Who is responsible under WMHMDA, the franchisor or the franchisee?

It depends on who determines the purpose and means of processing the consumer health data. Where the franchisor mandates the intake forms, booking platform and CRM and receives the data centrally, the franchisor is likely to be a regulated entity in its own right. Where a franchisee independently collects and controls data locally, responsibility may sit with them. Many systems produce shared or overlapping responsibility, which is why franchise groups should address this in the franchise agreement and the data processing terms rather than leaving it ambiguous.

Does a physical Washington location increase legal risk compared with just having online customers?

In practical terms, generally yes. Applicability under the statute does not depend on physical presence, but enforceability does. A business with premises, staff, bank accounts and assets in Washington is straightforward to serve and to collect a judgment against, whereas pursuing a purely out-of-state or overseas business involves jurisdictional and enforcement hurdles. A Washington location removes those hurdles, which makes a physical operator a more attractive defendant.

We only have one Washington site out of many. Do we need separate documents for it?

You could maintain a Washington-specific notice and consent flow, but most multi-site operators find that impractical because intake forms, booking systems and marketing are shared across locations. The more common approach is a single consumer health data privacy notice and consent process applied group-wide, which satisfies Washington and avoids staff at other sites having to remember a different procedure.

Does WMHMDA apply to our central CRM if only one location is in Washington?

To the extent that CRM holds consumer health data relating to Washington consumers, yes. Centralised systems are a common source of unrecognised exposure for multi-site groups because data from the Washington location flows into the same database, analytics stack and marketing tools as everywhere else, and those downstream transfers may amount to sharing or selling under the act.

Chains, franchises & multi-site groups · Updated 2026

WMHMDA for Multi-Location & Franchise Businesses

Q: Does one Washington location put my whole chain in scope for WMHMDA?

For the consumer health data collected from Washington consumers, yes. WMHMDA applies to entities that conduct business in Washington or target products and services to Washington consumers, and operating a physical location in the state clearly satisfies that. In practice, because most chains run one shared intake form, booking system and CRM across all sites, the compliant approach is usually to bring the whole group's process up to standard rather than treat the Washington site as a separate regime.

One Washington location is enough — and a physical presence makes you a far easier defendant than a web-only business

If you run gyms, clinics, med-spas, physiotherapy practices, veterinary groups, salons, pharmacies or retail across several states, and one of them is in Washington, WMHMDA is your problem — not a Washington-specific footnote for that one site's manager to worry about.

In short: A single Washington location puts the consumer health data you collect there squarely in scope, and because your intake forms and CRM are almost certainly shared group-wide, the practical fix is one compliant process everywhere. Physical presence also makes you materially easier to sue than an out-of-state web business. Generate your documents or check your scope free.

Why this page exists: most WMHMDA coverage is written for apps and software companies. Multi-site physical operators tend to assume a privacy statute aimed at data collection doesn't describe them — while running exactly the intake forms, health questionnaires and booking systems that it does.

Read the full guide for multi-location operators

The enforceability point, stated plainly

This is the part that distinguishes you from the out-of-state web businesses most WMHMDA content addresses, and it's worth being direct about.

Applicability under the statute doesn't turn on physical presence — a company with no Washington footprint can be fully in scope, as our outside-Washington guide explains. But enforceability is a separate question from applicability, and that's where premises change the picture. A business with a Washington location has staff, a lease, bank accounts, equipment and revenue inside the state. It's trivially easy to serve, plainly within the jurisdiction of Washington courts, and straightforward to collect a judgment against.

Compare that with a plaintiff pursuing a business in another country with no US assets: jurisdiction has to be established, service made abroad, and any judgment enforced in a foreign court. That's slow and expensive, which is why it rarely happens for small claims.

The practical consequence is uncomfortable but useful to know: as a multi-site operator with a Washington presence, you are a more realistic defendant than a much larger overseas company doing the same thing. Not because the law treats you differently, but because you're reachable.

Where multi-site groups actually collect consumer health data

Almost always in systems that were adopted for operational convenience, not designed with a privacy statute in mind:

Standardised intake and waiver forms — injury history, medical conditions, medications, pregnancy, allergies. Whether on a clipboard or a tablet, this is consumer health data.
Central booking and scheduling platforms — appointment types alone can reveal health status. A booking labelled "physiotherapy — lower back" or "fertility consultation" is health data regardless of what else the record contains.
The group CRM and loyalty database — where every location's customer records converge, usually with notes fields nobody audits.
Membership and cancellation records — medical freezes, injury-related suspensions and health-based cancellation reasons.
In-location assessments — body composition scans, biometric screenings, skin analysis, fitting consultations.
Group-wide marketing tools — email platforms and ad pixels segmenting by condition, treatment type or health interest. This is often the largest and least-visible exposure. See analytics & SDKs.

The franchisor / franchisee question

Franchise systems produce the messiest version of this, because responsibility follows control rather than the sign above the door. The relevant question is who determines the purpose and means of the processing.

