Consumer Health Data Privacy Policy
Effective Date: September 22, 2026 | Last Updated: September 22, 2026
This Consumer Health Data Privacy Policy explains how North Peak Care PLLC ("North Peak Care," "we," "us," or "our") collects, uses, and protects consumer health data as defined by the Washington My Health My Data Act (chapter 19.373 RCW). It supplements our general Privacy Policy. Where this policy addresses consumer health data, this policy controls.
A note on patient information: Patient documents that pharmacies submit through our platform are protected health information governed by the Health Insurance Portability and Accountability Act (HIPAA) and are exempt from the My Health My Data Act. Our HIPAA practices are described in our Privacy Policy and Security Overview. This policy addresses health data that is not covered by HIPAA — principally health documentation submitted by nurses during credentialing.
1. Categories of Consumer Health Data We Collect
We collect the following categories of consumer health data from nurses who enroll in the North Peak network, solely as part of credentialing:
- Immunization and vaccination records
- Tuberculosis (TB) test results
- Other health-related credentialing documentation that a nurse chooses to submit to satisfy pharmacy or industry credentialing requirements (for example, titer results)
We do not collect consumer health data from website visitors. Our website contact forms collect only name, email, phone, and company information, and our website does not use cookies or tracking technologies.
2. Purposes of Collection and How the Data Is Used
We collect and use this data only to:
- Verify that a nurse meets the health-related credentialing requirements needed to perform home infusion visits coordinated through our platform
- Maintain credentialing compliance records as required by our pharmacy partners' requirements and applicable law
We do not use consumer health data for marketing, advertising, or any purpose other than those listed above. We will not collect additional categories of consumer health data, or use consumer health data for additional purposes, without first disclosing this and obtaining your affirmative consent.
3. Sources of Consumer Health Data
We collect consumer health data from one source only: directly from you, when you upload documents to our secure portal.
4. Sharing of Consumer Health Data
We do not sell consumer health data, and we will not sell it.
We do not share your health documents with any third party. Pharmacy partners receive only confirmation that your credentials are complete and current; they do not receive the underlying documents. Access to your health documents is restricted to you and to authorized North Peak Care administrators, and every access is recorded in an audit log.
Service providers (processors): Our data is stored and processed by Google LLC (Google Cloud Platform, Firebase, and Google Workspace), acting as our processor under contractual restrictions consistent with this policy.
Affiliates: North Peak Care has no affiliates with whom consumer health data is shared.
5. Your Rights
Under the My Health My Data Act, you have the right to:
- Confirm and access: confirm whether we are collecting, sharing, or selling your consumer health data, and access that data, including a list of any third parties and affiliates with whom we have shared it and a means of contacting them
- Withdraw consent: withdraw your consent to our collection or sharing of your consumer health data
- Delete: have your consumer health data deleted. If you request deletion, we will delete it from our systems, including archived and backup systems, notify our processors and any third parties with whom the data was shared, and honor the statutory timelines (deletion within 45 days, with the extensions the Act permits for complex requests and archived systems)
Exercising these rights will not result in discrimination. Note that because certain health documentation is required for credentialing, withdrawing consent or requesting deletion may mean you no longer meet the requirements to accept visits through the network; we will tell you if that is the case before completing your request.
6. How to Exercise Your Rights
Email us at scanales@northpeakcare.com from the email address associated with your portal account. We will respond within 45 days. We do not require you to create a new account to exercise your rights.
7. Appeals
If we decline to act on your request, you may appeal by replying to our response with the word "Appeal." Within 45 days of receiving your appeal, we will inform you in writing of any action taken or not taken, with an explanation. If your appeal is denied, you may contact the Washington State Attorney General to submit a complaint at www.atg.wa.gov/file-complaint.
8. How We Protect This Data
Access to consumer health data is restricted to those administrators for whom access is necessary for the credentialing purposes described above. We maintain administrative, technical, and physical safeguards including encryption in transit and at rest, role-based access controls, and audit logging of access. See our Security Overview for details.
9. Changes to This Policy
We will not make retroactive material changes to how we handle consumer health data without your affirmative consent. We will post any updates on this page with a revised effective date.
10. Contact Us
If you have questions about this policy, please contact us:
- Email: scanales@northpeakcare.com
- Website: www.northpeakcare.com