A Washington startup launches a wellness app, adds location-based recommendations, and sends behavioral events to an advertising platform. The founders call the information “engagement data.” A privacy review later reveals that the same events can indicate visits to health-related locations, interest in wellness services, or a person's physical and mental health. The problem isn't a missing paragraph in the privacy policy. The problem is that nobody can show where the data came from, why it was collected, who received it, when it will be deleted, or whether the user gave the right consent.
That's the practical challenge behind data management practices with My Health My Data. Washington's law turns health-adjacent information into an operational governance issue for apps, retailers, advertisers, analytics companies, and other businesses that may never consider themselves healthcare companies. A defensible program must produce evidence, not just assurances. It should show data minimization, purpose restrictions, consent records, access controls, deletion activity, and vendor oversight across the full data lifecycle.
Introduction to Data Management Under My Health My Data
The Washington My Health My Data Act was signed into law on April 27, 2023. Its compliance dates were staggered by section. Section 10 applied to all persons beginning July 23, 2023, most core requirements in sections 4 through 9 applied to regulated entities on March 31, 2024, and those same provisions applied to small businesses on June 30, 2024, according to the Washington Attorney General's guidance on the Act.
That staggered rollout created a practical problem that generic privacy programs often miss. Teams had to operationalize different data-management controls on three separate dates, rather than moving to one unified compliance deadline. Policy drafting, consent workflows, geofencing, and vendor review therefore had to evolve in stages, while product teams continued changing how data was collected and used.
The law reaches beyond traditional healthcare
A fitness application might collect exercise routines. An online retailer might infer pregnancy-related interests from browsing behavior. An advertising platform might process precise location signals near a clinic or wellness provider. Each example can create consumer health data concerns even when the company doesn't diagnose, treat, or insure anyone.
The statute's breadth means a business can't define its obligations by industry label alone. The relevant questions are more practical:
- What data is collected? Can it identify or infer physical or mental health status?
- Where is the consumer located? Is the person a Washington resident, or is the data collected in Washington?
- What happens after collection? Does the data go to affiliates, processors, analytics services, or advertisers?
- What evidence exists? Can the company prove the purpose, consent, retention period, and deletion path?
Practical rule: A privacy policy describes a program. A data inventory, consent log, deletion record, and vendor file prove it.
The Act's foundational obligations have been in force for more than two years as of September 5, 2026, for companies handling consumer health data in Washington or collecting it from Washington residents. The Washington My Health My Data Act overview for businesses offers additional context, but operators should treat the issue as a continuing governance responsibility, not a one-time policy project.
The right operating model is evidence-based. Product managers should know which fields are collected and why. Engineers should enforce purpose restrictions. Legal and privacy teams should approve consent language and vendor terms. Operations staff should be able to locate, export, delete, and suppress data when a consumer exercises a right.
Who and What Falls Within My Health My Data Scope
The scope analysis starts with the data, not the company's marketing description. The Act covers personal information that identifies a consumer's past, present, or future physical or mental health status. Washington legal guidance also identifies “health care services” as services provided to assess, measure, improve, or learn about a person's mental or physical health, a definition that can reach wellness and data-driven products.
The law applies to any natural person who is a Washington resident or whose consumer health data is collected in Washington. That jurisdictional reach can affect a company headquartered outside the state if its product collects information from Washington users or operates in Washington.
Scope questions for founders
Covered organizations can include businesses, nonprofits, and service providers that handle qualifying information. Traditional healthcare companies are obvious candidates, but the more difficult cases involve businesses whose products create health inferences indirectly.
