Consumer health data privacy policy

On this page

1. Consumer health data we collect, and why
2. Where it comes from
3. Consumer health data we share
4. Who we share it with
5. Your rights
6. Changes to this policy

Consumer health data we collect, and why

Consumer health data is personal information that identifies you and relates to your past, present or future health, including information that isn’t covered by HIPAA. We collect these categories:

• Health conditions and symptoms: the reason for your visit, your answers to intake questions, your medical history and diagnoses.
• Medications and treatments: prescriptions, refills, allergies and treatments you ask about or receive.
• Tests and measurements: lab orders and results, and measurements you share in a visit, like height, weight or blood pressure.
• Sexual and reproductive health information: for example birth control, erectile dysfunction treatment or STD testing, when it’s part of your care.
• Photos you share with your clinician, for example of a skin condition.
• The health services you look for or use: the visits, tests and medications you ask about, and the lab and pharmacy you choose.

We use this data only to provide the services you ask for: your visits by text, lab tests, prescriptions, the insurance and prior authorization work for them, and messages about your care. We also use it to keep Arcus safe and to meet our legal obligations. We use it for anything else only with your consent.

The BMI calculator on our website runs in your browser. We don’t receive or keep the height and weight you enter.

Where it comes from

• From you, when you start a visit, answer questions or message your care team.
• From your care team, in the notes and orders they create during your care.
• From labs, pharmacies, your insurance plan and prescription history services.
• From your device, when you use our website or services.

Consumer health data we share

We may share each category listed above, but only what each recipient needs to provide the services you asked for, or as you’ve consented.

Who we share it with

• Our affiliates: the medical groups whose licensed clinicians provide care through Arcus.
• Labs that run your tests.
• Pharmacies that fill your prescriptions.
• Insurance plans and pharmacy benefit managers, to check coverage, file claims and request prior authorization.
• Prescription history services, so your clinician can prescribe safely.
• Service providers that process data for us, like hosting, text messaging, payments, identity verification and customer support.
• Government authorities, when the law requires it.
• People you authorize, like a caregiver.

We don’t sell consumer health data.

Your rights

Wherever you live, you can:

• Confirm and access: ask whether we collect, share or sell your consumer health data, get a copy of it, and get a list of every third party and affiliate we’ve shared it with, with their contact information.
• Delete: ask us to delete it. We’ll also tell the affiliates and service providers we shared it with to delete it. Some records may need to be kept by the medical groups as medical records under the law.
• Withdraw consent: take back your consent to our collecting or sharing it.

To make a request, email privacy@arcus.healthcare. We’ll confirm your identity, then respond within 45 days. If we need more time, we’ll tell you, and we may extend that once by another 45 days. Using these rights is free, and we won’t treat you differently for using them.

Appeals

If we turn down your request, you can appeal by replying to our decision within 45 days. We’ll answer your appeal in writing within 45 days. If we deny it, you can contact the Washington State Attorney General at atg.wa.gov, or the Nevada Attorney General at ag.nv.gov.

Changes to this policy

We’ll post changes here and update the date at the top. If a change is significant, we’ll tell you before it takes effect, and we’ll ask for your consent if the law requires it.