Tool-term guide · With embedded generator

Consumer Health Data Privacy Policy: What WMHMDA Requires

The posted policy every regulated entity needs under RCW 19.373

Washington's My Health My Data Act requires every business that collects or processes consumer health data of Washington residents to post a clear, accessible Consumer Health Data Privacy Policy. Posting is not optional — and "we don't share data" is not an exemption; you still need the policy.

The 5 required disclosures

1. Categories of consumer health data collected — and the sources from which it is collected (directly from the consumer, from devices, from third parties, from advertising partners).
2. The purposes for collecting and sharing consumer health data — specific, not generic.
3. Categories of third parties and affiliates with whom the data is shared — WMHMDA also requires the names of third parties for the sale/sharing list a consumer can request.
4. Rights language — how consumers can confirm collection, access their data, request deletion, withdraw consent at any time, and receive a list of third parties and affiliates their data was shared or sold to.
5. Effective date and change notification — including how consumers will be notified of material changes (your PDFs carry the generation date for exactly this reason).

The posting requirement

WMHMDA requires the policy to be posted in a manner that is clear and readily accessible. Practically, that means a standalone page reachable from everywhere on your site or app — not hidden inside terms of service, and not gated behind an account.

Rights language you must include

The policy should state each consumer right under the statute:

• Confirm whether their consumer health data is collected, shared, or sold;
• Access the consumer health data held about them;
• Have their consumer health data deleted;
• Withdraw consent to collection or sharing at any time;
• Receive a list of third parties and affiliates with whom their data was shared or sold, including contact information;
• Be free from discrimination for exercising these rights.

That rights list is the exact language generated into your policy by the tool below. For the rest of your compliance set — consent, sale authorization, retention schedule, rights form — see the consent form guide or jump straight to the generator.

Generate your policy now

Answer 7 questions and the tool builds your Consumer Health Data Privacy Policy — plus the other 4 WMHMDA documents — from RCW 19.373, with your share list and contact email filled in. Full previews are free; you pay only to unlock PDF + Word export.