Consumer Health Data Privacy Policy

Washington's My Health My Data Act requires a standalone consumer health data privacy policy with its own link. This document is that policy. It covers consumer health data as Washington defines it, and it sits alongside — not inside — our general Privacy Policy (/privacy-policy) and Cookie Policy (/cookie-policy), which continue to describe everything else.

Where this policy and the general Privacy Policy describe the same practice, they agree. Where you are in Washington, this policy governs the handling of your consumer health data.

Washington defines consumer health data broadly: personal information linked to you that identifies your past, present, or future physical or mental health status. Its reach is wider than most people expect — it includes information showing that someone is seeking health care services.

We take that reading seriously. It means that, in Washington, information about your visit to a page where you compare health, dental, or vision plans can be consumer health data even before you have entered a single answer about your health.

Precise geolocation: we do not collect it. We use your ZIP code and a coarse, IP-derived location. We use that coarse location to tell whether you are in Washington, so that this policy and the consent gate in Section 7 apply to you.

We do not use consumer health data to build advertising profiles, and we do not infer health conditions about you.

• Directly from you — what you type into the platform: your questionnaire answers, your ZIP code, your household information.
• Automatically from your device — cookies and similar technologies, according to the choices you make under Section 7.
• From insurance carriers — the status of applications and policies you hold.
• From identity-verification providers, and, where applicable under the Fair Credit Reporting Act, from consumer reporting agencies — the result of an identity check.
• From an agent— if you reached us through an agent's referral link, we associate your account with that agent.

Two categories are shared, and they are shared with very different people:

Health questionnaire responses. Shared only with the insurance carrier you apply to, because that is the point of the application. They are never shared with any advertising or analytics provider, and no Epicare employee or agent can view them.

Browsing and interaction information on our health-coverage pages. Shared with the advertising and analytics providers named in Section 5 — but in Washington, only after you say yes, and never at all if you decline or if your browser sends a Global Privacy Control signal. Outside Washington the default differs; see Section 7.

Nothing else is shared as consumer health data. Your eligibility and rating information goes to the carrier as part of an application you asked us to submit; that is providing the service you requested, not advertising.

We do not sell consumer health data. Washington requires a signed, specific authorization before a regulated entity may sell it (RCW 19.373.070). We have no such authorizations because we do not sell.

Categories of third parties:

Specific affiliates: none. Epicare Insurance Corp shares consumer health data with no affiliated entity. If that ever changes, this policy names the affiliate before any data reaches it.

Through the Google Tag Manager container we also load Google Analytics 4 and Google Ads conversion tracking and remarketing (audiences used to show our ads to visitors on other sites). They receive the same page, event, device and browser information, under the same advertising measurement choice.

If you are in Washington, you have the following rights over your consumer health data. Using them is free, and we will not treat you differently for it.

6.1 The right to know, and to see who received your data

You can ask us to confirm whether we collect, share, or sell your consumer health data, and to give you a list of all third parties with whom we have shared it, together with a way to contact each of them.

6.2 The right to withdraw your consent

You can withdraw your consent to the collection and to the sharing of your consumer health data at any time. The fastest route is the Your Privacy Choices link in the footer of every page, which lets you switch each category off. Withdrawing consent does not undo sharing that already happened, and it does not affect an application you have already submitted to a carrier.

6.3 The right to have your data deleted

You can ask us to delete your consumer health data.

What Washington requires: deletion from all parts of our network, including archived and backup systems, and notification to every third party and processor that received the data.

What we do: on a verified request we delete your consumer health data from our active systems, and we instruct our processors to do the same. Health questionnaire responses are usually already gone, because we purge them once the carrier confirms receipt.

Backups, specifically. We do not edit backup archives in place — restoring, editing and re-sealing a backup would put your data at more risk, not less. Instead: a backup that still contains data you asked us to delete is never restored into active use, it expires on its own retention schedule, and if we ever do restore a backup for disaster recovery, we re-apply every deletion request before that data returns to service. The practical effect is that your data does not come back.

Some information we must keep despite a deletion request — insurance, financial, consent and compliance records that law obliges us to retain. Where that applies we will tell you what we kept and why.

6.4 How to make a request, and what happens next

Write to privacy@eppigo.com, or use the postal address in Section 8.

• We confirm receipt within 10 business days and tell you how we will handle the request.
• We respond within 45 days. If the request is complex we may take a further 45 days, and we will tell you why within the first 45.
• We verify your identity before acting on a request about specific data, so that nobody else can obtain or delete your information.

6.5 If we say no

If we refuse a request, we will tell you why, and you may appeal. Write to the same address with the word appeal. We will respond in writing within 45 days of receiving the appeal, explaining what we did and why.

If we deny your appeal, you may complain to the Washington State Attorney General through the consumer-complaint form at atg.wa.gov/file-complaint (https://www.atg.wa.gov/file-complaint). The My Health My Data Act is enforceable under Washington's Consumer Protection Act, which also gives you your own right to bring an action.

In Washington, nothing beyond what the site needs to function loads until you have answered. The first time you visit, a notice appears before any advertising, analytics, or session-recording technology runs, and we wait. That is different from the rest of the United States, where traffic and advertising measurement start on by default and you can switch them off.

We record your choice together with the date you made it.

If your browser sends a Global Privacy Control signal, we treat it as a refusal: nothing beyond the strictly necessary loads, and we send no advertising conversion events. You can still switch a category on yourself if you want to.

A note on what Washington requires of us here. RCW 19.373.030 requires that consent to share consumer health data be separate and distinct from consent to collect it. Our notice currently takes one consent across categories rather than two separate acts. We are separating them. Until we have, treat any consent you give through the notice as covering both, and use Section 6.2 to withdraw it.

We never place health questionnaire responses, policy numbers, or payment details into any advertising or analytics technology. We do not sell consumer health data. We do not use it for advertising targeting, and we do not use it to infer anything about you. No Epicare employee or agent can view your health questionnaire responses. We do not use geofencing of any kind, and in particular none around any facility that provides health care services (RCW 19.373.080).

A complete change log is available on request.