Washington Consumer Health Data Privacy Notice

This Washington Consumer Health Data Privacy Notice (“CHD Privacy Notice”) applies to Washington residents (also called “consumers” or “you”) and supplements the information contained in ZS’s Privacy Policy.

This CHD Privacy Notice describes ZS’s practices regarding consumer health data (“CHD”) as defined in Washington State’s My Health My Data Act (the “MHMDA”).

This CHD Privacy Notice does not cover CHD that we collect and process on behalf of our clients as their “processor” or “service provider.” Any CHD that we collect and process in this role is covered by the privacy policy of the relevant client. If you believe we have collected or processed your CHD on behalf of one of our clients, please consult that client’s relevant privacy policy for more information.

Some terms in this CHD Privacy Notice may have different meanings than they do in the Privacy Policy, and the meanings in this CHD Privacy Notice reflect the definitions under Washington State’s My Health My Data Act (“MHMDA”).

We may collect CHD directly from you, such as when you participate in market research or otherwise provide CHD to us, or from third parties, such as our clients or third-party vendors.

The categories of CHD we collect about you depend on how you interact with ZS, including the products and features you use.

Examples of consumer health data we collect may include:

• Individual health conditions, treatment, diseases, or diagnosis.
• Social, psychological, behavioral, and medical interventions.
• Health-related surgeries or procedures.
• Use or purchase of prescribed medication.
• Bodily functions, vital signs, symptoms, or measurements of information described in this list.
• Diagnosis or diagnostic testing, treatment, or medication.
• Gender-affirming care information.
• Reproductive or sexual health information.
• Data that identifies that you are seeking health care services.
• Other information that ZS processes to associate or identify you with the above data that is derived or extrapolated from non-health information (e.g., inferences from non-health data that link you with a health condition, medication, treatment, visiting a health care location, etc.).

We use CHD for the purposes of sending non-marketing communications, performing analytics, and complying with legal obligations. Primarily, we may use, disclose, or share CHD to provide services to our clients. This may include research and product development purposes.

We may use CHD for other purposes for which we give you choices or obtain your consent as required by law. 

As necessary for the purposes described above, we share CHD with the following categories of third parties:

• Our service providers and vendors.
• Our clients, including pharmaceutical companies.
• Our affiliates within the ZS group of companies. A full list of affiliates is available here.
  
• In certain circumstances, it may also be necessary to provide data to other third parties, for example, to comply with the law or to protect our rights or those of our clients.
  

The MHMDA provides Washington consumers with certain rights with respect to their CHD, including the right to confirm whether we collect, share, or sell your CHD, as those terms are defined in the MHMDA; access your CHD; delete your CHD; and withdraw consent to our collection and sharing of your CHD. You can request to exercise these rights using our Privacy Request Tool.

We may take reasonable steps to authenticate you and your request before responding to your request, including by asking you to provide additional information. If we are unable to authenticate you, we reserve the right to decline your request.

Your rights are subject to certain exceptions. For example, we retain the right to decline your request or charge a reasonable fee to cover the administrative costs of responding if the request is repetitive, excessive, or manifestly unfounded. You may request to exercise the same right free of charge up to twice per year.

If we decline your request, you may appeal this decision by e-mailing us at dataprivacy@zs.com with the subject line, “CHD Right Request Appeal.” Please explain the right you requested to exercise and your reasons for believing that our denial of your request was unwarranted.