Consumer Health Data Privacy Policy.

This policy explains how Cabana Filters, LLC, a Wyoming limited liability company (“Cabana”, “we”, “us”), handles consumer health data: the answers about allergies, asthma and immune health that you can give in Doctor Merv’s air quality assessment. It is written for Washington’s My Health My Data Act and Nevada’s consumer health data law, and we apply it to everyone. It adds to our Privacy Policy, which covers all the other information we hold.

The health data we collect

The assessment asks whether anyone in your home has:

• allergies, and if so to which of dust, pollen, pet dander or mold;
• asthma;
• a compromised immune system.

“None of the above” is always an answer. We also keep the filter prescription we work out partly from these answers (the filter tier and how often to change your filters), and the record of what we recommended and why. We do not ask about diagnoses, treatment, medication, or anything else about anyone’s health, and we do not collect precise location or biometric data.

Your answers may be about other people in your home. Please only share information that they are happy for you to share. They have the same rights over it as you, described below.

Why we collect it and how we use it

We use consumer health data only:

• to choose the filter tier (MERV rating) and the change schedule for your home;
• to make up and deliver the box of filters that prescription calls for;
• to keep a record of what we recommended and why, so we can answer your questions about it.

We never use it for advertising or marketing, to decide what we charge you, or for any purpose unrelated to your filters.

The legal basis, and consent

We collect and use consumer health data only to the extent necessary to provide the product you asked for, a filter prescription for your home and the filters that fill it (RCW 19.373.030(1)(a) and Nevada law), and only with your consent. Before you answer the health questions, we ask you to agree, with a separate box you tick, to our collecting and using those answers for your prescription, and we keep a record of when you agreed. You do not have to: you can skip the health questions and still get a prescription based on the rest of your answers.

You can withdraw your consent at any time by emailing darren@cabanafilters.com or by deleting your data. We then delete your health answers and base your prescription on your other answers. We would ask for your separate consent again before any other use, and we will never sell consumer health data.

Where it comes from

From you, when you answer the assessment. We do not obtain health data about you from anyone else, and we do not infer it from your browsing or purchases.

Who receives it

• Google Cloud, as our processor, stores it in our database in the United States, on our behalf and under contract.
• No one else. We do not share consumer health data with any third party or affiliate. It is not sent to Stripe, to the partner that packs your box, to shipping carriers, or to any partner whose code you used. The partner that packs your box sees the filter tier it must pack, but not the answers behind it.

We would disclose it only if the law required us to, for example under a valid court order, and we would tell you unless the law prevented us.

No sale, no advertising

We do not sell consumer health data, and we do not use it, or let anyone else use it, for advertising. We do not use geofencing around any health care location. No third party collects information about your activity on our site across time and other websites.

How long we keep it

An unfinished assessment is deleted 30 days after you last worked on it. Otherwise we keep your answers while you have a subscription, and after that until you ask us to delete them. When you delete your data, your health answers are erased.

Your rights

Wherever you live, you have the right to:

• confirm and access: to know whether we collect, share or sell your consumer health data, and to see it, including a list of every third party and affiliate we have shared it with and how to contact them;
• delete it, from our records and from our processor’s, and on any archive or backup, within the time the law allows;
• withdraw consent to any processing that rests on your consent;
• correct it, if an answer is wrong;
• not be discriminated against for using these rights.

How to use your rights

• To delete, use our delete my data form. It emails a single-use link to the address you used with us, so nobody else can use it. Deleting your data also cancels your subscription, because we cannot fill your prescription without it.
• For anything else, email darren@cabanafilters.com from the address you used with us, with “Health data request” in the subject.

We verify requests by matching the email address you used with us. We answer within 45 days, and if we need longer we will tell you why and take no more than 45 days more. Requests are free, at least twice a year.

Appeals

If we decline your request, you can appeal by replying to our answer with the word “Appeal”. Someone who did not make the original decision will review it and tell you the outcome and reasons in writing within 45 days. If we deny your appeal, you can complain to your state’s Attorney General; Washington residents can do so at atg.wa.gov/file-complaint, and Nevada residents through the Nevada Attorney General’s website, ag.nv.gov.

Security

Consumer health data is encrypted in transit and at rest, and held in a database on a private network with no public address. Access is limited to the people and systems that need it to provide your filters.

Changes

If we change this policy, we will post the new version here and update the dates at the top. We will email you before a material change takes effect, and we will ask for your consent before using consumer health data in any new way.

Contact us

Email darren@cabanafilters.com or write to Cabana Filters, LLC, 1309 Coffeen Ave., Suite 1200, Sheridan, WY 82801, USA.