This Consumer Health Data Privacy Notice describes how AITALITY, LLC (“AITALITY,” “we,” or “us”) collects, uses, shares, and protects consumer health data, and the rights you may have in that data under Washington’s My Health My Data Act, Nevada’s consumer health data law, and similar state laws. It supplements the AITALITY Privacy Policy. Where this Notice provides additional rights or protections for consumer health data, this Notice controls.
AITALITY helps health care professionals organize and share their own professional credentialing information. We do not seek health information, but documents and forms you upload or complete for credentialing may contain it. Do not upload patient records or health information about any other person.
1 Consumer health data we collect
Depending on what you upload or enter, we may collect the following categories of consumer health data:
- immunization and vaccination records and titers;
- tuberculosis testing, drug screening results, and other occupational-health or employee-health records;
- fitness-for-duty statements and health attestations;
- disability, accommodation, or health-related disclosures, and answers to health-related questions on credentialing applications or forms; and
- other information in your documents that identifies, or could reasonably be linked to, your past, present, or future physical or mental health status.
We do not derive or infer health status from other information, and we do not collect precise geolocation information to identify attempts to acquire or receive health care services.
2 Why we collect and use it
We collect and use consumer health data only as reasonably necessary to provide the features you request, or with your consent. These purposes are:
- storing, organizing, classifying, and displaying your credentialing documents in your account;
- extracting information such as issue and expiration dates and sending you renewal reminders;
- prefilling credentialing applications and forms at your request;
- sharing documents and information with the recipients you choose;
- securing the Services, preventing fraud and misuse, and providing customer support; and
- complying with law and responding to valid legal process.
We do not use consumer health data for advertising or marketing, and we do not use identifiable consumer health data to train or fine-tune artificial-intelligence models.
3 Sources of consumer health data
We collect consumer health data directly from you, from organizations or people you authorize to provide it (such as an employer’s occupational-health or credentialing staff), and from third-party services you connect or ask us to query.
4 Consumer health data we share and with whom
We may share any of the categories of consumer health data listed in Section 1 only as reasonably necessary for the purposes in Section 2, with the following categories of recipients:
- Processors and service providers that host, store, secure, or process data on our behalf, including cloud hosting, document processing, optical character recognition, artificial-intelligence, security, and customer-support providers. They may use the data only to provide services to us and are prohibited from using it to train their own models.
- Recipients you direct, such as hospitals, employers, staffing organizations, payers, credentialing bodies, licensing boards, and anyone who can use a sharing link you create.
- Third-party services you connect, when you connect an account, request a verification, or direct an export.
- Government authorities, courts, and law enforcement, when required by law.
AITALITY does not share consumer health data with affiliates. We do not sell consumer health data.
5 Consent
When you upload a document or complete a form that contains consumer health data, you are asking us to store and process it to provide the feature you are using. When you share information through the Services, you are directing us to disclose it to the recipient you select. If we ever want to collect or share consumer health data for any other purpose, we will ask for your separate consent first, and we will not process it for that purpose unless you agree. You may withdraw consent at any time as described in Section 6.
6 Your rights
Depending on where you live, you may have the right to:
- confirm whether we collect, share, or sell your consumer health data, and access that data;
- receive a list of all third parties and affiliates with which we have shared your consumer health data, along with an email address or other online way to contact them;
- withdraw your consent to our collection and sharing of your consumer health data;
- have your consumer health data deleted, including from our archives and backups; and
- appeal our decision on your request.
You can review and update most of your information directly in your account. To make a request, email privacy@aitality.com and state your state of residence. We will verify your identity using information associated with your account and may ask for more information when reasonably necessary. An authorized agent may submit a request where permitted, but we may require proof of authority and confirm your identity directly.
We will respond within 45 days of receiving your request. We may extend this by another 45 days when reasonably necessary, and we will tell you if we do. Requests are free of charge at least twice per year, except where the law allows us to decline or charge a fee for requests that are manifestly unfounded, excessive, or repetitive.
When we delete consumer health data at your request, we will delete it from our active systems and from archives and backups within the time required by law, and we will notify our processors and any third parties with which we shared it so they delete it as well.
If we deny your request, you may appeal by replying with “Privacy Appeal” and explaining the basis for your appeal. We will respond to your appeal within 45 days. If we deny your appeal, you may contact your state attorney general, including the Washington State Office of the Attorney General or the Nevada Attorney General.
We will not discriminate against you for exercising these rights.
7 Geofencing and online tracking
We do not use geofences around health care facilities, and we do not allow third parties to collect consumer health data about your online activities over time or across other websites or online services through the Services.
8 Security and retention
We protect consumer health data with the administrative, technical, and organizational safeguards described in the Privacy Policy and limit access to personnel who need it to provide the Services, maintain security, or comply with law. We retain consumer health data as described in the Privacy Policy’s retention section.
9 Changes to this Notice
We will post any update to this Notice with a new effective date. If we materially change how we collect, use, or share consumer health data, we will notify you before the change takes effect and obtain your consent where required by law.
10 Contact us
AITALITY, LLC
Privacy requests and questions: privacy@aitality.com