Consumer Health Data Privacy Policy
This notice is separate from our general Privacy Policy because Washington and Nevada require it to be. It applies to everyone, not only to residents of those states. In this notice, “Atlas Salus,” “we,” “us,” and “our” refer to the Atlas Salus service; you can reach us about your consumer health data at contact@atlassalus.com.
Why this document exists
The Washington My Health My Data Act and Nevada SB 370 define consumer health data to include information identifying that a person is seeking health care services. No diagnosis, medical record, or HIPAA relationship is required. Because Atlas Salus asks what type of care you are enquiring about, we treat that answer as consumer health data and apply this standard nationwide.
What we treat as consumer health data
- The type of care you are asking about (dental, or your short description if you select “other”)
- The fact that you contacted a healthcare navigation and coordination service
- Your US state of residence, in combination with the above
- Any health-related detail you later provide within a case, which we handle as purpose-limited, restricted-access case data
Why we collect it
Only to provide the coordination service you asked us for: to answer your questions about options and costs, and — if you choose to continue — to obtain information from providers and arrange scheduling and travel on your behalf.
We do not use it for advertising, retargeting, audience building, profiling, or automated decision-making, and we do not sell it. Washington and Nevada both prohibit the sale of consumer health data without a specific signed authorization; we do not sell it and do not seek such an authorization.
Where it comes from
Only from you, through the enquiry form and, later, through what you choose to share within your case. We do not buy it, and we do not infer it from third-party sources.
How we handle consent
We rely on providing the coordination service you requested as the basis for the core handling of your consumer health data. Where we go beyond what is necessary to deliver that requested service — most importantly, before we share your information with a specific named provider — we ask for your separate, specific authorization first, identifying the provider, the information involved, the purpose, and how to revoke it. We do not bury this consent inside a general acceptance of our Terms, and we keep a record of the consent text, its version, and the date, so both sides know what was agreed.
Who we share it with
| Who | What they receive | Why |
|---|---|---|
| The clinic or clinician you authorize us to approach | What is needed to respond to your enquiry | To obtain information and scheduling on your behalf |
| Resend | Your enquiry, to deliver it to us | Email delivery |
| Attio | Your enquiry record | Managing the conversation with you |
| Cloudflare | Site traffic and bot-protection signals | Hosting and spam prevention |
Our analytics provider is deliberately not on this list. Page routes that would reveal which treatment you were reading about are redacted before they leave your browser, visitor IP is stripped, and autocapture and session recording are switched off — so analytics never receive consumer health data at all.
What we do not collect through the public form
No medical records, clinical histories, diagnoses, images, or attachments. The enquiry form has no upload capability and no clinical fields, by design. When documents are genuinely needed within a case, they move through a separate secure channel — never the public form, ordinary email, or a general-purpose CRM.
Retention and deletion
We keep your consumer health data only as long as needed to provide the coordination service and for a limited follow-up period, then delete or de-identify it. You may ask us to delete it at any time; Washington requires deletion to reach our affiliates, processors, and contractors as well, and we pass any deletion request to the recipients listed above, except where a specific legal obligation requires us to retain particular data, which we will tell you about.
Your rights
You may ask us to confirm what consumer health data we hold about you, to give you a copy, to delete it, and to withdraw any consent you previously gave. Withdrawing consent does not undo what was already done with your permission.
To exercise any of these rights, write to contact@atlassalus.com. We verify your identity in a way proportionate to the request and respond within the timeframe the applicable law requires.
How to reach us
Write to contact@atlassalus.com to exercise any right described above, or to ask how we handle consumer health data.