Consumer Health Data Privacy Policy

Washington My Health My Data Act, chapter 19.373 RCW

Hear Northwest, PLLC • d/b/a Eastside Audiology, Olympic Hearing & Balance, and Seattle Hearing & Balance

Effective date: June 1, 2026

This is a standalone policy required by the Washington My Health My Data Act. It is separate from, and is not a substitute for, our HIPAA Notice of Privacy Practices or our general website privacy policy.

What This Policy Covers — and What It Does Not

Hear Northwest, PLLC is a Washington professional limited liability company that provides audiology and vestibular care under three registered trade names: Eastside Audiology, Olympic Hearing & Balance, and Seattle Hearing & Balance. In this policy, “we,” “us,” and “our” mean Hear Northwest, PLLC and all of its clinics. “You” and “your” mean a consumer as defined in RCW 19.373.010.

This policy describes how we handle consumer health data that is subject to the My Health My Data Act. In practice, that means information we collect through our websites, our online advertising, our online forms, and our call-handling and marketing tools — that is, information collected outside of a treatment relationship.

This policy does NOT apply to your medical or billing records or to any other protected health information. Under RCW 19.373.100, the My Health My Data Act does not apply to protected health information under HIPAA, to health care information collected, used, or disclosed under chapter 70.02 RCW, or to information that originates from and is intermingled to be indistinguishable from that information when it is maintained by a HIPAA covered entity. We are a HIPAA covered entity and a Washington health care provider. Once your information becomes part of your patient record, it is governed by HIPAA, by Washington’s Uniform Health Care Information Act, and by our Notice of Privacy Practices — not by this policy.

Categories of Consumer Health Data We Collect, and Why

We collect the following categories of consumer health data. For each category we describe the purpose of the collection and how the data will be used.

Category of consumer health data	Purpose for collecting it	How we use it
Contact and inquiry information you submit through a form on one of our websites — your name, email address, phone number, the clinic location you select, and anything you choose to type into a free-text message field	To respond to the request you made and to schedule or route your inquiry to the clinic you selected	A staff member at the clinic you selected reads your request and contacts you. If you become a patient, the information moves into your patient record and is then governed by HIPAA rather than by this policy.
Information that identifies you as a person seeking health care services — including the fact that you contacted, called, or requested an appointment with a hearing and balance clinic	To provide the service you asked us for and to understand demand for our services	To respond to you, to staff and schedule our clinics, and to produce aggregate counts of inquiries by clinic and by service line
Your activity on our websites — the pages you view, including pages about specific conditions and services such as hearing loss, tinnitus, dizziness and balance disorders, and hearing devices; the links you click; and the search term or advertisement that brought you to us	To operate, secure, maintain, and improve our websites, and to measure whether our website content and advertising are working	To generate traffic and engagement reports, to decide what content to publish, and to measure and improve advertising performance
Call information when you call a phone number listed on one of our websites — your phone number, the date, time, and length of the call, the web page or advertisement that produced the call, and general location inferred from your area code or IP address	To connect and route your call, to answer your question, and to measure which pages and advertisements generate calls	Front-office staff use it to serve you. Aggregate call reports are used to evaluate advertising and staffing.
Online and device identifiers — IP address, browser and device type, cookie and pixel identifiers, and the website that referred you	To operate and secure our websites, to prevent spam and abuse, and to measure and deliver advertising	To keep our sites working and secure, to filter automated form submissions, and to attribute website visits and advertising results
Approximate location derived from your IP address (generally city or region level) and the clinic location you select	To show you the clinic nearest to you and to route your inquiry to the right location	To display relevant location pages, driving directions, and clinic hours, and to route inquiries. We do not collect precise geolocation, and we do not use geofencing.
Inferences drawn from the information above about a possible interest in hearing, tinnitus, or balance care	To decide what content and advertising to show, and to plan services	To tailor website content and advertising audiences, and for internal planning. We do not use these inferences to make any decision about your eligibility for care, your pricing, or your insurance.

We do not knowingly collect consumer health data about biometrics, genetics, reproductive or sexual health, gender-affirming care, or prescription medication through our websites or advertising, and we do not ask for it.

Categories of Sources We Collect Consumer Health Data From

Directly from you — when you fill out a form on one of our websites, call or text a number listed on one of our websites, or send us an email.
Automatically from your device — when you visit one of our websites, through cookies, pixels, tags, and server logs.
From our service providers — our website developers and hosts, marketing platform vendors, analytics providers, call-tracking providers, and advertising providers, acting as processors on our behalf.
From advertising platforms, search engines, and referring websites — which report how you reached our site and how our advertising performed.

Categories of Consumer Health Data We Share

We share the following categories of consumer health data:

Contact and inquiry information you submit — shared internally with the Hear Northwest clinic you selected, and with the service providers that host our websites and deliver our form submissions to us.
Website activity, online and device identifiers, and inferences — shared with our analytics and advertising service providers.
Call information — shared with our call-tracking and call-analytics service providers.
Approximate location and clinic selection — shared with our website, mapping, and analytics service providers.

We may also disclose consumer health data when we are legally required to do so — for example in response to a subpoena, court order, or lawful government request — or to establish or defend legal claims, or in connection with a merger, acquisition, or sale of assets in which the receiving party assumes our obligations under this chapter.

Third Parties and Affiliates We Share Consumer Health Data With

Affiliates

Hear Northwest, PLLC has no corporate parent, subsidiaries, or affiliated companies. Eastside Audiology, Olympic Hearing & Balance, and Seattle Hearing & Balance are registered trade names of Hear Northwest, PLLC — they are the same legal entity, not separate affiliates. Sharing among our clinics is internal sharing within one company.

