Scope & applicability · Updated 2026
Does WMHMDA Apply to Me? A Step-by-Step Decision Guide
Of everything we hear from founders and small-business owners about the Washington My Health My Data Act, the single most common line is: "I didn't think this applied to a company our size." It's an understandable assumption — most privacy laws exempt small businesses. WMHMDA (RCW 19.373) does not. Below is the exact four-question test to find out where you stand, with real examples, citations, and a free scope report at every step.
In short: You're likely covered if you (1) have any Washington-resident users, (2) collect data that reveals or lets you infer health status, and (3) decide how that data is used — with (4) no small-business, revenue, or headcount exemption. Use the decision tree or scope report below for your specific answer, or generate your documents if you already know you're covered.
The WMHMDA applicability decision tree
Get your free 60-second scope report
Answer the same four questions below and we'll show you an instant, personalized scope summary — no email, no signup required. This is an educational screening tool, not a legal determination.
1. Do you have any Washington-resident users or customers?
2. Could your data reveal or let you infer a health status (fitness, sleep, mental health, reproductive health, biometric, medication, etc.)?
3. Do you (not a client you process data for) decide why and how that data is used?
4. Is any of your data covered by a specific exemption, such as HIPAA-protected health information — or are you unsure?
Read the full explanation of each question
Question 1: Do you process personal information about an identified or identifiable consumer? (RCW 19.373 — definitions)
"Consumer" under WMHMDA means a Washington resident acting in an individual or household context — not someone acting in an employment or commercial (B2B) context. If you have zero Washington-resident users or customers, you can generally stop here. But note: you don't need to be based in Washington, market specifically to Washington, or even know where a given user lives — if your app or service is available nationally or globally and even a handful of your users are Washington residents, this question is answered "yes."
Question 2: Does that personal information reveal (or let you infer) something about physical or mental health status? (RCW 19.373 — "consumer health data" definition)
This is the question most businesses get wrong, because WMHMDA's definition of "consumer health data" is much broader than "medical records." It explicitly includes:
- Fitness and exercise data (step counts, workout logs, heart-rate zones)
- Sleep tracking data
- Nutrition, diet, and weight-management data
- Reproductive or sexual health data — including period and fertility tracking
- Mental health, mood, and stress-tracking data
- Medication use, dosage, or adherence data
- Biometric data (heart rate, gait, fingerprint, voiceprint)
- Precise geolocation data that could reveal an attempt to receive health care services (e.g., visiting a reproductive health clinic)
- Any inference — even one you generate yourself from unrelated data — that reveals health status
Real examples that surprise people: a running app that logs pace and heart rate. A meal-planning app that tracks calories for "weight loss." A meditation or sleep-sound app that logs session times and self-reported mood. A supplement store that lets customers filter products by "for anxiety" or "for menopause" and stores that browsing/purchase history against an account. All of these collect consumer health data under WMHMDA's definition, even though none of them are hospitals or clinics.
Question 3: Are you the one deciding why and how that data is processed? (RCW 19.373 — "regulated entity" definition)
WMHMDA applies to "regulated entities" — any legal entity that conducts business in Washington or produces products or services targeted to Washington residents, and that alone or jointly determines the purpose and means of collecting, processing, sharing, or selling consumer health data. If you're a solo founder deciding what your app tracks and why, you meet this test. Being a small vendor that merely processes data on someone else's exact instructions may put you in a narrower "processor" role with a different set of duties — but in practice, most direct-to-consumer apps, sites, and product businesses are themselves the regulated entity, not a processor.
Question 4: Is any of your data covered by a specific exemption — for example, HIPAA? (RCW 19.373 — narrow activity-specific exemptions; no general small-business exemption)
This is the question people most often confuse with "am I too small to matter" — and it isn't the same question. WMHMDA has no general small-business exemption, no revenue threshold, and no employee-count threshold, so company size alone never gets you out of scope. What can narrow your obligations is a specific, activity-based exemption — most commonly, data that is already regulated as protected health information under HIPAA, in the specific context where HIPAA actually applies to that data (for example, a covered health care provider's own patient records). If none of your data falls under a recognized exemption like that, or you're not sure, treat yourself as in scope and get an attorney's confirmation on the exemption question specifically — don't rely on "we're small" as a substitute.
If you answered "yes" to questions 1–3 and no specific exemption applies to Q4, WMHMDA likely applies to you
This is an educational screening result, not a legal determination. Generate your Consumer Health Data Privacy Policy, Opt-in Consent Form, Sale Authorization, Retention Schedule, and Rights Request Form in ~2 minutes. Read everything free before you pay — $99.99 one-time.
Generate My Compliance Pack — $99.99Quick reference: business types that are typically in scope
- Fitness, workout, and step-tracking apps — see WMHMDA for fitness apps
- Meditation, sleep, and mental-wellness apps — see WMHMDA for wellness apps
- Period, fertility, and reproductive health trackers
- Nutrition, diet, and calorie-tracking apps
- Wearable device makers and their companion apps
- Direct-to-consumer supplement, vitamin, and wellness product brands with health-related browsing/purchase profiles
- Telehealth-adjacent marketing sites, symptom checkers, and health content platforms that collect user data — see WMHMDA for telehealth-adjacent services
- Any app or website using location SDKs that could reveal visits to health care facilities — see WMHMDA analytics & SDKs
What to do once you know WMHMDA applies
Once you've confirmed you're in scope, RCW 19.373 requires a specific set of documents and practices: a posted Consumer Health Data Privacy Policy, opt-in consent before collection (and a separate opt-in before sharing), a valid signed authorization before any sale of data, a documented retention/disposal schedule, a consumer rights intake process, and a ban on geofencing around health care facilities. See our WMHMDA Compliance Map for the full provision-by-provision breakdown, our complete WMHMDA compliance guide, or the free 12-point checklist to self-audit where you stand today.
FAQ
Does WMHMDA apply to businesses outside Washington State?
Yes — it's based on whose data you process (Washington residents), not where your company is headquartered.
Is there a small business or startup exemption from WMHMDA?
No. There is no revenue threshold, employee-count threshold, or general small-business carve-out.
What counts as "consumer health data" under WMHMDA?
A broad category including fitness, sleep, nutrition, reproductive/sexual health, mental health, biometric, medication, and health-related location data, plus inferences that reveal health status.
Does washington my health my data act apply to my ecommerce store?
If your store collects health-related browsing, purchase, or biometric-sizing data tied to a Washington customer, it likely applies.
I don't sell or share data with anyone — does wmhmda still apply?
Yes. Simply collecting consumer health data already triggers the privacy policy and consent requirements, independent of sharing or selling.
Does the wa health data act apply to a solo founder with no employees?
Yes. There's no headcount threshold — a solo founder processing even a small number of Washington residents' consumer health data is in scope.
Does whmda or wmhda (common misspellings of WMHMDA) apply to my app?
If you're looking for the "Washington My Health My Data Act" (sometimes mistyped as WMHDA, WHMDA, or MHMDA), the applicability test is the same regardless of how the acronym is spelled: it depends on the data you collect, not your business type or size.