Last Updated: May 18, 2026

Privacy Notice

Welcome to Health Access Innovation—a platform designed to help Americans to appeal denials of healthcare insurance coverage. This Privacy Notice explains how Health Access Innovation, a 501(c)(3) nonprofit ("Health Access Innovation," "we," "us," or "our") collects, uses, discloses, and otherwise processes personal data in connection with its platform, the Coverage Denial Support Program, and https://healthaccessinnovation.org/, as well as any specific product, service, or application that references or links to this Privacy Notice (the "Services"). We may also choose or be required by law to provide different or additional disclosures relating to the processing of personal data about residents of certain countries, regions, or states. Please refer to the Region-Specific Disclosures section below for additional disclosures that may be applicable to you.

This Privacy Notice does not address our privacy practices relating to Health Access Innovation job applicants, employees and other employment-related individuals, nor data that is not subject to applicable data protection laws (such as deidentified or publicly available information). This Privacy Notice is also not a contract and does not create any legal rights or obligations not otherwise provided by law.

Health Access Innovation is not a "covered entity" or a "business associate" as those terms are defined under the Health Insurance Portability and Accountability Act of 1996, as amended, and its implementing regulations (collectively, "HIPAA"). Accordingly, any health-related information that we receive – including that may have been considered "protected health information" (as defined under 45 CFR § 160.103) while in possession of a HIPAA-covered entity – ceases to be subject to HIPAA once it has been disclosed to us. Once that data is in our possession, it is subject to this Privacy Notice and not HIPAA. If you have any questions about the extent to which your information is subject to HIPAA before it comes into our possession, you should contact the relevant HIPAA-covered entity, such as your health care provider or health plan.

[ 01 ]

Our Collection and Use of Personal Data

The categories of personal data we collect depend on how you interact with us and our Services. For example, you may provide us your personal data directly when you sign up for our mailing list, register for an account, or otherwise contact us or interact with us.

We also collect personal data automatically when you interact with our Services and may also collect personal data from other sources and third parties.

Personal Data Provided by Individuals

We collect the following categories of personal data individuals provide us:

Contact Information, including first and last name, phone number, mailing address, email address, and communication preferences. We use this information primarily to communicate with you directly, with your authorization, locate medical records we may need to handle your appeal, and to send you promotional communications in accordance with your preferences.

Account Information, including first and last name, date of birth, email address, phone number, and account credentials. We use this information primarily to administer your account, provide you with our Services, communicate with you regarding your account and your use of our Services, and for customer support purposes.

Insurance Information and Coverage Details, including insurance carrier, policy identification numbers, type of policy, scope of coverage, copays, names of individuals covered by the insurance, and any other details that may be pertinent to your use of the Services. We use this information to advise you on the merit of any appeal you may choose to submit, to contact the insurer on your behalf (with your authorization), and to otherwise facilitate your use of the Services.

Appeal Documentation, including correspondence relating to the denial of coverage, reasons for the denial, nature of the original claim, the health care you received and any other information or documentation you choose to submit in relation to your denial of coverage and appeal. We use this information to advise you on the merit of any appeal you may choose to submit, to contact the insurer and healthcare provider on your behalf (with your authorization), and to otherwise facilitate your use of the Services.

Health Information, such as your health records, medical history, and any other health-related information you choose to provide to us. We use this information to assist you by advising on the merit of any appeal you may choose to submit and to facilitate your use of our Services.

Feedback and Support Information, including the contents of custom messages sent through email addresses, phone, or other contact information we make available to customers, and responses to survey questions, as well as recordings of calls with us, where permitted by law (including through the use of automated tools provided by us or our third-party providers). We use this information primarily to investigate and respond to your inquiries, to communicate with you via online chat, email, phone, or text message, and to improve our Services.

If you choose to contact us, we may need additional information to fulfill the request or respond to your inquiry. We may provide additional privacy disclosures where the scope of the request we receive or personal data we require fall outside the scope of this Privacy Notice. In that case, the additional privacy disclosures will govern how we may process the information you provide at that time.

