Washington Consumer Health Data Privacy Policy

Effective Date: September 23, 2026

This Consumer Health Data Privacy Policy is provided under the Washington My Health My Data Act (“MHMDA”).

It applies only to “consumer health data” subject to that law. It does not apply to protected health information subject to HIPAA or healthcare information that is otherwise exempt from the MHMDA. Those records are governed by our Notice of Privacy Practices and applicable healthcare privacy laws.

Consumer Health Data We May Collect

Depending on how you interact with our website or practice before information becomes part of a HIPAA-protected healthcare relationship, we may collect the following categories of consumer health data:

Information indicating that you are seeking healthcare services. This may include a request for information about ADHD evaluation, psychiatric care, medication management, behavioral-health services, pediatric services, adult services, or related healthcare.

Information you provide in an inquiry. This may include whether services are being sought for an adult or child, general concerns described in a message, preferred service or location, and other health-related information you voluntarily provide.

Contact and identifying information associated with a health-related inquiry. This may include name, email address, telephone number, or other information that links an individual to a request for healthcare services.

Website or device information associated with a health-related interaction, if applicable, such as technical information reasonably necessary to operate, secure, or respond to an online request.

We do not intentionally use information collected through our website to infer diagnoses, create health profiles for advertising purposes, or target consumers with behavioral advertising based upon health conditions.

Why We Collect and Use Consumer Health Data

We may collect or use consumer health data to:

• respond to a request for information;
• determine whether our services may be relevant to a person’s request;
• facilitate scheduling or intake when requested;
• communicate with the person making the request;
• provide a product or service requested by the consumer;
• maintain the security and integrity of our website and systems;
• prevent fraud or misuse; and
• comply with applicable law.

We do not collect additional categories of consumer health data or use consumer health data for materially different purposes without providing any notice or obtaining any consent required by applicable law.

Sources of Consumer Health Data

Consumer health data may come from:

• you directly;
• a parent, guardian, or other person contacting us on your behalf;
• your device or browser when necessary to operate or secure an online interaction; and
• service providers acting on our behalf in connection with a service you request.

Consumer Health Data We Share

We may share consumer health data when reasonably necessary to provide a service requested by the consumer or when otherwise permitted with appropriate consent under applicable law.

Categories of consumer health data potentially shared may include:

• identifying and contact information associated with an inquiry;
• information indicating that an individual is seeking a particular healthcare service; and
• information voluntarily submitted through an inquiry or scheduling process.

Categories of Third Parties

Depending on the service requested and our technology configuration, consumer health data may be processed by categories of vendors such as:

• website hosting and infrastructure providers;
• cybersecurity and information-technology providers;
• secure form or communication providers;
• scheduling or intake technology providers; and
• other processors acting on Winston’s behalf to provide a service requested by the consumer.

Specific Affiliates

Winston Center.

We do not sell consumer health data.

We do not share consumer health data with third-party advertising networks for cross-site behavioral advertising.

Your Washington Consumer Health Data Rights

To the extent the Washington My Health My Data Act applies to your information, you may have the right to:

• confirm whether we are collecting, sharing, or selling consumer health data concerning you;
• access consumer health data concerning you;
• obtain information about third parties and affiliates with whom your consumer health data has been shared or sold, as provided by law;
• withdraw consent to future collection or sharing when processing is based on consent; and
• request deletion of consumer health data subject to the Act.

These rights do not convert HIPAA-protected medical records or other information exempt from the MHMDA into consumer health data subject to MHMDA deletion requirements.

How to Exercise Your Rights

You may submit a request by email to [email protected] with the subject line Consumer Health Data Request, or by writing to:

Please describe the right you wish to exercise and provide enough information for us to reasonably authenticate your identity and locate the relevant information.

You are not required to create a new account in order to exercise your rights.

We may request additional information when reasonably necessary to authenticate a request.

We generally will respond to an authenticated request within 45 days as required by applicable law. When reasonably necessary, that period may be extended as permitted by law, in which case we will notify you.

Appeals

If we decline to take action on a request, you may appeal our decision.

Send the appeal by email to [email protected] with the subject line Consumer Health Data Appeal.

Please identify the request being appealed and explain why you believe the decision should be reconsidered.

We will respond to an appeal within the period required by applicable law. If an appeal is denied, we will provide information about how you may submit a complaint to the Washington State Attorney General.

Changes to This Policy

If we intend to collect additional categories of consumer health data or use consumer health data for additional purposes, we will update this policy and obtain affirmative consent when required by the Washington My Health My Data Act.

Contact