A location record might reveal that a person visited a health-related facility. A search or purchase history might indicate a health concern. A behavioral profile might be used to infer a person's physical or mental condition. A company that shares those signals with an affiliate or processor needs a data-flow analysis before deciding that the information falls outside the Act.
| Scope question | Operational answer |
|---|---|
| Does the data identify or infer health status? | Classify the field and its derived outputs, not only the original input. |
| Is the data collected in Washington? | Review collection points, geolocation logic, and user access patterns. |
| Does the business provide or support health-related services? | Assess the actual product function, including measurement, improvement, and analysis. |
| Is another entity receiving the data? | Map affiliates, processors, analytics tools, and advertising recipients. |
The statute includes exclusions and interactions with other legal regimes, so teams shouldn't assume that every health-related record receives identical treatment. A business evaluating broader healthcare privacy responsibilities may also find the RapidStart healthcare page useful for organizing healthcare operations and technology considerations.
Enforcement changes the risk calculation
Violations are handled through Washington's Consumer Protection Act. The Attorney General has enforcement authority, and the Act also provides a private right of action for aggrieved consumers. That combination makes weak documentation more dangerous than a simple policy gap. A company may need to defend not only what its notice said, but also how its systems collected, disclosed, retained, and deleted information.
The compliance dates matter because regulated entities faced the core sections 4 through 9 requirements on March 31, 2024, while small businesses received a three-month extension until June 30, 2024, as described by the Washington State Bar Association's analysis of the Act. The extension didn't eliminate the need for operational controls. It only changed the date by which small businesses had to implement them.
Building Compliant Data Management Practices From Mapping to Consent
A compliant program should follow the data through its lifecycle. The sequence below is more reliable than starting with a privacy-policy rewrite because it forces the business to understand what the product does.
Start with a living data map
The map should include collection points, fields, inferred attributes, storage locations, internal users, external recipients, retention rules, and deletion dependencies. It should cover the product, website, mobile software development kits, customer-support tools, payment systems, analytics platforms, advertising tools, and data warehouses.
A field-by-field review is necessary because health risk often appears in combinations. Precise location may not be labeled “health data,” but a repeated location pattern can create a health inference. An account identifier may look neutral until it is joined with a wellness assessment or service request.
Purpose tagging gives the map practical value. Each data element should have a stated purpose, such as account security, service delivery, customer support, analytics, or advertising. If a proposed use has no approved purpose tag, the system should block the use until privacy and legal owners review it.
Limit collection before designing consent
Consent shouldn't become a substitute for restraint. If the product doesn't need a precise location history, it shouldn't collect one merely because the data might become useful later. If a wellness feature can operate with a broad category instead of an exact measurement, the product should prefer the less intrusive option.
The Washington framework also makes consent mechanics specific. Consent must be a clear affirmative act that is freely given, specific, informed, opt-in, voluntary, and unambiguous. Collection consent and sharing consent are distinct, so a single broad checkbox shouldn't authorize both activities. The statute defines a sale as an exchange of consumer health data for monetary or other valuable consideration, which requires careful review of advertising and data-partnership arrangements. These requirements appear in the official Washington statute.
A useful consent record should preserve:
- The exact language shown: Store the version presented to the consumer.
- The time and context: Record when and where the affirmative action occurred.
- The selected purpose: Identify collection, sharing, or another approved use.
- The identity or account link: Connect the record to the relevant consumer without exposing unnecessary information.
- The withdrawal event: Capture when consent was withdrawn and which downstream systems received the instruction.
Separate the health-data policy from the general notice
The Washington Attorney General says the consumer health data privacy policy must have a separate, distinct homepage link. The policy also shouldn't include extra information that the Act doesn't require. Combining that policy into a broad privacy notice can create a defect even when the combined document contains the relevant language.
The homepage link should be easy to find, labeled clearly, and maintained through releases. Product teams should test it on desktop and mobile interfaces, including signup flows, logged-in dashboards, and pages where health-adjacent data is collected.
Design consent as a product control, not a legal decoration. If the interface makes acceptance easy and withdrawal difficult, the business has created both a trust problem and a compliance problem.
Consent screens also need protection from dark patterns. Preselected options, confusing button labels, bundled purposes, and visual designs that steer a consumer toward acceptance weaken the evidence that consent was freely given and unambiguous.