Personal Data Automatically Collected

We, and our third-party partners, automatically collect information you provide to us and information about how you access and use our Services when you engage with us. We typically collect this information through the use of a variety of our own and our third-party partners' automatic data collection technologies, including (i) cookies or small data files that are stored on an individual's computer and (ii) other, related technologies, such as web beacons, pixels, embedded scripts, mobile SDKs, location-identifying technologies and logging technologies. Information we collect automatically about you may be combined with other personal data we collect directly from you or receive from other sources.

We, and our third-party partners, use automatic data collection technologies to automatically collect the following data when you use our services or otherwise engage with us:

Information About Your Device and Network, including the device type, manufacturer, and model, operating system, IP address, browser type, Internet service provider, and unique identifiers associated with you, your device, or your network (including, for example, a persistent device identifier or advertising ID). We employ third-party technologies designed to allow us to recognize when two or more devices are likely being used by the same individual and may leverage these technologies (where permitted) to link information collected from different devices.

Information About the Way Individuals Use Our Services and Interact With Us, including the site from which you came, the site to which you are going when you leave our services, how frequently you access our services, whether you open emails or click the links contained in emails, whether you access our services from multiple devices, and other browsing behavior and actions you take on our services (such as the pages you visit, the content you view, the communications you have through our services, and the content, links and ads you interact with). We employ third-party technologies designed to allow us to collect detailed information about browsing behavior and actions that you take on our services, which may record your mouse movements, scrolling, clicks, and keystroke activity on our Services and other browsing. These third-party technologies may also record information you enter when you interact with our Services, or engage in chat features or other communication platforms we provide.

Information About Your Location, including general geographic location that we or our third-party providers may derive from your IP address.

All of the information collected automatically through these tools allows us to improve your customer experience. For example, we may use this information to enhance and personalize your user experience, to monitor and improve our Services, to offer communications features such as live and automated chat, and to improve the effectiveness of our Services, offers, communications and customer service. We may also use this information to: (a) remember information so that you will not have to re-enter it during your visit or the next time you visit the site; (b) provide custom, personalized content and information; (c) identify you across multiple devices; (d) provide and monitor the effectiveness of our services; (e) monitor aggregate metrics such as total number of visitors, traffic, usage, and demographic patterns on our website; (f) diagnose or fix technology problems; and (g) otherwise to plan for and enhance our products and services.

For information about the choices you may have in relation to our use of automatic data collection technologies, please refer to the Your Privacy Choices section below.

Personal Data from Other Sources and Third Parties

We may receive the same categories of personal data as described above from the following sources and other parties:

Single Sign-On: We may provide you the ability to log in to our services through certain third-party accounts you maintain. When you use these single sign-on protocols to access our services, we do not receive your login credentials for the relevant third-party service. Instead, we receive tokens from the single sign-on protocol to help identify you in our system (such as by your username) and confirm you successfully authenticated through the single sign-on protocol. This information allows us to more easily provide you access to our Services.

Social Media: When you interact with our Services through social media networks, such as when you follow us or share our content on social networks, we may receive some information that you permit the social network to share with third parties. The data we receive is dependent upon your privacy settings with the social network, and may include profile information, profile picture, username, and any other information you permit the social network to share with third parties. You should always review and, if necessary, adjust your privacy settings on third-party websites and social media networks and services before sharing information and/or linking or connecting them to other services. We use this information primarily to operate, maintain, and provide you with the features and functionality of our Services, as well as to communicate directly with you, such as to send you messages about features that may be of interest to you.

Insurance Companies: With your authorization, we may receive information about your claim and denial of coverage from the insurer from whom you obtain medical insurance.

Health Care Providers: With your authorization, we may receive information about the healthcare for which you claimed coverage from your relevant health care providers to assist with your appeal.

Service Providers: Our service providers that perform services on our behalf, such as analytics and certain marketing providers, collect personal data and often share some or all of this information with us.

Other Sources: We may also collect personal data about you from other sources, including publicly available sources, third-party data providers, brand partnerships, or through transactions such as mergers and acquisitions.

Inferences: We may generate inferences or predictions about you and your preferences based on the other personal data we collect and the interactions we have with you.