Franchisor-controlled systems. If head office mandates the intake form, supplies the booking platform, and receives customer data into a central CRM, the franchisor is likely a regulated entity in its own right — not merely a vendor to its franchisees.
Genuinely independent franchisees. Where a franchisee chooses its own systems and controls its own data locally, responsibility may sit primarily with them.
The common reality: both. Most systems are hybrid, and overlapping responsibility is the normal outcome rather than an edge case.

The failure mode we'd flag is the assumption on each side that the other has handled it. Franchise agreements and data processing terms should say explicitly who is responsible for the notice, for obtaining consent, for responding to consumer requests within the statutory window, and for indemnity if something goes wrong. This is a genuine legal-drafting task, not a template exercise — worth counsel time if your system has any real scale.

Why a Washington-only process usually fails in practice

The instinct is to treat Washington as an exception: a special notice at that one site, a different consent checkbox, business as usual elsewhere. It rarely survives contact with operations.

Your intake form is printed or configured once. Your booking platform has one settings screen. Your CRM has one schema. Your email tool has one template library. Staff transfer between locations, and customers of a multi-site brand routinely visit more than one — a Portland member using your Seattle location is a Washington consumer for that visit.

Maintaining a genuine two-track process across shared systems and rotating staff is usually more expensive and more error-prone than simply raising the whole group to the Washington standard. Washington's requirements are broadly the strictest currently in force, so a group-wide process built to it also positions you well for Nevada and Connecticut, and for whichever state legislates next.

Example: a five-location fitness group with one Seattle site

A group operates five studios — four in Oregon, one in Seattle. All use the same tablet intake form asking about injuries, medical conditions and pregnancy; the same booking platform; the same central CRM; and one email marketing tool that segments members by injury-recovery programme for targeted campaigns. Head office assumed WMHMDA was "a Washington thing" for the Seattle manager to look at.

In reality the group needs: a consumer health data privacy notice, distinctly linked and covering the intake data, scans and booking records; unbundled opt-in consent before the health questions on the intake form are submitted, not buried in the membership agreement; a documented position on the marketing segmentation, since sending condition-based segments to an ad platform can amount to sharing or selling; a retention schedule covering how long intake records persist after cancellation, including in backups; and a rights-request process that any location's front desk can actually execute within the statutory window.

None of that is Seattle-specific in operational terms. It's one set of documents and one process applied across all five sites.

A sensible order of work

Map where health data enters the group. Intake forms, bookings, assessments, cancellations, marketing. Usually more places than expected.
Follow it downstream. Which vendors, pixels, analytics tools and partners receive it? Downstream transfers are where "sharing" and "selling" obligations bite.
Fix the intake point first. Consent has to be obtained at collection; retrofitting it later is much harder than getting the form right now.
Produce the documents. Notice, consent, sale authorization where relevant, retention schedule, rights-request process.
Make the front desk capable. A rights request arriving at any location has to reach someone who can action it inside the statutory window — this is an operational problem more than a legal one.
Get the franchise or group agreements reviewed if responsibility is genuinely shared. Templates don't allocate liability between entities; lawyers do.

One process, all your locations

The generator produces five draft documents from a short questionnaire — privacy policy, consent form, sale authorization, retention schedule and rights request form — built around how your group actually collects and shares data. Read every one in full, free, before deciding to pay.

Generate My Compliance Pack — $99.99

Not sure you're in scope? Run the free scope check first →

Scope & limitations of this page

This is general guidance for multi-site and franchise operators, not legal advice, and it does not create an attorney-client relationship. Allocating responsibility between a franchisor and franchisees, or between group entities, is a fact-specific legal question that depends on your agreements and your actual control over data — a document generator cannot resolve it and should not be relied on to. Our comments on enforceability describe general practical dynamics, not a prediction about any particular dispute. If your group has meaningful scale or shared responsibility, have the arrangements reviewed by an attorney licensed in Washington.

FAQ

Does one Washington location put my whole chain in scope?

For consumer health data collected from Washington consumers, yes. And because intake forms and CRMs are typically shared group-wide, the practical answer is usually to raise the whole group to standard rather than run a Washington exception.

Is the franchisor or the franchisee responsible?

It follows control. If head office mandates the systems and receives the data, the franchisor is likely a regulated entity itself. Independent franchisees may hold their own responsibility. Overlap is common — address it in the franchise agreement.

Does a physical Washington location increase our risk?

Practically, yes. Applicability doesn't depend on presence, but enforceability does — premises, staff and assets in-state make you easy to serve and collect against, unlike a purely out-of-state or overseas business.

Can we keep separate documents just for the Washington site?

You can, but shared intake forms, booking platforms, CRMs and rotating staff usually make a two-track process more expensive and error-prone than one group-wide standard.

Does our central CRM fall in scope if only one site is in Washington?

To the extent it holds consumer health data about Washington consumers, yes. Central systems are a frequent source of unrecognised exposure because data converges there and flows onward to analytics and marketing tools.

What if we're planning to open a Washington location?

Better timing than most people get. Building the intake form, consent flow and rights process correctly before launch is considerably cheaper than retrofitting consent onto records you've already collected.