Teams working across HIPAA and Washington requirements can use the ProPlaintiff.ai AI HIPAA guide as a separate reference point for healthcare privacy concepts. It shouldn't replace a Washington-specific analysis, especially where the product's data flows extend beyond HIPAA-covered operations.
Finally, contract click behavior matters when a company relies on online terms and consent records. The clickwrap versus browsewrap analysis can help product owners evaluate whether the interface creates a clear affirmative agreement rather than relying on passive notice.
Managing Consumer Rights Requests Retention and Vendor Controls
A consumer request exposes whether a company controls its data. If the operations team must search every system by hand, the business lacks the evidence needed to show minimization, consent enforcement, and lifecycle control. Build the process around identity verification, a central owner, mapped systems, documented exceptions, and an audit trail.
Consumers may request access, deletion, withdrawal of consent, and appeals. Under Washington's My Health My Data Act, a company generally has 45 days to respond, with one possible 45-day extension. The law also addresses up to two free consumer requests annually. Staffing and workflow design should account for that volume instead of treating rights requests as unusual events.
Build a request workflow that leaves evidence
A rights-request register should record the request date, request type, verification method, systems searched, vendors contacted, response date, exceptions, and appeal outcome. Limit access to the register because it can contain sensitive requester information and reveal internal control details.
Deletion requires more than issuing a database command. Identify production databases, backups, logs, support tools, data lakes, analytics stores, and vendor copies. If immediate deletion is not technically possible, document the applicable exception, restrict access, and apply the deletion instruction when the system permits.
Withdrawal of consent must also change system behavior. If a consumer withdraws permission to share data, stop the relevant disclosure, update suppression records, and communicate the instruction to recipients where the business's data flow requires it. Test that change rather than relying on a policy statement.
Use retention schedules that product teams can follow
Retention rules should connect each data category to a defined purpose. A practical schedule can distinguish account administration from analytics, customer support from fraud prevention, and raw events from aggregated outputs. Assign every category an owner, a review trigger, and a deletion or anonymization action.
The schedule must operate through technical controls. Automated jobs can remove records from primary systems, but teams also need documented handling for backups, exports, vendor caches, and derived profiles. A quarterly review should compare the written schedule with actual storage, identify data that outlived its purpose, and preserve evidence of the review.
Use this data retention policy template to organize the written schedule, then tailor it to the company's actual systems, purposes, and deletion capabilities.
Treat vendors as part of the data stack
Vendor oversight should cover processors, affiliates, analytics providers, advertising partners, customer-support platforms, and cloud services. Contracts should define permitted purposes, prohibit unauthorized use, require access restrictions, address deletion assistance, and include clear breach-notice and audit terms.
A vendor questionnaire cannot substitute for contract and system review. Procurement should compare the agreement with technical settings and the vendor's actual data use. A processor receiving precise location or health-related inferences needs controls designed for those fields, not a generic data-processing addendum copied from another product.
A vendor remains part of the privacy program after the data leaves the company's environment. Record what was shared, why it was shared, and how the recipient will return or delete it.
Regular audits should test retention, deletion, access permissions, consent withdrawal, and vendor compliance. The incident-response playbook should identify who investigates an unauthorized disclosure, preserves evidence, contacts vendors, and evaluates consumer and regulatory obligations. That record gives the company a defensible account of how its controls worked, not merely a notice describing what they were supposed to do.
Enforceability Litigation Risk and Alternatives to Non-Solicitation
My Health My Data is no longer only a policy exercise. The first lawsuit under the statute was filed in February 2025, a development discussed in WilmerHale's litigation update. The Washington Attorney General's guidance remains active and updated, while consumer rights, consent failures, and dark patterns have become practical litigation concerns.
A company facing a claim may need to defend the entire chain, including the notice, interface, consent record, data map, vendor contract, retention schedule, and deletion response. That's why evidence-based governance is more valuable than a polished policy that the system doesn't follow.
