Consumer Health Data Privacy Policy

Effective [DATE]. Last updated [DATE].

This policy explains how [ENTITY NAME] ("TRIUMPH Coaching", "we", "us") collects, uses, shares and protects your health information when you book a consult with Ben Greenfield. It applies to everyone, and it covers the rights given by Washington's My Health My Data Act, Nevada's consumer health data law (SB 370), Connecticut's health data rules and Texas Health and Safety Code chapter 181.

The short version

We collect health information only to prepare for and run your consult.
Only Ben and the small team preparing your consult can see it.
We never sell your health information.
We share it with a doctor or clinic only if you say yes, each time.
You can see it, get a list of who has it, withdraw consent, or have it deleted. Email [email protected].

1. What health information we collect

Lab results you upload or email to us (for example blood panels, hormone panels).
Your health goals and the reason for your consult.
Your answers on our intake form, including whether you have recent labs and when they were taken.
Notes from your consult that relate to your health.

We also collect your name, email, phone number and booking details. Payment card details go straight to Square. We never see or store your full card number.

2. Where it comes from

You. Through our intake form, our lab upload form, or by emailing labs to our team.
Doctors or clinics, but only ones Ben has introduced you to and only after you've agreed (see section 4).

3. Why we use it

To prepare Ben for your consult and to run it.
To deliver anything promised after your consult, such as a written follow-up.
To schedule, reschedule and remind you about your consult.

We don't use your health information for advertising, and we don't use it for any purpose you haven't agreed to.

4. Who we share it with

Doctors and clinics

Ben sometimes works with doctors and clinics. We share your lab results or consult notes with one only if:

you ticked the optional sharing box on our intake form, or agreed by email, and
we've told you which doctor or clinic and what we'll send, and you've said yes in writing.

We ask every time. You can say no, and it won't affect your consult.

Service providers who process data for us

These companies store or move data on our behalf, under contracts that limit what they can do with it. They don't use it for their own purposes.

HighLevel (our client and booking system)
Google Workspace (file storage and email)
Zoom (video calls)
Square (payments; card and billing details only)
n8n (automations that file your labs into your private folder)

We never sell health information

Not to advertisers, data brokers or anyone else. We may disclose information if the law requires it, for example a valid court order.

5. Electronic disclosure notice (Texas)

Your health information may be disclosed electronically, for example by secure email or file sharing. We disclose it only as this policy describes, and for any disclosure to a doctor or clinic we ask for your authorization first.

6. How we protect it

Lab files are stored privately and open only for a logged-in team member. We never send links to your files by email or chat.
Only people who prepare your consult have access, and their accounts use two-factor sign-in.
Everyone with access completes health-privacy training.

7. Your rights

You can ask us to:

Confirm whether we hold your health information.
Give you a copy of it.
List every third party and service provider we've shared it with, with contact details.
Withdraw your consent to collection or sharing.
Delete it, including copies held by our service providers.

How to ask

Use our Privacy Request form, or email [email protected].

We'll confirm who you are before acting, so we don't send your information to the wrong person.
We answer within 45 days. If we need more time, we'll tell you why within those 45 days. We can extend once, by another 45 days.
Requests are free, twice in any 12 months.
When we delete your information, we also tell any doctor or clinic we shared it with. Backup copies are deleted within 6 months.
Appeals. If we turn down your request, you can appeal by replying to our answer. We'll respond within 45 days. If you're still not satisfied, you can contact your state attorney general (Washington: atg.wa.gov; Nevada: ag.nv.gov; Connecticut: portal.ct.gov/ag).

We won't treat you differently for using any of these rights.

8. How long we keep it

We keep your health information while you're a client and for 2 years after your last consult, unless you ask us to delete it sooner.

9. Changes to this policy

If we change how we collect, use or share health information, we'll update this page and ask for your consent again before using your information in a new way.

10. Contact us

[ENTITY NAME]
676 Pullman Road, Suite 326
Moscow, ID 83843
[email protected]