Consumer Health Data Privacy Notice

Who this notice covers, and how it fits with HIPAA

These laws use “consumer health data” for information that identifies you and allows an inference about your health. They also step aside where HIPAA already applies. So the line runs roughly here: once a clinician is involved and you are a patient, most of what we hold about you is protected health information, and our Privacy Policy and Notice of Privacy Practices govern it. Before that, on the public site, the same kind of information is not protected health information, and this notice governs it.

Only some states have passed a law of this kind. We do not sort visitors by state to decide who gets these protections. What is written here is how we treat consumer health data for everyone.

Categories of consumer health data we collect

What we collect depends on how far you go. Reading the site collects less than starting a visit, and we have tried to keep each step to what that step actually needs.

• Which therapies you looked at. The pages you ask for name specific prescription therapies, so requesting one tells our server something about you. Under these laws that is data identifying you as someone seeking health care services, before you have told us anything about yourself. We do not build a browsing profile out of it. Where the site counts how many product pages you have read so it can offer help, what it keeps is that count, whether you dismissed the offer, and the last page it counted, so it does not count the same one twice. That stays in your browser and goes when you close the tab.
• The state you live in. You type it in so the catalog can show what is available where you are. We never infer it from your IP address.
• What is in your cart. A cart names a prescription therapy or a blood panel, and for one product it also holds whether you chose the injection or the nasal spray.
• Your account details. What it takes to open and run an account, including your name, date of birth, phone number, email address, shipping address and the preferences you set. On their own those are ordinary contact details. Joined to an order for a prescription therapy they say something about your health, and we treat them that way.
• Health goals you choose to save. If you set goals on your profile, we keep them and use them to decide which content to show you.
• The visit you start through us. We keep the record of the visit rather than the contents of it: that one was requested, which products it covers, which intake you were sent to, and what came back, such as approved, declined or never completed. Your intake answers do reach an endpoint of ours, inside the stream of progress events our telehealth partner sends us while a visit is under way, and that endpoint drops the contents on arrival. What it keeps from one of those messages is the name of the event, our own reference for your visit, the sender’s id for the message, and the outline of the body, meaning the field names and their types, never the values in them. The clinician’s notes and the written prescription do not come to us today, and nothing in your account is built to show them.
• What you buy and what ships. Order and subscription records carry what a commerce record has to carry, including the therapy, the amount, the billing cycle, the address it goes to, the shipping status and the references that tie the row to the partner or processor that handled it. For a blood panel we hold the purchase and the kit shipment. Lab results never reach us: they are held by the laboratory and go to you, and nothing here is built to receive one.
• What you write to us. Anything you type into the assistant in your Avellum account, and anything you write to our Privacy Officer, which is the mailbox that lands with us. Our support address is a different matter: it is delivered to the care team that runs your care rather than into an Avellum inbox, so what you send there is held by them and described by their own notice.

We use it for these purposes:

• Showing you what you can actually buy. A few therapies cannot be prescribed in every state, so the catalog uses the state you gave us to show you what is available rather than letting you find out at checkout.
• Starting a visit. Handing you to our telehealth partner, and knowing which visit belongs to which account when their systems report back.
• Filling and shipping an order. Getting a medication or a blood-draw kit to the right address through the right pharmacy.
• Answering you. The assistant in your Avellum account, and correspondence with our Privacy Officer.
• Keeping the account safe and the records straight. Sign-in security, fraud prevention, and the business records the law requires us to keep.
• Pricing. Visitors reach us from Amway’s network, and a linked Amway account in good standing carries a lower price. Two things cross that boundary and both are about the account rather than about you. When you arrive on one of Amway’s links we hand the link’s token back to Amway and receive a reference for the account, which is what tells Amway the account arrived here. Then, while the account stays linked, we ask Amway from time to time whether it is still in good standing, and the answer describes the account’s standing and when it was checked. Nothing about your health, your cart or your orders goes to Amway in either exchange, and the requests carry no field that could hold any of it. Amway is not a sponsor, endorser, or co-provider of any product offered through Avellum Health.

Several other categories of personal data we collect could count as consumer health data depending on the context and on how much you tell us. The full list is in the Privacy Policy.

For personal data to be consumer health data it must, alone or with other data, identify you and allow an inference about your health. We do not mine the rest of what we hold to work out things about your health you did not tell us. What we know is what you told us, what came back from your visit, and one value that is worked out rather than told: which of the two intakes your screening answers sent you to. That one is calculated in your browser from answers we never receive, which the next section describes.

If we deidentify your consumer health data, we will only process it in a deidentified fashion and will not attempt to reidentify it.

In addition to the purposes stated above, we may process consumer health data for purposes allowed under applicable law, such as to prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any activity that is illegal under applicable law; preserve the integrity or security of our systems; or investigate, report, or prosecute those responsible for any such action that is illegal under applicable law.

