Consumer Health Data Privacy Policy

Effective Date: November 2, 2026

Flourish Functional Health PLLC (“Flourish Functional Health,” “we,” “us,” or “our”) is committed to protecting your privacy and handling personal health information responsibly.

This Consumer Health Data Privacy Policy explains how we collect, use, share, and protect consumer health data under Washington's My Health My Data Act (RCW 19.373), where applicable.

1. Consumer Health Data We Collect

Consumer health data includes personal information that identifies or can reasonably be linked to an individual's physical or mental health status.

Through our website and online forms, we may collect:

• Health-related inquiries: General health concerns, symptoms, wellness goals, or reasons for seeking our services that you voluntarily provide.

• Service interests: Information about the healthcare or wellness services you are interested in receiving.

• Contact information: Your name, email address, and telephone number when associated with a health-related inquiry.

• Health-related communications: Information you voluntarily provide when contacting us about your health or wellness needs.

Our Flourish Vital Check-In™ educational resource currently collects only your name and email address to deliver the requested material. It does not request medical histories, diagnoses, or symptom information.

2. Sources of Consumer Health Data

We collect consumer health data primarily from information you voluntarily provide when:

• Completing a new-patient inquiry form.

• Contacting our practice through our website.

• Requesting information about consultations or services.

• Communicating with us regarding your healthcare or wellness interests.

We do not request detailed medical records or comprehensive medical histories through general website inquiry forms.

3. How We Use Consumer Health Data

We collect and use consumer health data for purposes reasonably necessary to respond to your requests and coordinate services, including:

• Responding to inquiries about our services.

• Determining whether our services may be appropriate for your needs.

• Coordinating discovery calls, consultations, or appointments.

• Providing information or educational resources you request.

• Maintaining appropriate administrative records related to your inquiry.

We do not sell consumer health data or use health concerns submitted through our inquiry forms for targeted advertising.

We will provide additional disclosures and obtain consent when required by applicable law before collecting additional categories of consumer health data or using information for purposes not described in this policy.

4. Sharing Consumer Health Data

We may share limited consumer health data with trusted service providers acting on our behalf when necessary to respond to your inquiry, manage communications, or coordinate requested services.

The categories of information shared may include contact information, service interests, general health concerns, and communications related to your inquiry.

Service providers may include:

• GoHighLevel: Our HIPAA-enabled customer relationship management platform, used for inquiry forms, scheduling, and communications.

• Google Workspace: Our business email and administrative communication platform, for which we maintain an applicable Business Associate Agreement.

• Zoom for Healthcare: Our healthcare communications platform, used for telephone communications and related practice operations.

• Website and technology service providers: Providers supporting website hosting, form functionality, security, and related operations, to the extent necessary for authorized services.

These providers are expected to maintain appropriate privacy and security protections and process information only for authorized purposes.

We do not sell consumer health data or share health concerns submitted through our inquiry forms with third parties for their independent marketing or advertising purposes.

We do not currently identify any separate affiliated business with which we routinely share consumer health data collected through our website inquiry forms.

5. Your Washington Consumer Health Data Rights

To the extent provided by Washington law, you may have the right to:

• Confirm whether we collect, share, or sell your consumer health data.

• Access consumer health data we maintain about you.

• Request deletion of your consumer health data, subject to applicable legal exceptions.

• Withdraw consent for future collection or sharing where consent is the basis for processing.

• Obtain information about third parties or affiliates with whom your consumer health data has been shared.

• Appeal a decision denying a privacy rights request.

To exercise your rights, email info@flourishfx.com with the subject line “Consumer Health Data Privacy Request.”

We may take reasonable steps to verify your identity before processing a request and will respond within the timeframes required by applicable law.

If your request is denied, you may appeal by replying to our decision and requesting a privacy appeal. We will review your appeal and provide a written response as required by Washington law.

6. Information Protected Under HIPAA

Flourish Functional Health is a healthcare practice that maintains safeguards for protected health information in accordance with applicable federal and state privacy laws.

Certain information collected or maintained in connection with patient care may be governed by