Consumer Health Data Privacy Policy

Last updated: [EFFECTIVE DATE]

Washington My Health My Data Act (RCW 19.373.020); Nevada consumer health data law (NRS 603A.450 and 603A.495); Connecticut Data Privacy Act (Conn. Gen. Stat. §42-515 et seq.).

This policy explains how Measured Health, the business name of CoolCRYO LLC, 4040 Cheyenne Blvd, Suite C, Rapid City, SD 57703, handles "consumer health data." That is personal information that is linked or reasonably linkable to you and identifies your past, present, or future physical or mental health status, including information inferred from other data.

It applies to residents of Washington, Nevada and Connecticut, and to anyone whose consumer health data is collected in those states. It does not cover information protected by HIPAA, which our Notice of Privacy Practices covers. Our Privacy Policy covers everything else.

A. The consumer health data we collect, and why

Category	Examples	Why we collect it
Quiz answers	Age range, goals, what has held you back, cravings, what you've tried, how ready you are	To show your quiz result and next steps. If you then book a call, order an assessment or ask for the guide, to prepare for your call and recommend a program.
Interest in or purchase of health services	That you booked a free call, chose an assessment (in person or from home, with or without labs), or joined a program	To schedule and provide the service, take payment, ship the from-home scale, and manage your account
Body measurements and wellness information	Scan results, weight, lab results, check-ins, progress photos you give us as a client	To provide your assessment and program
Inferences	The program or next step we suggest for you	To recommend services that fit you
Precise location	We do not collect precise location. Address suggestions use only the text you type (Section C).	—
Biometric data	We do not collect biometric identifiers such as face geometry or fingerprints.	—

We collect consumer health data only with your consent, or when it is necessary to provide a product or service you asked for (RCW 19.373.030(1)). Taking the quiz to see your result is a service you ask for. Keeping your answers with your contact record after the result page is something we do only when you book, order, or ask us to send the guide, and the form tells you so before you submit.

B. Where it comes from

• Directly from you: the quiz, our booking and order forms, the contact form, your portal, and conversations with our team.
• From devices and partners at your direction: your body-composition scan, and labs or a prescribing provider you choose, when you authorize them to send results to us.
• From information you give us: the program we suggest is inferred from your answers.

C. Who we share it with

We do not sell consumer health data. We would need your signed, valid authorization under RCW 19.373.070 and NRS 603A.535 before any sale, and we do not ask for one.

We do not share consumer health data with advertising platforms. Our quiz, assessment, booking and checkout pages and the Portal run no advertising pixels, analytics tags or session recording. We count visits to each funnel step on our own server, with no IP address, cookie, contact details or answers attached.

We share consumer health data only with the processors that run our services for us, under contract, and with third parties you direct us to:

Who	What and why
DigitalOcean (processor)	Hosts our website, database, files and backups, where all the categories above are stored, encrypted
Google (processor)	Google Workspace carries our email (no health details in it). Google Places receives the street-address text you type at checkout, to suggest addresses (no health data). If you sign in with Google, Google tells us your name and email.
Anthropic (processor)	Helps our team draft summaries and documentation from client records, for staff review. On the public site, it answers questions in our website assistant; the assistant removes personal health details before a question is sent.
Twilio and GoHighLevel (processors)	Send texts and manage our contact list: name, phone, email and consent only. No health details.
Square (processor)	Takes card payments: name, billing details and amount. The assessment you bought appears as a line item.
Asher Health and its network prescribing providers; laboratories (third parties)	Only if you ask to be evaluated for prescription options or order labs, and only what they need
Affiliates	[NONE / LIST]

Ask us and we will give you a list of every third party and affiliate that received your consumer health data, with their contact details (RCW 19.373.040(1)(a)).

Tracking across sites (NRS 603A.495(1)(j)). Third parties may collect information about your browsing over time and across websites only on our general marketing pages, and only if you accept advertising cookies. They never do so on our quiz, assessment, booking, checkout or Portal pages.

D. Consent

We ask for consent in plain words, in a separate box that is never checked for you and never hidden in general terms. We ask separately before sharing anything that isn't necessary for the service you asked for. You can withdraw consent at any time (Section F).

E. Geofencing

We do not use geofences around health care facilities to identify, track, collect data from, or send health-related messages or ads to people (RCW 19.373.080; NRS 603A.540; the Connecticut Data Privacy Act).

F. Your rights

You have the right to:

1. Confirm whether we collect, share or sell your consumer health data, and access it, including the list of third parties and affiliates it was shared with
2. Withdraw consent to our collection and sharing
3. Delete your consumer health data. We also tell our processors and the third parties we shared it with to delete it. Data in archives or backups is deleted within 6 months.
4. Appeal if we deny your request
5. Be free from discrimination for using these rights

How to use your rights: email privacy@measuredhealth.me or call 605-301-3189. Clients can also send a Portal message to "Privacy Officer." We will verify your identity, usually by a code sent to the email or phone we have for you, and respond within 45 days. Where the law allows, we may extend that once by 45 more days and will tell you why.

Appeals: email privacy@measuredhealth.me with the subject line "Appeal." We will respond within 45 days (60 days in Connecticut) and explain our decision in writing. If we deny your appeal, you may contact your Attorney General:

• Washington: www.atg.wa.gov/file-complaint
• Nevada: ag.nv.gov
• Connecticut: portal.ct.gov/ag

G. How long we keep it

Data	How long
Quiz answers you don't attach to a booking, order or guide request	Deleted 30 days after you finish the quiz
Quiz answers attached to your contact record, if you don't become a client	[24] months after your last contact with us
Client records	As our Notice of Privacy Practices and records schedule require [at least 6 years after your last service]

H. Changes

If we change this policy in a material way, we will post the new version here, change the "Last updated" date, and email clients first. We will ask for your consent before using consumer health data we already have for a new purpose.

I. Contact

Privacy Officer · Measured Health / CoolCRYO LLC · 4040 Cheyenne Blvd, Suite C, Rapid City, SD 57703 · privacy@measuredhealth.me · 605-301-3189