Tool-term guide · With embedded generator

WMHMDA Consent Form: What It Must Contain + Generator

The opt-in consent WMHMDA requires before you collect or share consumer health data

Under Washington's My Health My Data Act (RCW 19.373), you cannot collect or share consumer health data without first obtaining the consumer's separate, affirmative opt-in consent. A checkbox buried in your terms of service is not enough — the law requires a distinct consent that is informed, and consent to sharing must be obtained separately from consent to collection.

The 5 things a WMHMDA consent form must state

1. What is collected — the specific categories of consumer health data (fitness, sleep, nutrition, reproductive health, mental health, biometric, medication, health-related precise location, and more).
2. Why it is collected and how it will be used — the specific purposes, not a generic "to improve our services."
3. Who it is shared with — the categories of third parties and affiliates (and, for the privacy policy, their names).
4. How to withdraw consent — a clear, accessible withdrawal mechanism (e.g., contact email), with withdrawal applying to future collection and sharing, and no retaliation for withdrawing.
5. That consent is freely given — providing the product or service must not be conditioned on consent to anything beyond what is strictly necessary.

Withdrawal mechanics

Consumers may withdraw consent at any time, and treatment of the consumer must not be conditioned on consent beyond what is necessary to provide the product or service. You should also treat the withdrawal as a request to stop future collection and sharing — and be ready to handle deletion per your privacy policy and retention schedule.

When you also need a sale authorization

Consent and authorization are different things. If you sell consumer health data — exchanging it for money or anything of value, which WMHMDA defines broadly — you need a separate valid authorization to sell that names the purchaser, lists the data sold, explains the reason and how the purchaser will use the data, includes revocation language, and expires one year after signature. The generator produces this document only when you indicate you sell data.

Generate your consent form now

Answer 7 questions and the tool builds your consent form (plus the other 4 WMHMDA documents) from RCW 19.373 — with your share list and contact email filled in. Full previews are free; you pay only to unlock PDF + Word export.