Additional Uses of Personal Data

In addition to the primary purposes for using personal data described above, we may also use personal data we collect to:

Fulfill or meet the reason the information was provided, such as to fulfill our contractual obligations, or to deliver the Services requested;
Manage our organization and its day-to-day operations;
Communicate with you, including via email, text message, chat, social media and/or telephone calls;
Facilitate the relationship we have with you;
Request you provide us feedback about our Services;
Address inquiries or complaints made by or about an individual in connection with our Services;
Create and maintain accounts for our users;
Verify your identity and entitlement to our Services;
Register you for and provide you access to contests, sweepstakes, and surveys;
Market our Services to you, including through email and social media;
Administer, improve, and personalize our Services, including by recognizing you and remembering your information when you return to our Services;
Develop, operate, improve, maintain, protect, and provide the features and functionality of our Services, including by training or fine-tuning our artificial intelligence and machine learning models;
Identify and analyze how you use our Services;
Infer additional information about you from your use of our Services, such as your preferences;
Create aggregated or de-identified information that cannot reasonably be used to identify you, which information we may use for purposes outside the scope of this Privacy Notice;
Conduct research and analytics on our user base and our Services, including to better understand the demographics of our users;
Improve and customize our Services to address the needs and interests of our user base and other individuals we interact with;
Test, enhance, update, and monitor the Services, or diagnose or fix technology problems;
Help maintain and enhance the safety, security, and integrity of our property, Services, technology, assets, and business;
Defend, protect, or enforce our rights or applicable contracts and agreements (including our Terms of Use), as well as to resolve disputes, to carry out our obligations and enforce our rights, and to protect our business interests and the interests and rights of third parties;
Detect, prevent, investigate, or provide notice of security incidents or other malicious, deceptive, fraudulent, or illegal activity and protect the rights and property of Health Access Innovation and others;
Facilitate business transactions and reorganizations impacting the structure of our business;
Comply with contractual and legal obligations and requirements;
Fulfill any other purpose for which you provide your personal data, or for which you have otherwise consented.

[ 02 ]

Our Disclosure of Personal Data

We disclose or otherwise make available personal data in the following ways:

To Insurance Companies: With your authorization, we will disclose your personal data to relevant insurance companies as part of the Services we provide to you. For example we may contact an insurance company to ask for further details about why they denied you coverage or otherwise correspond with them about the status of your appeal.

To Health Care Providers: With your authorization, we will disclose your personal data to health care providers when seeking further information on your behalf in support of your appeal. For example, we may disclose your name, date of birth, address or other required identifiers to enable your health care provider to locate relevant records.

To Other Customers and the General Public: If you interact with us on social media, or post a review, that information will be available to other members of the public who are interacting with us on those same platforms, based on the applicable privacy settings and intended recipients. Keep in mind that individuals who view content can always reshare or redistribute that content both on and off the platform or save or copy the content outside of the applicable platform. In addition, by publicly posting such content, you are directing us to disclose that information as broadly as possible and directing those accessing the content to do the same.

To Service Providers: We engage other third parties to perform certain services on our behalf in connection with the uses of personal data described in the sections above. Depending on the applicable services, these service providers may process personal data on our behalf or have access to personal data while performing services on our behalf.

To Other Businesses as Needed to Provide Services: We may share personal data with third parties you engage with through our Services or as needed to fulfill a request or transaction.

In Connection with a Business Transaction or Reorganization: We may take part in or be involved with a transaction or reorganization, such as a merger, acquisition, joint venture, or financing or sale of our assets. We may disclose, transfer, or assign personal data to a third party during negotiation of, in connection with, or as an asset in such a transaction or reorganization. As a 501(c)(3) nonprofit, such a transaction or reorganization will occur, if at all, in compliance with the laws applicable to such nonprofit transactions and reorganizations. Also, in the unlikely event of our bankruptcy, receivership, or insolvency, your personal data may be disclosed, transferred, or assigned to third parties in connection with the proceedings or disposition of our assets.

