Definitions & scope · Updated 2026
Consumer Health Data Examples Under WMHMDA: The Complete List
"Consumer health data" is the single term that determines whether the Washington My Health My Data Act applies to your business at all — and it's defined far more broadly than most people expect. RCW 19.373 defines it as personal information that is linked, or reasonably linkable, to a consumer and that identifies the consumer's past, present, or future physical or mental health status. Below is every category the statute names, translated into real examples.
In short: "Consumer health data" covers far more than medical records — fitness, sleep, nutrition, reproductive health, mental health, biometric, medication, and health-related location data all count, plus any inference drawn from unrelated data that reveals health status. See the full list below, or generate your privacy policy if any category matches your product.
Read the full category-by-category list
1. Individual health conditions, treatment, and diagnosis data
The most obvious category — but it goes beyond formal diagnoses to self-reported symptoms, treatment status, and disease/diagnosis information a consumer enters into an app, form, or chatbot.
Examples: a symptom-checker app; a chronic-condition management app; a customer-support chat log where a user mentions a diagnosis.
2. Reproductive or sexual health information
Explicitly named in the statute, and one of the most heavily litigated categories nationally given its sensitivity.
Examples: period and ovulation tracking apps; fertility and pregnancy apps; sexual wellness product purchase history; contraception-related content browsing tied to an account.
3. Gender-affirming care information
Examples: hormone therapy tracking, gender-affirming product purchases, or content engagement tied to an identifiable account.
4. Biometric data
Data generated from measuring an individual's biological characteristics, used to identify a specific individual.
Examples: heart-rate monitors, fingerprint or face-based device unlock tied to health features, gait-analysis fitness trackers, voiceprints used in health/wellness voice assistants.
5. Health-related precise location data
Location data specific enough to reveal a consumer's attempt to acquire or receive health care services or supplies.
Examples: GPS pings within a defined radius of a clinic, hospital, or pharmacy tied to a user profile; see our companion piece on the WMHMDA geofencing ban for how this category interacts with location SDKs specifically.
6. Diagnoses, diagnostic testing, treatment, or medication
Examples: medication reminder apps, at-home test-kit result tracking, telehealth intake forms, pharmacy refill history.
7. Biological, genetic, or chromosomal information
Examples: consumer genetic testing results, family health history intake forms, genetic-risk assessments.
8. Data that identifies a consumer seeking health care services
This overlaps with the geofencing and location categories, but also covers non-location signals — such as search queries, appointment-booking behavior, or telehealth session metadata — that reveal someone is seeking care.
9. Any other information processed in a way that identifies past, present, or future health status
The statute's catch-all: data that would ordinarily seem unrelated to health, but that is used or inferred in a way that reveals health status.
Examples that surprise businesses most:
- Fitness and activity data — a running app's pace/distance logs, workout streaks, or calories burned.
- Sleep data — hours slept, sleep-cycle phases, snoring detection from a smart mattress or wearable.
- Nutrition and diet data — calorie tracking, "weight loss" or "muscle gain" goal settings, diet-plan subscriptions.
- Mental health and mood data — mood-journal entries, stress-tracking scores, meditation-app session data tagged with self-reported emotional state.
- Purchase history revealing a health condition — buying products marketed for a specific condition (e.g., "for anxiety," "for menopause," "for diabetes management").
- Inferences from unrelated data — a retailer inferring pregnancy from a shift in purchasing patterns, even without any explicit health-related purchase.
10. Any information derived or extrapolated from non-health information
This is the provision most businesses miss entirely: you don't need to directly collect "health data" to trigger WMHMDA — if you (or a vendor on your behalf) draw an inference about health status from data that looks completely unrelated, that inference itself becomes consumer health data, with all the same obligations attached.
If any of these examples match your product, you need a compliant privacy policy
Generate your Consumer Health Data Privacy Policy, Opt-in Consent Form, Sale Authorization, Retention Schedule, and Rights Request Form in ~2 minutes. Read everything free before you pay — $99.99 one-time.
Generate My Compliance Pack — $99.99FAQ
Is fitness and step-count data considered consumer health data?
Yes — fitness and activity data is explicitly named as a category under WMHMDA.
Does period or fertility tracking data count as consumer health data?
Yes — reproductive/sexual health data, including cycle and fertility tracking, is explicitly covered.
Are inferences about my health status also covered, or only data I directly collect?
Both are covered — inferences drawn from unrelated data that reveal health status are treated the same as directly collected health data.
Does purchase history count as consumer health data?
It can, if it reveals or allows an inference about a health condition.
What consumer help data or consumer health data examples list is required in my privacy policy?
You must disclose the specific categories you actually collect from the statute's list, not a generic catch-all statement.
Is sleep tracking or a smart mattress considered consumer health data?
Yes — sleep data is explicitly named as a category under WMHMDA's definition of consumer health data.
What is considered consumer helth data (a common misspelling of "health data") under the WA law?
The same broad definition applies regardless of spelling: personal information linked to a consumer that reveals physical or mental health status, including fitness, sleep, reproductive, mental health, biometric, medication, and location data, plus inferences.