Washington My Health My Data Act
Consumer Health Data Privacy Policy
This policy applies to Washington consumers and is published under the Washington My Health My Data Act (RCW 19.373). It is separate from, and in addition to, ourHIPAA Notice of Privacy Practices and ourWebsite Privacy Policy.
Scope of this policy
The My Health My Data Act governs "consumer health data" that is not already protected as HIPAA-regulated health information. Most information we hold about our patients — your chart, your treatment records, your clinical photographs — is HIPAA-protected health information, and theNotice of Privacy Practices governs it.
This policy governs consumer health data collected outside that relationship: for example, information collected when you browse our website, submit an inquiry form, or interact with our marketing before you become a patient.
Categories of consumer health data we collect
| Category | Examples | Purpose |
|---|---|---|
| Inquiry and interest data | Treatment you asked about in a contact or consultation-request form; free-text notes you write in that form | To respond to your inquiry and schedule a consultation |
| Appointment request data | Requested service, requested provider, requested date | To schedule and confirm your appointment |
| Contact identifiers linked to the above | Name, email, phone, ZIP | To contact you about your inquiry |
| Communication preferences | Whether you consented to email or SMS | To honor your consent and opt-out choices |
What we do not collect
- We do not use advertising pixels, conversion tracking, or third-party analytics tags on our booking pages or on any page where a treatment is identified.
- We do not build advertising audiences from your treatment interest or browsing.
- We do not upload patient or lead lists to advertising platforms.
- We do not infer health conditions from your location data.
Sources of consumer health data
- Directly from you, through forms, phone calls, email, and text messages you send us.
- From our appointment and booking platform when you request an appointment.
- We do not purchase consumer health data from data brokers.
How we share consumer health data
We share consumer health data only with service providers who process it on our behalf, under written contract, and only for the purposes described above. As of the effective date, those categories are:
| Category of third party | Named affiliate or vendor | Purpose |
|---|---|---|
| Booking and point-of-sale platform | Boulevard — confirm entity name | Appointment scheduling and confirmations |
| Clinical charting | Aesthetic Record — confirm entity name | Clinical records (HIPAA-covered once you are a patient) |
| Website and forms hosting | Hosting provider — complete | Operating the website and receiving form submissions |
| Email and SMS communications | Messaging platform — complete | Sending appointment and inquiry communications you consented to receive |
| Affiliated management entity | BB MSO LLC | Administrative and management services for the practice |
We do not sell consumer health data. We do not, and will not, sell consumer health data as "sale" is defined in RCW 19.373.010. Should that ever change, we would first obtain your separate, valid, signed authorization — distinct from any consent to collect or share — containing the disclosures the Act requires, and you could revoke it at any time.
Analytics and tracking technologies
The studio site uses Google Analytics 4 (gtag.js, property G-BGMZDLX8BT) with Google Consent Mode v2 set to denied by default. No analytics cookies are set and no events are sent until you affirmatively accept through our cookie banner; advertising storage, ad user data, and ad personalization remain denied in all cases. Google Analytics is not loaded on the Embrace telehealth referral page. We do not run Meta, TikTok, Google Ads, or other advertising pixels, and we do not run session-recording or website-chat tools. Analytics events record page paths and interaction names only — never form contents, treatment selections tied to your identity, appointment details, or any contact identifier. You can change or withdraw your choice at any time using Cookie Settings in the site footer.
Consent
We collect and share consumer health data only with your consent, or as strictly necessary to provide a product or service you have requested from us. Consent is requested separately from any other terms, is never bundled, is never obtained through a pre-checked box, and may be withdrawn at any time by emailing privacy@botanica-beauty.com or using our Privacy Requests page. Withdrawal applies going forward and does not affect processing already completed. We record the wording shown to you, the date and time, and the page or form on which consent was given.
Retention
We keep consumer health data only as long as needed for the purpose it was collected. Website inquiry and appointment-request data is retained for retention period — confirm with counsel and then deleted or de-identified, unless you ask us to delete it sooner or we must keep it to meet a legal obligation. Once you become a patient, your clinical record is HIPAA-protected health information and is retained under Washington law and our Notice of Privacy Practices, not under this policy.
Your rights under the My Health My Data Act
If you are a Washington consumer, you have the right to:
- Confirm and access whether we are collecting, sharing, or selling your consumer health data, and to access that data, including a list of all third parties with whom we have shared it and an active contact for each.
- Withdraw consent to our collection and sharing of your consumer health data.
- Delete your consumer health data. On a valid request we will delete it from our records, including archived and backup systems, and notify all affiliates, processors, contractors, and third parties who received it.
- Appeal a denial of any of these requests.
- Be free from discrimination or denial of service for exercising these rights.
How to exercise your rights
Email privacy@botanica-beauty.com or write to Privacy Officer, Botanica Beauty PLLC, 12611 Northup Way, Suite 220, Bellevue, WA 98005, or call (425) 543-6060. We respond within 45 days and may extend once by 45 days where reasonably necessary, with notice to you. There is no charge for the first two requests in a twelve-month period.
We will verify your identity before acting on a request. If we cannot verify you, we will tell you why and what additional information would allow us to proceed.
Appeals
If we decline a request, we will explain why and how to appeal. Submit appeals toprivacy@botanica-beauty.com with "MHMD Appeal" in the subject line. We respond to appeals within 45 days. If we deny your appeal, you may contact the Washington State Attorney General's Office atatg.wa.gov/file-complaint.
Geofencing
We do not use a geofence around any health care facility, and we will not use one to identify, track, collect data from, or send messages or advertisements to consumers based on their proximity to health care services.
Changes to this policy
If we materially change how we collect, use, or share consumer health data, we will update this policy, change the effective date above, post a notice on this page and on our home page, and obtain your consent before applying the change to data already collected where the law requires it.
Contact
Privacy Officer, Botanica Beauty PLLC, 12611 Northup Way, Suite 220, Bellevue, WA 98005 · privacy@botanica-beauty.com · (425) 543-6060 · See Privacy Requests & Complaints.