Product · Five core draft documents

The WMHMDA Compliance Pack

Five core draft documents commonly used to organize a WMHMDA compliance file — generated for your business, in about 2 minutes, read free before you pay.

If you've confirmed that the Washington My Health My Data Act applies to your business (see does WMHMDA apply to me if you haven't), the next question is simple: what should you have on file? A common starting set is five specific documents, and the WMHMDA Compliance Pack drafts all five, filled in with your business's actual answers, for you and your attorney to review.

What's in the pack

• ✓Consumer Health Data Privacy Policy — the public-facing disclosure of categories collected, sources, purposes, and third parties.
• ✓Opt-in Consent Form — separate consent sections for collection and for sharing, matching RCW 19.373's requirement that they not be bundled.
• ✓Valid Authorization to Sell — a signable authorization if you sell data, or a dated "not applicable" compliance record if you don't.
• ✓Data Retention & Disposal Schedule — your internal governance record, with a step-by-step deletion procedure.
• ✓Consumer Rights Request Form — the consumer-facing intake form for access, deletion, and withdrawal requests.

How it's generated

You answer 7 short questions about your business, your data categories, your sources, your purposes, who you share with, whether you sell data, and your retention/disposal practices. All 5 draft documents are generated instantly in your browser — nothing is uploaded to a server. You can read every document, in full, before paying anything.

Example: what changes based on your answers

Two businesses using this generator get materially different documents. A meditation app that collects only mood and session data, shares nothing, and never sells data gets a lean privacy policy, a single-purpose consent form, and a "not applicable" sale-authorization record. A fitness wearable company that collects heart rate, sleep, and location data, shares with three named advertising partners, and sells aggregated data to a research firm gets a fuller privacy policy with all three sharing categories disclosed, a two-part consent form, and a signable, purchaser-specific sale authorization. Same generator, same 2 minutes — genuinely different, business-specific output.

Legal limitations — read before you buy

This tool generates draft documents based on the text of RCW 19.373 and the answers you provide. It is not legal advice, and it does not replace attorney review — especially if your business has complex data flows, operates across multiple states with different privacy laws, or handles unusually sensitive categories of health data. Documents are dated at generation so you have a clear record of when they were produced.

FAQ