Match the tool to the business risk
Non-solicitation, confidentiality, and non-compete provisions address different problems. A non-solicitation clause may restrict targeted efforts to take customers, employees, or business relationships, subject to Washington law and the facts of the agreement. A confidentiality agreement protects defined information from unauthorized use or disclosure. A non-compete attempts to restrict competitive activity and carries separate enforceability concerns.
None of these agreements substitutes for My Health My Data controls. A confidentiality clause won't create a consumer deletion workflow. A non-solicitation clause won't establish valid opt-in consent. A non-compete won't cure an advertising platform's unauthorized use of health-related data.
| Business objective | More suitable control |
|---|---|
| Restrict misuse of sensitive business information | Narrow confidentiality and trade-secret protections |
| Protect customer or employee relationships | Carefully tailored non-solicitation terms where enforceable |
| Control competitive activity | Separate non-compete analysis, not a privacy workaround |
| Govern consumer health data | Mapping, consent, retention, rights, and vendor controls |
The discussion of Washington data-breach litigation exposure provides useful context for companies assessing how privacy failures can develop into disputes. Founders should avoid using employment or commercial restrictions as a substitute for product governance. The better approach combines narrowly drafted agreements with demonstrable controls over consumer data.
For a practical comparison of litigation risk and contract tools, the following video can help frame the strategic choices:
The central question is simple: can the company show that each restriction and data practice serves a defined purpose, uses clear language, and operates as written? If not, the business has a documentation problem and potentially a systems problem.
Next Steps and When to Consult a Lawyer for Customization
A Washington business doesn’t need to rebuild every privacy system at once. It does need to prioritize the controls that expose the largest gap between written commitments and actual data behavior.
The immediate review
- Confirm the policy link: Verify that the consumer health data privacy policy has a separate, distinct homepage link and doesn’t contain unnecessary material.
- Refresh the data map: Include precise location, inferred health attributes, mobile tools, analytics, advertising systems, affiliates, and processors.
- Test consent records: Confirm that collection and sharing consent are separate, affirmative, specific, informed, and tied to the actual interface.
- Review retention: Assign an owner to every health-related data category and document deletion or access-restriction behavior.
- Run a rights exercise: Simulate access, deletion, withdrawal, and appeal workflows across production systems and vendors.
- Audit contracts: Add Washington-specific purpose limits, breach-notice obligations, deletion assistance, access restrictions, and audit terms where appropriate.
- Preserve evidence: Keep versions of notices, consent screens, data maps, approvals, request logs, and vendor reviews.
The result should be a program that a founder, engineer, privacy lead, and outside reviewer can understand. It should also survive product changes. New analytics tools, location features, AI systems, and advertising partnerships should trigger a documented privacy review before launch.
When outside counsel adds value
Legal customization becomes important when the company’s data flows are complex, when a vendor refuses meaningful audit or deletion terms, when the product relies on health inferences or location signals, or when a consumer request exposes inconsistent records. Counsel can also assess whether an agreement’s confidentiality, non-solicitation, or competitive restrictions fit Washington requirements without relying on overbroad language.
By Design Law Firm & Legal Consultancy, PLLC offers Washington-specific My Health My Data counsel, including data-flow review, notice assessment, privacy-program development, and vendor-agreement analysis. The firm’s role is most useful when a template needs to be adapted to the company’s actual product, systems, contracts, and risk profile.
The practical finish line isn’t a signed policy. It’s a repeatable system that limits collection, records valid consent, honors consumer rights, controls vendors, and demonstrates lifecycle governance when someone asks for proof.
By Design Law Firm & Legal Consultancy, PLLC can review a Washington company’s consumer health data flows, privacy notices, consent design, retention rules, and vendor agreements. Founders and operators should visit By Design Law Firm & Legal Consultancy, PLLC to request an assessment and build an audit-ready My Health My Data program around the systems the business uses. Contact our law office at (206) 593-1519.