To Facilitate Legal Obligations and Rights: We may disclose personal data to third parties, such as legal advisors and law enforcement:

in connection with the establishment, exercise, or defense of legal claims;
to comply with laws or to respond to lawful requests and legal process;
to protect our rights and property and the rights and property of our agents, customers, and others, including to enforce our agreements, policies, and terms of use;
to detect, suppress, or prevent fraud;
to reduce credit risk and collect debts owed to us;
to protect the health and safety of us, our customers, or any person; or
as otherwise required by applicable law.

With Your Consent or Direction: We may disclose your personal data to certain other third parties or publicly with your consent or direction. For example, with your permission, we may post your testimonial on our website.

[ 03 ]

Your Privacy Choices

The following privacy choices are made available to all individuals with whom we interact. You may also have additional choices regarding your personal data depending on your location or residency. Please refer to our Region-Specific Disclosures below for information about additional privacy choices that may be available to you.

Communication Preferences

Email Communication Preferences: You can stop receiving promotional email communications from us by clicking on the "unsubscribe" link provided in any of our email communications. Please note you cannot opt-out of service-related email communications (such as account verification, transaction confirmation, or service update emails).

Withdrawing Your Consent

Where we have your consent for the processing of your personal data (e.g., when you opt in to receive certain types of marketing communications from us), you may withdraw your consent by following the instructions provided when your consent was requested or by contacting us as set forth in the Contact Us section below.

Automatic Data Collection Preferences

Where a Health Access Innovation-specific preference manager or privacy setting is not available, you may be able to utilize third-party tools and features to further restrict our use of automatic data collection technologies. For example, (i) most browsers allow you to change browser settings to limit automatic data collection technologies on websites, (ii) most email providers allow you to prevent the automatic downloading of images in emails that may contain automatic data collection technologies, and (iii) many devices allow you to change your device settings to limit automatic data collection technologies for device applications. Please note that blocking automatic data collection technologies through third-party tools and features may negatively impact your experience using our Services, as some features and offerings may not work properly or at all. Depending on the third-party tool or feature you use, you may not be able to block all automatic data collection technologies or you may need to update your preferences on multiple devices or browsers. We do not have any control over these third-party tools and features and are not responsible if they do not function as intended.

Modifying or Deleting Your Personal Data

If you have any questions about reviewing, modifying, or deleting your personal data, you can contact us directly at legal@healthaccessinnovation.org. We may not be able to modify or delete your personal data in all circumstances.

Partner-Specific Preferences

Certain of our third-party providers and partners offer additional ways that you may exercise control over your personal data, or automatically impose limitations on the way we can use personal data in connection with the services they provide:

Device-Specific / Platform-Specific Preferences: The device and/or platform you use to interact with us (such as your mobile device or social media provider), may provide you with additional choices with regard to the data you choose to share with us. For example, many mobile devices allow you to change your device permissions to prevent our Services from accessing certain types of information from your device, and many social media platforms allow you to change your platform permissions to prevent the sharing of certain types of information connected with your profile. Please refer to your device or platform provider's user guides for additional information about implementing any available platform-specific targeted advertising opt-outs.

[ 04 ]

Children's Personal Data

While parents may choose to upload data about their children to our Services, our services are not directed to, and we do not intend to, or knowingly, collect or solicit personal data from children under the age of 18. If an individual is under the age of 18, they should not use our services or otherwise provide us with any personal data. If a child under the age of 18 has provided personal data to us, we encourage the child's parent or guardian to contact us to request that we remove the personal data from our systems. If we learn that any personal data we collect has been provided by a child under the age of 18, we will promptly delete that personal data.

[ 05 ]

Security of Personal Data

We have implemented reasonable physical, technical, and organizational safeguards that are designed to protect your personal data. However, despite these controls, we cannot completely ensure or warrant the security of your personal data.

[ 06 ]

Retention of Personal Data

We will usually retain the personal data we collect about you for no longer than reasonably necessary to fulfil the purposes for which it was collected, and in accordance with our legitimate business interests and applicable law. However, if necessary, we may retain personal data for longer periods of time as required under applicable law or as needed to resolve disputes or protect our legal rights.

To determine the appropriate duration of the retention of personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of personal data and if we can attain our objectives by other means, as well as our legal, regulatory, tax, accounting, and other applicable obligations.

