Consumer Health Data Privacy Policy

This policy is provided by Maxwell Massage PLLC under the Washington My Health My Data Act (chapter 19.373 RCW). It describes our handling of consumer health data as that law defines it and applies to Washington consumers.

Health information in your patient record, including intake forms, treatment notes, claims, and billing records, is protected health information or health care information governed by HIPAA and Washington’s Health Care Information Act and is outside the scope of this policy. This policy addresses consumer health data collected outside that record, primarily through public communications and our last-minute availability email program.

1. Consumer Health Data We Collect and Why

• Communications you choose to send. Our public website does not include a patient contact form. Information you voluntarily send through other channels—such as Jane, ordinary email, text, voice call, or fax—may reveal a condition, injury, disability, treatment interest, insurance status, or reason for seeking massage therapy. We use it only to respond to your request, provide requested information, and arrange care.
• Last-minute appointment interest. If you opt in to our last-minute availability list, we collect your email address and subscription status to deliver the program and honor subscriptions and unsubscribes. We do not use email-open or link-click tracking for this list.

2. Website Analytics

For transparency, our public website uses a self-hosted installation of Umami to measure aggregate traffic. It does not use cookies, store anything on your device, retain your IP address or browser user agent, or receive your name, email, phone number, patient identifier, form contents, or Jane activity. A one-way daily visitor identifier is used only to avoid counting the same visit repeatedly; it changes each day and is not combined with our contact, email-subscriber, or patient records.

Because this configuration does not create a durable profile or information that is reasonably linkable to a consumer in our records, we do not treat these aggregate measurements as consumer health data under chapter 19.373 RCW. No outside analytics or advertising company receives the Umami analytics dataset; Cloudflare still processes ordinary web requests as the hosting and security provider described below. We previously used Google Analytics and no longer do.

3. Sources of Consumer Health Data

• Directly from you when you choose to contact us through Jane, ordinary email, text, voice call, or fax. The public website does not include a patient contact form.
• Directly from you when you submit and confirm your subscription to the last-minute availability list.

4. Consumer Health Data We Share

We do not sell consumer health data, and we have never sold consumer health data. We do not disclose it to data brokers, advertisers, social networks, or outside analytics companies.

We disclose only the categories necessary to provide a service you request or operate a program you joined:

• Email addresses and message content may be processed by Google Workspace when you email us and by Amazon Web Services when it delivers a last-minute availability email.
• Text-message, voice-call, and fax transmission data passes through Telnyx. Fax contents are stored on our servers rather than in Telnyx.
• Scheduling and secure portal information is processed by Jane when you choose to book or communicate through Jane.

Our website chat, clinic communication inbox, fax storage, last-minute subscription list, and analytics are hosted on systems we operate. We do not have affiliates.

5. Service Providers

• Cloudflare, Inc. — public website hosting and security.
• Jane App, Inc. — appointment scheduling, secure portal, electronic intake forms, and health records.
• Google Workspace — business email, including correspondence you send us.
• Amazon Web Services, Inc. — email delivery, including last-minute availability emails.
• Telnyx LLC — transmission of text messages, voice calls, and faxes.
• Claim.MD — electronic claims clearinghouse for patient claims; its HIPAA-regulated claims processing is outside this consumer health data policy.

We maintain written agreements and safeguards appropriate to the service and information involved. The public website is not used to collect patient communications; care-specific information is directed to Jane or another appropriate clinic channel.

6. Your Rights and How to Exercise Them

Under RCW 19.373.040, you may:

• Confirm and access. Ask whether we collect, share, or sell consumer health data about you and obtain a copy, including a list of third parties and affiliates with whom it was shared or sold and an active method for contacting them.
• Withdraw consent. Withdraw consent to our collection or sharing of consumer health data. You may stop last-minute availability emails by using the unsubscribe link in any message.
• Delete. Ask us to delete consumer health data about you from our active systems and direct applicable processors, contractors, and other recipients to do the same, subject to exceptions allowed by law.

Submit a request by emailing privacy@maxwell-massage.com, calling (206) 448-9407, or writing to:

Maxwell Massage PLLC
100 Wall Street
Seattle, WA 98121

For your protection, we will use commercially reasonable steps to authenticate your identity and the request. We may ask for additional information reasonably necessary to do so, but we will not require you to create a new account. Please do not send medical records or sensitive identification through ordinary email; we will provide a secure method if those materials are needed.

We will respond without undue delay and generally within 45 days after receiving the request. When reasonably necessary because of the request’s complexity or number, we may extend that period once by up to 45 additional days and will explain the extension during the initial response period. Deletion from archived or backup systems may be delayed until those systems are restored or overwritten, but no longer than six months after we authenticate the deletion request.

Requests are free up to twice per year. As permitted by law, we may charge a reasonable fee or decline to act on a request that is manifestly unfounded, excessive, or repetitive. We will not discriminate against you for exercising these rights, and doing so will not affect the care you receive.

7. Appeals

If we decline to act on a request, we will explain why in writing. You may appeal by replying to that decision or by writing to the address or email above with the word “Appeal” in your message. We will respond in writing within 45 days and explain the reasons for our decision. If we deny the appeal, you may submit a complaint to the Washington State Attorney General at atg.wa.gov/file-complaint.

8. Changes to This Policy

We will not collect, use, or share additional categories of consumer health data, or use consumer health data for additional purposes, without first updating this policy and obtaining affirmative consent when chapter 19.373 RCW requires it.