Consumer health data

How you lost the weight, your BMI, and complications are optional. This page is the notice for that information. It stands next to the privacy page because Washington’s My Health My Data Act asks for a consumer health data notice that is separate from a general privacy policy. A lawyer still has to review this page before launch.

What you can choose to share

Nothing in this list is required to submit a price. If you fill any of it in, it is health information:

• How the weight came off, and about how many pounds.
• BMI at the time of surgery, and a height band rather than an exact height.
• How many months your weight had been stable, and whether you had bariatric surgery.
• Complications you describe, and a rating of the medical result.

We do not ask for your name, photographs, medical records, a ZIP code, or the day of the surgery.

Stored on its own record

Those fields live only on a separate health record attached to the price report. The price report does not carry them. Leave the health questions blank and that record is never created. Delete the health record later and the price datapoint stays, which is the point of keeping them apart.

Consent is separate from the price

Publishing a price has its own agreement. Collecting health information has another, and showing that information in anonymised, aggregated form has a third. Ticking the price box does not tick the health boxes.

If health fields are filled in without the health-collection consent, the submission is rejected. We do not keep them on the side. Your price can still be published if you share no health information at all. When you do share it, we ask for an email so we can send the link you will need to delete it later.

We do not sell it

We do not sell consumer health data. We do not share it with data brokers, and we do not pass it to advertising networks. If we ever change that, we will ask you again rather than quietly updating this page.

Analytics

Health fields never appear in an analytics event. Not hashed, not bucketed, not shortened into a category. The pages where you submit or manage a report carry no third-party scripts — no advertising pixel, no session recording, no tag manager.

Geography stops at a region or a country

We take a US region or a country, and the month and year of surgery. We do not take a city, a ZIP code, a street address, or the day. A ZIP code would let someone work out which patient a report belonged to, so we never collect it. The surgeon directory still lists a practice’s city, because that is a public address, not a patient’s location.

How to delete it

Open the manage link from your confirmation screen, or from the email we sent if you gave us an address. From edit or delete my submission you can remove the health record and leave the price up, or remove the whole submission. No account is required.

Lost the link? Email [email protected] from the address you submitted with. We will delete it by hand within 24 hours. We cannot look your submission up by email alone — we only keep a hash — so we will ask you to confirm a couple of details first.

How long other pieces are kept

Health details stay until you delete them. They are not on a timer. These windows cover the rest of a submission, and they are the ones the retention job actually enforces:

• A salted hash of your IP address is kept 30 days, then cleared. It is there to stop one person flooding the site. We cannot reverse it.
• The email address, in a form we can send mail to, is deleted after 90 days. A hash can remain on a verified submission so the same report is not counted twice.
• An uploaded invoice is kept 30 days, then the file is deleted.

Before launch

A lawyer has not reviewed this page, and has not signed off on it. That review still has to happen before launch. Until then, this notice describes how the site is built.

Questions: [email protected]. The broader account of what we collect is on the privacy page.