Once retention of the personal data is no longer reasonably necessary for the purposes outlined above, we will either delete or deidentify the personal data or, if that is not possible (for example, because personal data has been stored in backup archives), we will securely store the personal data and isolate it from further active processing until deletion or deidentification is possible.

[ 07 ]

Third-Party Websites and Services

Our Services may include links to third-party websites, plug-ins, applications and other services. Except where we post, link to or expressly adopt or refer to this Privacy Notice, this Privacy Notice does not apply to any personal data practices of third parties. To learn about the personal data practices of third parties, please visit their respective privacy notices.

[ 08 ]

Region-Specific Disclosures

We may choose or be required by law to provide different or additional disclosures relating to the processing of personal data about residents of certain countries, regions or states. Please refer below for disclosures that may be applicable to you:

United States: If you are a resident of the United States, please click here for additional U.S.-specific privacy disclosures, including a description of the personal data rights made available to residents of certain states under applicable law.

[ 09 ]

Updates to This Privacy Notice

We may update this Privacy Notice from time to time. When we make changes to this Privacy Notice, we will change the date at the beginning of this Privacy Notice. If we make material changes to this Privacy Notice, we will notify individuals by email to their registered email address, by prominent posting on this website or our other platforms, or through other appropriate communication channels. All changes shall be effective from the date of publication unless otherwise provided.

[ 10 ]

If you have any questions or requests in connection with this Privacy Notice or other privacy-related matters, please send an email to legal@healthaccessinnovation.org.

[ 11 ]

Additional U.S. Privacy Disclosures

These disclosures supplement the information contained in our Privacy Notice by providing additional information about the privacy rights available to individual residents of certain states in the United States and our personal data processing practices relating to those individuals. For a detailed description of how we collect, use, disclose, and otherwise process personal data, please read our Privacy Notice.

Nevada Residents

If you are a resident of the state of Nevada in the United States, you have the right to opt out of the sale of your personal data. Although we do not sell personal data of Nevada residents (as defined under Nevada law), you may submit a request to opt-out of the sale of your personal data by emailing us at legal@healthaccessinnovation.org.

California Residents

California's "Shine the Light" law (Civil Code Section §1798.83) provides certain rights to California residents that have an established business relationship with us with regard to the disclosure of certain types of personal data to third parties for their direct marketing purposes. It is company policy that we do not disclose personal data to third parties for their direct marketing purposes.

Connecticut Residents

If you are a resident of the state of Connecticut in the United States, the following supplementary disclosures apply to you.

Personal Data Disclosures, Sales, and Targeted Advertising

We disclose all of the categories of personal data we collect to the categories of recipients set forth in the Our Disclosure of Personal Data section of our Privacy Notice. However, we do not sell personal data, and we do not process or otherwise share personal data for the purpose of displaying advertisements that are selected based on personal data obtained or inferred over time from an individual's activities across non-affiliated businesses or websites, applications, or other services (otherwise known as "targeted advertising" or "cross-context behavioral advertising").

Sensitive Personal Data

The following personal data elements we collect may be classified as "sensitive" under certain privacy laws:

Health Information, such as your health records, medical history, and any other health-related information you choose to provide to us.

We use sensitive personal data for the purposes set forth in the Our Collection and Use of Personal Data section of our Privacy Notice. We do not sell sensitive personal data, and we do not process or otherwise share sensitive personal data for the purpose of targeted advertising. However, depending on your state of residency and subject to certain legal limitations and exceptions, you may be able to limit, or withdraw your consent for, our processing of sensitive personal data (as described in the Your Additional U.S. Privacy Choices section below).

Deidentified Information

We may at times receive, or process personal data to create, deidentified information that can no longer reasonably be used to infer information about, or otherwise be linked to, a particular individual or household. Where we maintain deidentified information, we will maintain and use the information in deidentified form and not attempt to reidentify the information except as required or permitted by law.

Automated Decision-Making and Profiling

We do not conduct automated processing of personal data for the purposes of evaluating, analyzing, or predicting an individual's personal aspects in furtherance of decisions that produce legal or similarly significant effects. As a result, we do not provide a right to exercise control over such forms of automated decision-making and profiling.

