking healthcare services
- Collect Consumer Health Data from consumers who enter such locations
- Send advertisements or notifications to consumers related to their Consumer Health Data
9. Data Security
We implement administrative, technical, and physical safeguards to protect Consumer Health Data, including:
- Encryption in transit (TLS 1.2+) and at rest (AES-256);
- Access controls and authentication;
- Audit logging;
- Security monitoring and incident response.
10. Data Retention
We retain Consumer Health Data only as long as necessary to:
- Provide services to our healthcare practice customers;
- Comply with legal obligations;
- Resolve disputes.
Upon request from a healthcare practice customer or upon termination of our agreement, we will delete Consumer Health Data within 30 days, except as required by law.
11. Changes to This Policy
We may update this Policy periodically. We will notify you of material changes by posting the updated Policy on our website with a new "Last Updated" date.
12. Contact Us
If you have questions about this Policy or our Consumer Health Data practices:
- Email: [email protected]
- Mail: Cortexa Holdings, Inc., 310 E 46th Street, Apt 21V, New York, NY 10017