Categories of third parties

We share consumer health data with the following categories of third parties, all of which act as our processors under written contracts that limit what they may do with the data, except where noted:

Website development, hosting, and healthcare marketing platform providers — the vendors that build, host, and maintain our clinic websites and deliver our web form submissions to us.
Web analytics providers — vendors that measure website traffic, page views, and engagement, including Google (Google Analytics and Google Tag Manager) and our healthcare marketing analytics vendor.
Call tracking and call analytics providers — vendors that connect and measure calls placed to numbers shown on our websites.
Digital advertising and visitor measurement providers — vendors and advertising platforms, including Google Ads, that deliver our advertising and report on its results.
Form delivery, spam prevention, and mapping providers — vendors that process form submissions, filter automated submissions, and display maps and directions.
Information technology, email, hosting, and security providers — vendors that operate and protect our systems.
Professional advisors and government authorities — our attorneys, accountants, and insurers, and government authorities where disclosure is required by law. These recipients are not our processors.

If you ask us for it, we will give you the current, specific list of every third party and affiliate with which we have shared your consumer health data, together with an email address or other online mechanism you can use to contact each of them. See “Your rights” below.

We Do Not Sell Consumer Health Data

We do not sell, and we do not offer to sell, consumer health data. Under RCW 19.373.070, a sale would require a separate signed valid authorization from you, and we do not seek one. If that ever changes, we will update this policy first and will obtain a valid authorization before any sale. We will never condition your care, or any product or service, on your signing an authorization to sell your data.

We Do Not Use Geofencing

RCW 19.373.080 makes it unlawful to place a geofence around a facility that provides in-person health care services in order to identify or track consumers seeking health care services, to collect consumer health data, or to send them notifications, messages, or advertisements about health care services. We do not use geofencing around any health care facility, including our own clinics, and we require our marketing vendors not to do so on our behalf.

How We Protect Consumer Health Data

As required by RCW 19.373.050, we limit access to consumer health data to the workforce members, processors, and contractors who need it for the purpose you consented to or to provide what you asked us for, and we maintain administrative, technical, and physical safeguards that meet at least the reasonable standard of care in our industry, appropriate to the amount and nature of the data involved.

Your Rights and How to Exercise Them

Under RCW 19.373.040 you have the following rights with respect to your consumer health data:

Confirm and access. You may ask us to confirm whether we are collecting, sharing, or selling consumer health data about you, and to give you access to that data. This includes a list of all third parties and affiliates with which we have shared or sold it, and an active email address or other online mechanism you can use to contact each of them.
Withdraw consent. You may withdraw your consent to our collection of your consumer health data, and you may separately withdraw your consent to our sharing of it, at any time.
Delete. You may ask us to delete your consumer health data. When we receive an authenticated deletion request, we will delete the data from our records, including from archived and backup systems, and we will notify every affiliate, processor, contractor, and third party with which we shared it so that they delete it too. If the data sits on archived or backup systems, deletion there may be delayed as long as it takes to restore those systems, and in no case more than six months after we authenticate your request.
Appeal. If we refuse to act on your request, you may appeal.
No discrimination. We will not discriminate or retaliate against you for exercising any of these rights, and exercising them will not affect the care you receive from us.

How to submit a request

Submit your request by any of the following means. Please tell us which right you are exercising and give us enough information for us to locate your data and verify who you are. You do not need to create an account to make a request.

Email	privacy@hearnw.com
Mail	Privacy Officer, Hear Northwest, PLLC, 49 Front Street N, Issaquah, WA 98027
Phone	425-391-3343 — ask for the Privacy Officer
In person	Ask any staff member at any Hear Northwest clinic to route your request to the Privacy Officer

How we handle your request

We will respond without undue delay and in all cases within 45 days of receiving your request. We may extend that once by another 45 days when reasonably necessary, and if we do we will tell you within the first 45 days and explain why.
Responding to your request is free, up to twice a year. If a request is manifestly unfounded, excessive, or repetitive, we may charge a reasonable administrative fee or decline to act, and we bear the burden of showing that it was.
We must be able to verify that the request is really from you. If we cannot authenticate it using commercially reasonable efforts, we may ask you for additional information, and we are not required to act until we can verify you.

How to appeal

If we refuse to act on your request, you may appeal within a reasonable time after you receive our decision. Send your appeal to the same email address, mailing address, or phone number listed above and write or say “Consumer Health Data Appeal.” Within 45 days of receiving your appeal we will tell you in writing what action we took or did not take, and explain why.

If we deny your appeal, you may submit a complaint to the Washington State Attorney General. The Attorney General’s complaint form is available at www.atg.wa.gov/file-complaint, and complaints may be mailed to the Consumer Protection Division, Office of the Attorney General, 800 Fifth Avenue, Suite 2000, Seattle, WA 98104. We will provide you with this information again in any appeal denial.

Changes to This Policy

We will not collect, use, or share any category of consumer health data, or use consumer health data for any purpose, that is not disclosed in this policy without first disclosing the new category or purpose and obtaining your affirmative consent. When we change this policy we will post the revised version with a new effective date and keep it prominently linked from the homepage of each of our websites.

This Consumer Health Data Privacy Policy is published under chapter 19.373 RCW and is effective June 1, 2026. It must be maintained as a separate, standalone document and prominently linked from the homepage of every Hear Northwest website. It may not be combined with our HIPAA Notice of Privacy Practices or with any general website privacy policy.