Version 1.0 — Effective June 15, 2026
This Consumer Health Data Privacy Policy applies to the "consumer health data" of residents of the State of Washington and is provided separately from our general Privacy Policy as required by the Washington My Health My Data Act (RCW 19.373) ("MHMDA"). Where both this policy and our general Privacy Policy apply, this policy governs the consumer health data of Washington consumers.
1. What "Consumer Health Data" Means
Under MHMDA, consumer health data is personal information linked or reasonably linkable to a consumer that identifies the consumer's past, present, or future physical or mental health status. This includes health conditions, diagnoses, treatments, medications, and procedures; bodily functions and vital signs; the use or purchase of health-care services; biometric data; gender-affirming care information; reproductive or sexual health information; precise location information that could reasonably indicate an attempt to receive health services; and any information derived or processed to associate or identify a consumer with the foregoing.
2. Categories of Consumer Health Data We Collect
- Identity and contact data linked to care (name, date of birth, contact details).
- Appointment, treatment, and clinical record data entered by a clinic (conditions, allergies, medications, procedures, treatment photographs, and clinical notes).
- Payment and transaction data associated with health services.
- Technical data, such as an IP address captured at the time a consent is signed.
3. Sources From Which We Collect It
- Directly from the consumer — for example, through the patient portal or intake forms.
- From the clinic that provides the consumer's care and uses Tarsi to manage its records.
- Automatically from the consumer's device when interacting with the platform (limited technical data).
4. How We Use Consumer Health Data
To provide and operate the platform on behalf of the clinic; to enable the clinic to deliver and document care; to process payments; to communicate about appointments and care; to secure the platform and prevent fraud; and to meet legal obligations. Tarsi acts as a service provider to the clinic and processes consumer health data on the clinic's instructions.
5. Categories We Share, and With Whom
We share consumer health data only as needed to operate the platform, and only with:
- The clinic that is the consumer's health-care provider.
- Service providers and sub-processors acting on our or the clinic's behalf and bound by contract — for example, hosting, payment processing, communications delivery, and AI documentation assistance. The current list is published on our Subprocessors page.
- Government bodies or other parties where required by law, or to protect rights and safety.
6. Sale of Consumer Health Data
Tarsi does not sell consumer health data. We will not sell it without first obtaining the consumer's valid authorization as required by MHMDA — a separate, signed authorization distinct from consent.
7. Your Rights
A Washington consumer has the right to:
- Confirm whether we are collecting, sharing, or selling their consumer health data, and to access that data, including a list of the third parties and affiliates with whom we have shared it.
- Withdraw consent to the collection and sharing of their consumer health data.
- Delete their consumer health data.
- Appeal a refusal to act on a request.
8. How to Exercise Your Rights
Email privacy@tarsi.ca with your request. We will verify your identity before responding, respond within the time limits required by law, and charge no fee. If we decline a request, you may appeal to the same address; if an appeal is denied, you may contact the Washington State Office of the Attorney General.
9. No Geofencing
Tarsi does not use a geofence around any entity that provides in-person health-care services to identify or track consumers, to collect consumer health data, or to send notifications, messages, or advertisements related to consumer health data.
10. How We Protect Consumer Health Data
We use encryption in transit and at rest, role-based access controls, least-privilege design, private storage with time-limited signed access, and event-level audit logging. Consumer health data is stored in Canada; certain service providers operate in the United States under contractual safeguards.
11. Changes
We may update this policy and will post a revised effective date. Version 1.0 — June 15, 2026.
12. Contact
Tarsi Inc. privacy@tarsi.ca Hamilton, Ontario, Canada