Consumer Health Data Privacy Notice

This notice describes how Compassion MD, Inc. (“CompassionMD,” “we,” or “us”) collects, uses, and shares Consumer Health Data, as that term is defined under Washington’s My Health My Data Act (RCW 19.373), Nevada’s consumer health data law (NRS 603A.495–540), Connecticut’s Data Privacy Act health data amendments, and any successor or equivalent state law. This notice is separate from our general Privacy Policy, which covers other personal information and Protected Health Information under HIPAA.

What Is Consumer Health Data

Consumer Health Data is personal information that identifies, or is reasonably linkable to, a consumer and that describes or can be associated with that consumer’s past, present, or future physical or mental health status. Under these state laws, this definition is broader than HIPAA’s definition of Protected Health Information. It can include data collected through website tracking technologies even when no clinical care has occurred — for example, identifiers associated with visiting or enrolling on a healthcare subscription website.

Consumer Health Data We Collect

The following table lists all consumer health data currently collected through the CompassionMD™ website and enrollment process. This does not include Protected Health Information created during clinical care, which is governed by HIPAA and described in our general Privacy Policy.

DATA ELEMENT	MECHANISM	PURPOSE	DURATION
PAPVisitorId	Browser cookie	Persistent visitor identifier used to link enrollment events to the referring Affiliate for commission attribution	365 days
PAPCookie_Imp_*	Browser cookie	Records the type of ad impression (raw or unique) associated with an Affiliate referral	365 days
PAPAffiliateId	Browser cookie	Temporarily holds the referring Affiliate’s ID while the referral click is processed	5 minutes

We do not currently operate any analytics platforms (such as Google Analytics), advertising pixels (such as Meta or Google Ads), or other third-party tracking technologies on the CompassionMD™ website. The CareClix platform uses browser storage for application functionality; no browser storage items currently collect consumer health data. If this changes, this notice will be updated before any new collection begins.

How We Collect It

The data elements listed above are collected through browser cookies set by our affiliate referral platform (Post Affiliate Pro, operated by Quality Unit, LLC). These cookies are set when a visitor arrives at compassionmd.com through an Affiliate’s referral link. Cookies are set both on the compassionmd.com domain (first-party) and on the domain where the affiliate platform is hosted (third-party).

Why We Collect It

We collect this data solely to operate our Affiliate referral program — specifically, to attribute a subscriber’s enrollment to the Affiliate who referred them so that the Affiliate receives the correct commission. We do not use this data for advertising, behavioral profiling, or marketing. We do not sell this data.

Who We Share It With

We share consumer health data with one third party:

RECIPIENT	PURPOSE	RELATIONSHIP
Quality Unit, LLC (Post Affiliate Pro)	Operates the affiliate tracking platform that processes the cookies listed above	Vendor / data processor under contract

We do not sell consumer health data to any party. We do not share consumer health data with advertising platforms, data brokers, or any other third party beyond what is listed above.

Consent

Where required by Washington’s My Health My Data Act or similar state laws, we obtain your affirmative opt-in consent before setting the affiliate tracking cookies listed above. These cookies will not be placed on your browser until you consent through our cookie consent mechanism. Consent is not inferred from your general use of the website, acceptance of our Member Agreement, or interaction with a generic cookie banner.

Your Rights

Under Washington, Nevada, Connecticut, and similar state consumer health data laws, you have the right to:

Confirm whether we are collecting consumer health data about you.

Access the consumer health data we hold about you.

Delete your consumer health data, including by directing us to instruct Quality Unit, LLC to delete its copy.

Withdraw consent you have previously given for the collection of consumer health data. If you withdraw consent, the affiliate tracking cookies will be removed and will not be reset.

To exercise any of these rights, contact us at privacy@compassionmd.com. We will respond within the timeframe required by applicable law.

Geofencing

We do not use geofencing technology around any healthcare facility to identify, track, collect data from, or target advertising to consumers. This prohibition applies to CompassionMD™, its Affiliates, and its vendors.

Changes to This Notice

If we add new tracking technologies, analytics platforms, or third-party data recipients, we will update this notice before any new collection begins and, where required by law, obtain your consent before collecting additional consumer health data. Material changes will be communicated by posting the updated notice with a new revision date.

Contact

Questions about this notice or requests to exercise your consumer health data rights:

Email: privacy@compassionmd.com

Mail: Compassion MD, Inc., 950 N. Washington St., Alexandria, VA 22314