What stays in your browser

Two places on the site ask health questions outside of any clinical relationship, and neither one sends the answers anywhere.

• The three-question quiz. It asks what you want to work on, roughly where you are today, and whether you would want a baseline blood panel. The answers pick which page to show you next and are then gone. No request leaves your browser, nothing is written to a cookie or to storage, and no answer is put into a query string. The page we send you to is named for the topic you picked, the same as any other page on the site. There is no free-text box to type into.
• The screening questions before a visit. Height, weight, age, the state you gave us, medication history and a list of conditions, asked so we can send you to the right intake. Those answers stay in your browser too, and what they produce is a single word. Sometimes they produce no word at all: the same rules can end the screening on a page of ours that says this treatment is not a match, and in that case nothing about the screening reaches us, because no visit was started. When a visit does start, that one word, which of the two intakes you were sent to, is what reaches us. The answers behind it do not.

This is enforced rather than promised. Automated tests read the source of those screens and fail if a network call, a cookie, browser storage or a free-text field appears in them, so a change that broke this rule would fail before it could ship.

We built it that way because the reason to keep an answer is that something later needs it, and nothing of ours needs these. The rules run where you answer them, and the result is what travels.

Categories of sources from which we collect consumer health data

Nearly all of it comes directly from you: what you enter on the site and what you write to us. The rest comes back from the companies we work with to carry out an order or to price one, and each of them tells us a narrow thing.

• The outcome of a visit, and the billing references for what was prescribed, come back to us from our telehealth partner. Their progress events reach us too, carrying intake detail we have no use for, and the categories section above says what survives arrival.
• The pharmacy that packs a blood-draw kit tells us the box left, with the carrier, the tracking number and its own reference for the shipment. It sends us nothing clinical, and it has nothing clinical to send: what it holds about you is what we gave it.
• The payment processor for a blood panel tells us the payment went through, and what comes back is what settles the order: whether it was paid, the amount, its own references for the session and the payment, our order reference, and the name and shipping address you typed on its checkout page, which is how the draw kit reaches you. Your card details go to it, never to us. We never receive a card number, because the payment page is theirs and nothing here would know what to do with one.
• Amway answers how a linked account stands: whether it is active, whether it carries a membership, its own reference for the link and when it checked. Those are facts about an Amway account rather than health data, and the boundary is on the record here for the same reason: nothing about your health travels in either direction.

We buy no data. We receive no consumer health data from data brokers, advertising networks, social networks, mailing-list providers or advertising and marketing partners, and we have no arrangement with any of them.

Sharing of consumer health data

We share for a job, and what a recipient gets is scoped to the job it is doing, so who receives what depends on what you bought.

• The people who run the visit. The clinicians, the medical intake, the payment for medication and the patient support all sit with our telehealth partner. When you start a visit we hand over a reference for that hand-off. You enter your own health information into their intake, on their system, under their notice, and they charge you on their own payment processor when you finish it, before a clinician has reviewed anything.
• The dispensing pharmacies. Which one fills your order depends on the therapy and on the state you live in, and some therapies only one of them carries at all. Precision Pharma (Precision Pharma Corp, NPI 1770389629) is the pharmacy we work with directly, for the therapies it carries in the states where it is licensed. Everything else is filled by a pharmacy in our telehealth partner’s network. A pharmacy receives what it needs to compound, label and ship, and it receives a prescription from the clinician who wrote it rather than from us. We send a pharmacy something ourselves in one case only, a blood-draw kit, and what we send is what it needs to pack and post the box: the name and address it ships to, our own order reference, which kit to pack and how many, when it was paid for and cleared to ship, and whether a prescription order is on its way to the same person so it knows what to expect. Your date of birth, your goals, the panel name, any marker and any result are not in that request, and the pharmacy’s own endpoint refuses those fields outright, so a mistake there fails rather than travels.
• The company that sells a blood panel. Valdura is the merchant of record for a blood panel and charges you for it, which is why buying medication and a panel together means entering a card twice with two different merchants. The company charging you is named on the checkout page and on the receipt, so you can see it there rather than take it from this page. The panel, the draw kit and the laboratory work sit with Valdura and the laboratory that runs it. Your results go to them and to you, and never into our systems.
• Service providers under contract. The companies that run our systems, including application hosting, the database, email delivery, the workspace our mailboxes run in, payment processing for the panel, and the provider behind the assistant in your Avellum account. Each works under a written contract, and a vendor that can reach health information is covered by a HIPAA business associate agreement, which for several of them, including our email delivery and the provider behind the assistant, is an agreement held by an affiliated company on our behalf rather than by Avellum Health Co LLC in its own name. The payment processor for the panel is the deliberate exception. HIPAA does not ask for one of those agreements to move a payment (45 CFR 164.502(e)(1)(ii)), and payment processors do not sign them, so this one works under its own terms instead. What it receives is what it needs to take the payment and get the box addressed: your email address so it can send the receipt, the name and shipping address you type on its checkout page, the amount, the plain product name, and our own order and account references, which are opaque ids that mean nothing outside our systems. Nothing clinical beyond the product name.
• Where the law requires it. In response to valid legal process, or where disclosure is necessary to protect someone’s safety.

