Consumer health data privacy policy
What health information we collect, why, who receives it, and how you can see it, delete it or withdraw consent.
Who this covers
This policy covers consumer health data that Root Wellness Lab (JT Root) collects through rootwellnesslab.com, our forms and coaching. We publish it to meet Washington’s My Health My Data Act (RCW 19.373), and we apply it to everyone, wherever they live.
Consumer health data means personal information that is linked or reasonably linkable to you and identifies your past, present or future physical or mental health status. For us, that includes things like your health goals, the fact that you take a GLP-1 medication, and what you tell us about your health.
Categories of consumer health data we collect
- Health and wellness goals you select (for example body composition, sleep, energy, gut health).
- Whether you take a GLP-1 medication and which type, where you are with it (for example on one now, planning a change with your prescriber, or stopped) and whether you have a prescriber, if you choose to tell us. We never ask for your dose.
- Yes/no answers to our health check. For example: whether you’re managing a medical condition, take prescription medication, are pregnant or breastfeeding, have type 2 diabetes, or have red-flag symptoms right now. If you have type 2 diabetes, we also ask whether your care team knows you’re working with a coach.
- Eating pattern, eating window, caffeine and sleep habits, and the trackers you use.
- For coaching clients: what you share on calls and in check-ins, and your tracker data (such as protein, fluids, strength sessions, weight trend, waist measurement, strength-habit notes, and wearable sleep, recovery and activity trends). Glucose-monitor data only if you choose to share it and don’t have diabetes or prediabetes.
Why we collect it and how we use it
- To reply to your coaching request and check that coaching is a safe and appropriate fit (for example, to refer you elsewhere if coaching isn’t right for you).
- To prepare for and deliver the coaching you ask for, including reading your trends with you.
- To keep the records we’re required to keep.
We don’t use consumer health data for advertising, and we don’t sell it.
Where it comes from
- Directly from you, through our forms, calls, check-ins and emails.
- From devices or apps you choose to export from (for example a wearable or glucose monitor), only when you send us that data.
Categories of consumer health data we share, and with whom
We share consumer health data only as needed to provide the service you asked for. The categories shared are the ones listed above, as needed for each provider’s job. We share it with these categories of third parties, which act as our processors:
- Web hosting: DreamHost (receives form submissions).
- Business email: Zoho Mail (delivers form submissions and our emails with you).
- Business documents and spreadsheets: Zoho Workplace (store intake notes, check-ins and the shared tracker).
- Video calls: Cal Video, by Cal.com (carries live calls; we don’t record calls without your separate permission).
We don’t share consumer health data with any affiliate. Our payment processor (Stripe), Cal.com’s scheduling and our spam-check provider (Cloudflare) don’t receive consumer health data. Calendar and payment items are named without reference to any medication or condition, and we don’t send these providers your health answers. If we ever want to share consumer health data for any other purpose, we’ll ask for your separate consent first.
Consent
We ask for your consent before we collect consumer health data. The request comes before any health question on the coaching request form and the GLP-1 coaching application, and again in the coaching agreement. That consent request tells you what we collect, why, who receives it, and how to withdraw. You can withdraw consent at any time by emailing jt@rootwellnesslab.com. Withdrawing consent means we stop collecting your consumer health data, and it may mean we can’t continue coaching.
Your rights and how to use them
- Confirm and access: ask whether we collect, share or sell your consumer health data, and get a copy of it, plus a list of the third parties we’ve shared it with and how to contact them.
- Withdraw consent to our collecting and sharing it.
- Delete: ask us to delete it. We’ll delete it from our systems and tell our processors to delete it too. Backup copies are deleted within 6 months.
To make a request, email jt@rootwellnesslab.com from the address you used with us. We may ask for information we reasonably need to confirm it’s you. You don’t need to create an account. Requests are free at least twice a year.
We respond within 30 days of receiving your request, and we complete deletion requests within those 30 days.
Appeals: if we decline your request, reply to our answer with “appeal” in the subject line. We’ll decide within 45 days and explain why. If we deny your appeal, you can contact the Washington State Attorney General’s Office to submit a complaint (atg.wa.gov). Residents of other states, such as Nevada and Connecticut, can contact their own state Attorney General.
We won’t treat you differently for using any of these rights.
How we protect it
Root Wellness Lab is not a HIPAA covered entity (it doesn’t bill health insurance), so HIPAA doesn’t apply to the information you share. It’s protected as described in our privacy policies and by state consumer health privacy laws.
Form submissions travel over HTTPS. Coaching request records kept on the web host contain no health details. Coaching records are kept in accounts protected by strong passwords and two-step verification. Our intake doesn’t ask for detailed medical history; that’s covered privately on a call.
Contact
Email jt@rootwellnesslab.com, or write to Root Wellness Lab, PO Box 853, Hood River, OR 97031.