Your Additional U.S. Privacy Choices

Subject to certain legal limitations and exceptions, you may be able to exercise some or all of the following rights:

Right to Know: The right to confirm whether we are processing personal data about you.

Right to Access & Portability: The right to obtain access to the personal data we have collected about you and, where required by law, the right to obtain a copy of the personal data in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another entity without hindrance.

Right to Correction: The right to correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing of the personal data.

Right to Control Over Sensitive Personal Data: The right to exercise control over our collection and processing of certain sensitive personal data.

Right to Deletion: The right to have us delete personal data we maintain about you.

You may also have the right to not receive retaliatory or discriminatory treatment in connection with a request to exercise the above rights. However, the exercise of the rights described above may result in a different price, rate or quality level of product or service where that difference is reasonably related to the impact the right has on our relationship or is otherwise permitted by law.

Submitting Privacy Rights Requests

Please submit a request specifying the right you wish to exercise by emailing us at legal@healthaccessinnovation.org.

In relation to automatic data collection, you can follow the steps set forth in the Automatic Data Collection Preferences section of the Your Privacy Choices section of our Privacy Notice to further exercise control over automatic data collection technologies.

Before processing your request to exercise certain rights (including the Right to Know, Access & Portability, Correction, and Deletion), we will need to verify your identity and confirm you are a resident of a state that offers the requested right(s). In order to verify your identity, we will generally either require the successful authentication of your account, or the matching of sufficient information you provide us with the information we maintain about you in our systems. As a result, we require requests to include first and last name, email address, phone number, state of residency and/or the date of your last transaction with us.

In certain circumstances, we may decline or limit your request, particularly where we are unable to verify your identity or locate your information in our systems, or where you are not a resident of an eligible state.

Submitting Authorized Agent Requests

In certain circumstances, you are permitted to use an authorized agent to submit requests on your behalf through the designated methods set forth above where we can verify the authorized agent's authority to act on your behalf. In order to verify the authorized agent's authority, we generally require evidence of either (i) a valid power of attorney or (ii) a signed letter containing your name and contact information, the name and contact information of the authorized agent, and a statement of authorization for the request. Depending on the evidence provided and your state of residency, we may still need to separately reach out to you to confirm the authorized agent has permission to act on your behalf and to verify your identity in connection with the request.

Appealing Privacy Rights Decisions

You may be able to appeal a decision we have made in connection with your privacy rights request. All appeal requests should be submitted by replying to the communication resolving your original request.

[ 12 ]

Consumer Health Data Privacy Notice

Washington and Nevada Consumer Health Data Privacy Notice

Last Updated: May 18, 2026

This Consumer Health Data Privacy Notice (the "Consumer Health Notice") supplements the Health Access Innovation Privacy Notice and explains how we collect, use, disclose, and otherwise processes Consumer Health Data (as defined below) of residents of the state of Washington or Nevada, or individuals whose Consumer Health Data is collected in those states through our Services.

This Consumer Health Notice does not address privacy practices relating to Health Access Innovation job applicants, employees, and other personnel. Please note that this Consumer Health Notice is not a contract and does not create any legal rights or obligations not otherwise provided by law.

Our Collection and Use of Consumer Health Data

The term "Consumer Health Data" as used in this Consumer Health Privacy Notice means any personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status as defined in the Washington My Health My Data Act or the Nevada Consumer Health Data Privacy Law (the "Consumer Health Privacy Laws"). The Consumer Health Data we collect depends on the context of your interactions with us and, in most cases, is information that you decide to share with us. This includes information collected through consultation questionnaires, your communications with us, authorized disclosures from your insurance carrier or health care provider, or from your other interactions with our Services. Consumer Health Data does not include information that is considered deidentified under the Consumer Health Privacy Laws.

Examples of Consumer Health Data that we may collect include:

Information you share about your health-related conditions, symptoms, experiences, diagnoses, testing, or treatments.
Billing and claims information.
Reasons for denial of coverage by your insurer.
Other information that may be used to infer or derive data related to the above or other health-related information.

We may process and/or use your Consumer Health Data (including with your consent where required by the Consumer Health Privacy Laws) for the following purposes:

To manage and provide the Services.
To manage, provide, maintain, and improve our business.
To respond to your questions, concerns, and other requests for assistance.
To customize your browsing experience on the Services.
For market research and providing insights into consumer health behaviors/conditions.
To build and enhance consumer profiles.
To create anonymous, aggregated, or de-identified data.

We may also combine your Consumer Health Data with other personal data we collect directly from you or receive from other sources.

Sources of Consumer Health Data

The Consumer Health Data we collect depends on the context of your interactions with our Services and, in most cases, is information that you decide to share with us.

We and our service partners may collect this type of information over time and across third-party websites and mobile applications. For more information, please see the Our Collection and Use of Personal Data section of our Privacy Notice.

Our Disclosure of Consumer Health Data

We may share the categories of Consumer Health Data set forth above as follows:

To Insurance Companies: With your authorization, we may disclose your Consumer Health Data to relevant insurance companies as part of the Services we provide to you. For example we may contact an insurance company to ask for further details about why they denied you coverage or otherwise correspond with them about the status of your appeal.

To Health Care Providers: With your authorization, we may disclose your Consumer Health Data to health care providers when seeking further information on your behalf in support of your appeal. For example, we may disclose details of the treatment you say you received in order to obtain further details from them to help support your appeal.

To Service Providers: We work with a variety of service providers who help us process your Consumer Health Data, such as to facilitate the operation of our Services.

In relation to Business Transactions: We may take part in, or be involved with, a business transaction, such as a merger. We may disclose Consumer Health Data to a third party during the negotiation of or in connection with such a transaction.

In relation to Legal Obligations and Rights: We may disclose Consumer Health Data to third parties in connection with the establishment, exercise, or defense of legal claims; to comply with laws or to respond to lawful requests and legal processes; to protect our rights and property and the rights and property of others, including to enforce our agreements and policies; to detect, suppress, or prevent fraud; to protect the health and safety of us and others; or as otherwise required by applicable law.

With Your Consent: We may disclose Consumer Health Data about you to other service providers or publicly with your consent or at your direction. For example, with an individual's consent or at their direction we may post their testimonial on our Services.

Your Privacy Rights

The Laws provide the following rights with respect to Consumer Health Data we collect about you:

Right to Access / Confirm: You may have the right to confirm whether we are collecting, sharing, or selling Consumer Health Data about you and with whom we may be disclosing such Consumer Health Data, and to access such data.

Right to Withdraw Consent: If you have provided your consent for our processing or sharing of your Consumer Health Data, you may have the right to withdraw your consent.

Right to Delete: You may have the right to request that we delete your Consumer Health Data and that all third parties to whom we have disclosed your Consumer Health Data delete such data.

How to Exercise Your Privacy Rights

To exercise any of the privacy rights set forth above or to review or request changes to data, please submit a request by emailing legal@healthaccessinnovation.org.

Before processing your request, we will need to authenticate your identity. To authenticate your identity, we will generally require matching a minimum amount of information you provide us with the information we maintain about you in our systems. This process may require us to request additional information from you, including, but not limited to, your email address and phone number.

In certain circumstances, we may decline a request to exercise the rights described above, particularly where we are unable to authenticate your identity or locate your information in our systems. If we are unable to comply with all or a portion of your request, we will explain the reasons for our decision.

Appealing Privacy Rights Decisions

If your request to exercise a right under the Laws is denied, you may appeal that decision by contacting us at legal@healthaccessinnovation.org. If the appeal is unsuccessful, you may raise a concern or lodge a complaint with the applicable State Attorney General:

Washington: www.atg.wa.gov/file-complaint
Nevada: https://consumeraffairs.nv.gov/About/File_a_complaint/

Changes to this Consumer Health Data Privacy Notice

We may update this Consumer Health Notice from time to time. When we make changes to this Consumer Health Notice, we will notify you by changing the date at the beginning of this Consumer Health Notice. If we make material changes to this Consumer Health Notice, we will notify individuals by email to their registered email address, by prominent posting on this website or our other platforms, or through other appropriate communication channels. All changes shall be effective from the date of publication unless otherwise specified.