Precision Pharma and Valdura are affiliates of ours under common ownership. Both are named here rather than described as a category, because these laws ask for the specific affiliate rather than the type.

We do not share consumer health data with advertising networks, social networks, data brokers or analytics vendors. No page on avellumhealth.com carries a third-party advertising or analytics script, so there is nothing collecting on their behalf to share with.

We do not sell your consumer health data

We do not sell it and never have. Under these laws a sale requires a signed authorization from you, separate from everything else you sign. We do not ask anyone for one.

No tracking, and no geofencing

There is no advertising pixel, tag manager, session recorder or analytics script on this site. We do not follow you around other websites and we build no profile of you off ours.

Washington’s law also bans drawing a virtual boundary around a health care facility to track people near it or advertise to them. We do not do that, and we are not built to. The location we ask you for is the state you type in and the address you want a box sent to, and both are used for those two jobs. We hold one piece of location data you do not hand us: our security logs record the IP address a request came from, the way any server’s do. We do not turn it into a place, we do not use it to decide what you are shown, and nothing on this site infers where you are from it.

How long we keep it

Each class of data is kept for as long as the purpose it was collected for lasts, and then for as long as the law requires. Conversations with the assistant last for the life of the account. Your account details are kept for at least six years after your last activity, because they are attached to records we have to keep. Order, subscription and visit hand-off records are those records: they are financial and compliance records, kept at least six years from the date of the order. Our security logs, which record who did what and from which IP address, are kept for six years as well, and a deletion request does not reach them.

Where an account has order history, the record of the order stays. Nothing we do in response to a request destroys a financial or compliance record inside its retention period, so a request against an account that has bought something is handled by closing the account and restricting what the remaining data is used for, rather than by erasing it. We tell you which records are staying and why, and what we did with the rest.

Your privacy rights

Under applicable law, you may have certain privacy rights regarding your consumer health data, including the right to:

• Confirm whether we are collecting, sharing, or selling your consumer health data;
• Access your consumer health data, including a list of all third parties and affiliates with whom we shared or sold your consumer health data and an active email address or other online mechanism that you may use to contact any third parties;
• Withdraw your consent from our collection and sharing of your consumer health data; and
• Delete your consumer health data.

To exercise any of them, email privacy@avellumhealth.com, call (689) 220-7908, or write to Avellum Health Co LLC, Attn: Privacy Officer, 4736 Pebble Bay Cir, Indian River Shores, FL 32963. All three reach our Privacy Officer, which is why they are the ones printed here, and a letter carries the same weight as an email. Withdrawing your consent and asking us to delete your data are rights you hold against the company named at the top of this page, so you do not need an account, a login or our website to exercise them. Our support address, support@avellumhealth.com, is a different door: it is answered by the care team that runs your care, and it is the right place for a question about an order, a shipment, a bill or your treatment. A request about this notice or about your records belongs with the Privacy Officer instead.

We verify who you are before we act. If you write by email, we ask that it come from the address on the account; if you write by post, we ask you to confirm details we already hold. Either way we confirm enough to be sure the request is yours. We do not send records to a third-party address without your written direction. Thirty days from the day we receive it is the standard we work to for answering a request and acting on it, and if one needs longer than that we write and tell you why before the time is up. A request is handled by a person rather than by a button: there is no self-serve export or deletion on the site today, which is why the three channels above are the way to make one.

Two limits worth stating plainly. Withdrawing consent stops us collecting and sharing from that point; it cannot unwind what a clinician or a pharmacy already holds as their own medical record. And some records we cannot delete on request: the financial and compliance records above, our security logs, and anything under legal hold. Where that applies we tell you which records and why, rather than quietly working around the request.

If we refuse to act on your request, you may appeal by replying to the message we send you, or by writing to the Privacy Officer at the postal address below, and we will look at the decision again. If we refuse the appeal, you can complain to your state attorney general.

Changes to this notice

If we change what we collect or who receives it, we update this page and the dates at the top. We ask for your consent before collecting or sharing consumer health data for a purpose this notice does not describe. Putting an analytics or advertising script on any page would be exactly that kind of change, and this page would say so before it happened.

Contact

Questions about this notice, or about a request you have made, go to: