Washington Consumer Health Data Privacy Policy.

Introduction and scope

This Washington Consumer Health Data Privacy Policy (“CHD Policy”) describes how PsyBird.ai, operated by Any Percent LLC (“PsyBird,” “we,” “us,” or “our”), collects, uses, shares, and protects “consumer health data” as defined by the Washington My Health My Data Act, RCW 19.373 (“MHMDA”). It applies to consumers who are Washington residents and to consumers whose consumer health data is collected in Washington.

What this policy does not cover. This CHD Policy applies only to consumer health data governed by MHMDA. It does not apply to protected health information (PHI) that we handle for a licensed practice under HIPAA and a Business Associate Agreement (that information is described in the practice's HIPAA Notice of Privacy Practices) or to other information exempt from MHMDA (including information governed by HIPAA, and employment-related data). Because most client clinical data in PsyBird is PHI handled under HIPAA, this policy chiefly covers consumer health data collected outside the HIPAA relationship: what you tell us when you ask us to find you a clinician (a therapist or a physical therapist) on psybird.ai/match, health-related information from website visitors, and anything health-related you write to us before a practice's care relationship and BAA attach.

1. Categories of consumer health data we collect

“Consumer health data” is personal information linked or reasonably linkable to a consumer that identifies the consumer's past, present, or future physical or mental health status, including information derived or extrapolated from non-health data. We collect the following categories:

• That you are looking for mental health care or physical therapy, and what you tell us in the request form. When you send a request on psybird.ai/match we collect your name, your email address, the state you live in, whether you want to meet by video or in person, your zip code when you want to meet in person or either way, when you are free, whether you plan to use insurance or pay yourself, the name of your health plan if you give it, and anything else you write. For therapy we also collect what has been going on (the topics you tick and anything you write about it), whether you have seen a therapist before, and what you would like in a therapist. For physical therapy we also collect where it hurts and on which side, how it started and how long ago, the date of any surgery, what you want to get back to, whether you have a doctor's referral, and whether you have Medicare. We also record that you said you are 18 or older and that you gave the two consents the form asks for. We use this to find a licensed clinician in your state who can take you on.
• A summary and flags that our software derives from your request. When you confirm your request from the link we email you, our software uses an AI model to write a short summary of what you are looking for for the clinician to read, and for the clinic they work within, if any (for physical therapy, also a suggested description of the problem, such as the body area and how long it has hurt). It records a safety flag when your words suggest you may be in crisis or facing a medical emergency: a check of your words when you send the form, which also shows you the 988 crisis line or tells you to call 911, and the AI model when you confirm. It also notes when a request reads as if it came from someone under 18, in which case we do not pass it on and we email you to say so. Our software does not score how well any clinician fits you and does not rank clinicians: a fixed rule, described in Section 5, decides who receives your request. These are information about your health that we derive from what you write, rather than something you typed in, and we use them to present your request to a clinician and to make sure a safety flag is seen quickly.
• Health-related information you choose to include in any other message or inquiry to us, including our website contact and consultation forms and bug reports, outside of a HIPAA-covered treatment relationship. We use it to answer you.
• Technical information that arrives with a request: the user-agent string your browser sends; a one-way hash of your email address, kept with your request and, for about two days, in a counter that limits how many requests one address can send; and a one-way hash of the network address your request came from, made with a random value that changes every day and kept for about two days, so that the form cannot be flooded. When you send the form, Cloudflare's Turnstile check runs in your browser and we send Cloudflare your network address with its result (Section 5). Our hosting provider's own request logs also record the network address and the browser string of each request, and nothing you write; they are kept for 30 days.

We do not collect other categories of consumer health data. We derive health information only in the ways described above, from what you write to us, and we do not derive or infer it from your purchases, your browsing, your device's location, or any other non-health data.

2. Sources of consumer health data

• You directly: through our request form and our other forms, and through your other messages to us.
• Our own software: the summary and the flags described in Section 1, which it derives from what you write in your request.
• Your interactions with our website: limited to the technical operation of the site and the request you submit.
• A clinician your request was sent to, or the clinic they work within, when either replies to you through us: we keep the first message sent to you.

3. Purposes for collecting and using consumer health data

We use consumer health data only for the following purposes, and only with your consent or as necessary to provide a product or service you have requested:

• To find a licensed clinician in the state you name who can take you on, to give them what they need in order to decide whether they can help you, to show you crisis or emergency numbers when your words call for them, and to make sure a safety flag reaches the clinician quickly.
• To respond to your inquiries and requests.
• To provide, operate, secure, and improve our website and services.
• To comply with legal obligations and to protect against security incidents, fraud, or illegal activity.

We do not use consumer health data for targeted advertising, and we do not use it for purposes that are incompatible with those described here.

4. Categories of consumer health data we share

We share only the categories listed in Section 1, and only as necessary for the purposes described above. We do not share consumer health data with advertising or cross-site tracking vendors.

5. Categories of third parties with whom we share

Contact information is given below for each category of recipient. Section 8 also gives you the right to ask us for the list of the third parties we have shared your own consumer health data with, and Section 9 says how to ask.

• Licensed clinicians in the state you name: therapists, or physical therapists, as you asked, and the clinics they work within. Nothing is shared until you confirm your request from the link we email you; if you never confirm it, we delete it after 7 days. Once you confirm, a fixed rule, not the AI model, picks one clinician: one who has told us they hold a current license in your state and who offers the kind of care, the way of meeting and the payment you asked for, and, when you want to meet in person, who sees clients at an office within 50 miles of your zip code. PsyBird's staff may also offer your request to a particular clinician who meets those same conditions, move it on from a clinician before their time is up, or close it, and they see your name, your email address and what you wrote only after recording why. We send that clinician your name, your email address, your answers, the summary our software wrote, and the safety flag if there is one. We send your request to one clinician at a time. Where that clinician works within a clinic that uses PsyBird, the clinic's owners and the people it allows to work its front desk can also read your request and, on the clinician's behalf, reply to you, pass it on or start your care; the first reply you get, from the clinician or the clinic, is the one that counts. A reply from a clinic is emailed to you by PsyBird under the clinic's name, and your answer goes to the person at the clinic who replied. Each clinician has two business days to reply; if they pass or do not reply in time, we send it to the next clinician, until one takes you on or your request ends. It is not sent to a new clinician later than 14 days after you confirm it; a clinician who has it then keeps their full two business days. The clinicians are independent licensed professionals in their own practices, not PsyBird staff, and the clinics they work within are independent of PsyBird too. A clinician who passes or does not reply in time, and their clinic, keep only your first name and the dates, and the details are removed from their copy when their turn ends. We delete your request, and every clinician's copy of it, 30 days after it closes or after you connect with a clinician. Which clinicians receive a request differs for every request, so we cannot name them here: ask us as Section 9 describes and we will tell you which clinicians, and which clinics, received yours and how to reach each of them.
• Google LLC (Google Cloud and Google Workspace), which processes data on our behalf: hosting, the database your request is kept in, the AI model that writes the summary and flags risk, and the email we send you, a clinic's reply included, and the notice we send a clinician. 1600 Amphitheatre Parkway, Mountain View, CA 94043; policies.google.com/privacy.
• Cloudflare, Inc., which operates the domain name service for psybird.ai: a browser or an app has to look up where our website and our app are before it can reach them, and Cloudflare answers that lookup. It also runs Turnstile, a check that a form on our website is sent by a person: your browser runs Cloudflare's check when you send our request form or our consultation form, and we send Cloudflare your network address with its result. It also counts visits to our website for us, without a cookie or an identifier: the page viewed, the page that linked to it, and the browser's country and device type. It receives none of what you write to us. Cloudflare receives the connection information that routing and that check need, and none of what you write to us. 101 Townsend Street, San Francisco, CA 94107; privacyquestions@cloudflare.com.
• Government entities or others when required by law or legal process, or as necessary to protect safety, rights, or security.

Google and Cloudflare act as our processors, under contracts requiring them to protect the data and to use it only under our instructions.

6. Specific affiliates with whom we share

We do not share consumer health data with any affiliates.

7. No sale of consumer health data; no geofencing

No sale. We do not sell consumer health data. Under MHMDA, any sale would require your separate, written, and signed authorization, which we do not seek.

No geofencing. We do not use a geofence around any entity that provides in-person health care services to identify or track consumers, to collect consumer health data, or to send notifications, messages, or advertisements related to consumer health data or health care services.

8. Your rights under the My Health My Data Act

If you are a Washington consumer, you have the right to:

• Confirm whether we are collecting, sharing, or selling your consumer health data, and access that data.
• Obtain a list of all third parties and affiliates with whom we have shared your consumer health data, together with active contact information for each recipient.
• Have your consumer health data deleted, including by our direction to the processors, affiliates, and other third parties that received it, which includes any clinician your request was sent to and the clinic they work within.
• Withdraw consent to our collection and sharing of your consumer health data.

9. How to exercise your rights

To exercise any of these rights, or to withdraw consent, email us at support@psybird.ai. We will take steps to authenticate your request as permitted by law. We will respond without undue delay and within 45 days of receipt; where reasonably necessary, we may extend that period once by an additional 45 days and will notify you of the extension and the reason. If we refuse to take action on a request, you may appeal by replying to our decision, and we will respond to your appeal within 45 days.

10. Changes to this policy

We may update this CHD Policy from time to time and will post the updated version with a new effective date. If we intend to collect new categories of consumer health data, or use consumer health data for new purposes, we will disclose those changes and obtain your consent as required by MHMDA before doing so.

11. Contact us

PsyBird.ai (operated by Any Percent LLC)
Consumer health data requests. Email: support@psybird.ai
Address: 1135 Scott Ave, Bremerton, WA 98310