This policy describes how Implemental LLC (“Implemental Health,” “we”) collects, uses, shares, and allows you to control consumer health data, as that term is defined by Washington’s My Health My Data Act and Nevada’s SB 370. Our general practices are described in our Privacy Notice; this document covers consumer health data specifically.

1. The consumer health data we collect, and why

Category	What it is	Why we collect it	How we use it
Contact information	The email address you give us when you join	It is how you become a member and how we deliver what membership includes	To send you the link to the brain-health viewer; to send you our research letter, at least quarterly; to send you notices about your membership or changes to these terms

That is the complete list. We do not collect your name, date of birth, address, health history, diagnoses, medications, symptoms, biometric data, precise location, or payment information as part of membership.

Information that does not come to us. The answers you give the virtual coach — your habits, your commitments, and your profile responses — are stored in your own browser on your own device, or held only in the page’s memory and discarded when you close the tab. They are not transmitted to Implemental Health. If you load a brain scan into our viewer, it is rendered on your device.

Information held by our clinical partner, not by us. If you order a specialist read, you upload your scan directly to MDview. MDview holds the images, the report, and the physician’s interpretation as its own record under its own privacy practices. Requests about that record go to MDview, not to us.

When this changes, this policy changes first. When we launch measurement — your own baseline tracked over time — Implemental Health will begin to collect and hold member-generated health data: assessments, adherence, and interval measurements. We will update this policy and obtain your consent before collecting it, not after.

2. Where we collect it from

Directly from you, when you enter your email address in the membership form on our website. That is the only source. We do not obtain consumer health data from data brokers, advertising networks, public records, health care providers, insurers, or any other third party, and we do not derive or extrapolate consumer health data from other information about you.

3. What we share

We share the category in section 1 — contact information — with the service providers listed in section 4, only to the extent needed to run the service and send you what membership includes.

We do not sell consumer health data. Not to advertisers, not to data brokers, not to anyone. We have never done so and there is no plan to. Washington and Nevada both require your separate, signed authorization before any sale of consumer health data. We are not asking you for one, because we are not selling anything.

We also do not share consumer health data with insurers or employers, and we do not use it for advertising, retargeting, or cross-context behavioural advertising.

4. The third parties and affiliates we share it with

Affiliates: Implemental LLC has no affiliates. Nothing is shared with any.

Third party	What they receive	Role	Contact
Automattic Inc. (WordPress.com, Jetpack)	Your email address	Hosts our website and operates the membership signup form, the subscriber list, and delivery of member email, on our instructions	privacy@automattic.com
Google LLC (Google Analytics 4)	Website analytics data, which may be linked to your visit but is not linked by us to your email address	Website analytics, on our instructions	Via the Google privacy help centre

We will also disclose information where a law or a valid legal order requires it. If that happens and we are permitted to tell you, we will.

MDview is named separately and deliberately: MDview is not receiving consumer health data from us. You provide your scan to MDview directly, and MDview holds it as its own record.

5. How to exercise your rights

If you are a Washington or Nevada resident, you have the right to:

• Confirm whether we are collecting, sharing, or selling your consumer health data;
• Access your consumer health data, and receive a list of all third parties and affiliates with whom we have shared or sold it, together with a way to contact each of them;
• Withdraw your consent to our collection and sharing of your consumer health data; and
• Delete your consumer health data.

How to make a request. Email privacy@implementalhealth.com from the email address the request concerns, and tell us which of the four rights above you are exercising. Because an email address is the only consumer health data we hold about a free member, confirming the request from that address is all the verification we will ask for.

Unsubscribing is a withdrawal of consent. The unsubscribe link at the bottom of every email we send works immediately and requires no explanation. You do not have to write to us to stop hearing from us.

What happens when you ask us to delete. We delete your consumer health data from our records, including from backup and archived systems, and we notify every processor, contractor, and third party listed in section 4 to do the same. Deletion from live systems happens promptly; deletion from backup and archive systems may take up to six months, which is the period the law allows.

How long we take. We will respond without undue delay and in all cases within 45 days of receiving your request. If a request is genuinely complex we may extend once by a further 45 days, and we will tell you why before we do.

If we decline. We will tell you why, and we will tell you how to appeal. If we deny your appeal, you may complain to the Washington State Attorney General (Washington residents) or the Nevada Attorney General (Nevada residents).

No penalty for asking. We will not deny you membership, degrade the service, or charge you a different price because you exercised any of these rights.

← Back to Implemental Health