Washington Consumer Health Data Privacy Policy

The Washington My Health, My Data Act (“MHMDA”) provides consumers that are residents of the state of Washington or whose consumer health data is collected in Washington certain rights as it relates to their consumer health data. This policy supplements COUNTRY’s Online Privacy and Security Statement and our Customer Privacy Notice.

Scope of this notice

In an effort to provide the highest quality client service and help ensure we are meeting your insurance and financial services needs, we may collect, use, and share consumer health data of Washington consumers. However, we do not sell consumer health data. In this policy, consumer health data has the meaning described below and excludes certain information subject to other laws.

Consumer health data is defined for purposes of this policy and the MHMDA as personal information that is linked or reasonably linked to a Washington consumer and that identifies the Washington Consumer’s past, present, or future physical or mental health status.

Personal information is defined for purposes of this policy and the MHMDA as information that identifies or is reasonably capable of being associated or linked directly, or indirectly, with a Washington consumer.

Under the MHMDA, consumer health data does not include:

• Publicly available consumer information;
• De-identified consumer information;
• Health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA); and
• Personal information covered by specific privacy laws such as the Fair Credit Reporting Act (FCRA) and the Gramm-Leach-Bliley Act (GLBA).

Categories of Consumer Health Data Collected, Used, and/or Shared

We may collect, use, and share consumer health data for the purpose of providing products and services related to commercial policies and claims. Based on the scope of this notice and under MHMDA, the types of consumer health data that we may collect, use, and/or share for this purpose would be directly related to products and services related to commercial policies and claims. This consumer health data may include:

• Health conditions, treatments, diseases, or diagnoses;
• Health related surgeries or procedures;
• Use or purchase of prescribed medication;
• Other consumer health data that may be provided to provide a policy or service; and
• Any other consumer personal information that is outlined within our other consumer privacy notices.

Categories of Sources from which Consumer Health Data is Collected

We may collect consumer health data about you as required based on your product or service with us. This consumer health data may be collected from one or more of the following parties:

• You
• Our family of affiliated companies and business partners for everyday business purposes such as to service your transactions, fulfill your claims and maintain your account(s).
• Third parties or other entities from whom we must obtain your consumer health data from in order to provide services associated with your commercial policy or claim.

Categories of Third Parties and Affiliates with whom Consumer Health Data is Shared

We may share consumer health data that we have collected about you to other parties as required based on your product or service with us. This consumer health data may be shared with one or more of the following parties:

• Our family of affiliated companies for everyday business purposes such as to service your transactions, fulfill your claims and maintain your account(s).
• Third parties with whom we have a business relationship and utilize in conjunction with providing our products and services.
• As required or permitted by law to others, such as in response to court orders and legal investigations.

Consumer Rights

Under MHMDA you have the following rights:

• The right to withdraw consent from our collection and sharing of your consumer health data.
• The right to request a list of all third parties and affiliates with whom we have shared your consumer health data.
• The right to request that we delete any of your consumer health data retained by us and notify our affiliates, processors, contractors, and third parties we have shared your consumer health data with of such deletion request.

We may deny your deletion request if your consumer health data:

• Does not fall into the scope of MHMDA.
• Is reasonably necessary to prevent, detect, protect against, or respond to security incidents, identity theft, fraud harassment, malicious or deceptive activities, or any activity that is illegal under Washington state law or federal law.
• To preserve the integrity or security of systems.
• To investigate, report, or prosecute those responsible for any such action that is illegal under Washington state law or federal law.
• Other legal requirements and exceptions may apply.

How to Exercise your Consumer Rights

To exercise any of your rights listed above, you may submit your request by completing the Washington Consumer Rights Request form.

In order to authenticate your identity, we will request your full name, street address, city, zip code, phone number, email address, and commercial claim number.

If we are unable to authenticate your identity or locate any consumer health data in our systems, we may not respond to your request until you provide us with additional information reasonably necessary to authenticate you and your request.

Contact Us

For additional question related to our privacy practices, please contact 866-COUNTRY (866-268- 6879).