Consumer Health Data Privacy Policy

This policy explains how GetMyYes handles consumer health data as defined by Washington's My Health My Data Act (RCW 19.373), Nevada's consumer health data law (SB 370), and similar state laws. It supplements our Privacy Policy, which covers everything else and applies in full.

1. Who we are

GetMyYes is operated by Nojus Sargevičius, a sole trader registered for individual activity in Lithuania (individuali veikla). Contact: support@getmyyes.com.

2. Consumer health data we collect and why

• The documents you upload (denial letters, explanations of benefits, prior-authorization denials) and the facts read from them. These can show a diagnosis, a treatment, service or medication, procedure and billing codes, the provider, the plan, claim details and dates.
• Your answers to the guided questions, which can describe your condition, treatment history or why the care was needed.
• Optional case-tracker details about an appeal you submitted (dates, method, reference, status and outcome).
• Information that may imply health status: that you used GetMyYes for a particular denial, and the case reminders you choose to receive.

We use this data only to provide the service you asked for: to explain your denial in plain English, to draft your appeal packet, to show your deadlines and next steps, to send the reminders you opt in to, and to keep the service secure and working. We do not use it for advertising, profiling, or training AI models. Our aggregate traffic counters never contain document contents, case text or any health information.

3. Where it comes from

Only from you: the documents you upload and the answers you type. We do not buy health data or collect it from insurers, providers, data brokers or other third parties, and we do not use precise location data.

4. Consent

We collect consumer health data only after you give consent with the checkbox before your first upload, and only for the purposes above. You can withdraw that consent at any time by deleting the case or your account in Settings, or by emailing us; we then stop processing and delete the data, except purchase records we must keep for accounting and tax law, which contain no health information.

5. Who we share it with

We do not sell consumer health data and do not share it with third parties or affiliates. GetMyYes has no affiliates. The only organisations that handle it are processors that run the service on our behalf, under contracts that forbid them from using it for their own purposes:

• Google Firebase / Google Cloud: hosting, sign-in, database and file storage (United States).
• OpenAI: reading your documents and drafting your summary and packet, with request retention disabled and no model training.

Stripe (payments) and Trustpilot (review invitations) receive no health information. We may disclose data if the law requires it, and we will tell you when the law allows.

6. Your rights

• Confirm and access: ask whether we hold your consumer health data and get a copy of it, and a list of every processor or third party that received it, with their contact details.
• Delete: delete a case or all data yourself in Settings, or ask us to. We also delete it from our processors and from backups as they roll over.
• Withdraw consent: as described in section 4.

Email support@getmyyes.com to make a request. We may need to confirm that you control the account. We answer within 45 days, and we tell you if we need up to 45 more days. Requests are free up to twice a year.

7. Appeals

If we decline your request, you can appeal by replying to our answer with "Appeal" in the subject line. We will answer within 45 days and explain our decision in writing. If you are not satisfied, you can contact the Washington State Attorney General at atg.wa.gov/file-complaint, or the attorney general of your own state.

8. Changes

We will post any change here with a new date. We will ask for your consent again before using consumer health data for any new purpose.