Consumer Health Data Privacy Policy

Effective and last updated: October 16, 2026

This Consumer Health Data Privacy Policy explains how HereSpa LLC (“HereSpa,” “we,” “us”) collects, uses, shares and protects consumer health data about consumers who live in Washington or Nevada, or whose consumer health data we collect in those states. It supplements our Privacy Policy at www.herespa.com/privacypolicy, which describes our other practices and applies where this policy does not.

➥ What This Policy Covers

“Consumer health data” means personal information that is linked or reasonably linkable to you and that identifies your past, present or future physical or mental health status, as defined by Washington’s My Health My Data Act and Nevada’s consumer health data law (Senate Bill 370 (2023)). HereSpa arranges beauty and personal-care services performed by independent professionals (“Providers”); it is not a health care provider.

➥ Consumer Health Data We Collect

Depending on how you use our website, applications, Book by chat, phone booking assistant and customer support (together, the “Portal”), we may collect:

• allergies and sensitivities to products, and skin, nail, scalp or hair conditions;
• health information relevant to performing a service safely, such as diabetes or circulation problems, impaired sensation, use of blood thinners, pregnancy, recent procedures, open wounds or contagious conditions;
• mobility, accessibility and positioning needs related to health;
• information you confirm to show that the person receiving the service is eligible for an in-home service where the law requires it, such as that the Recipient is homebound or ill;
• visit notes, messages, chat or call content that include health information;
• injury, illness and incident reports, including related photos; and
• for Provider applicants, where the law treats them as consumers, facial comparisons used to verify identity, as described in “Biometric Information” in our Privacy Policy.

➥ Sources

We collect consumer health data from you; from a person who books or coordinates a service for you, such as a family member, caregiver or facility; from the Provider who performs your service, for example in visit notes or incident reports; and from the organization that arranges a HereSpa Connect event you attend.

➥ How We Use Consumer Health Data

We use consumer health data only to:

• arrange and perform the services you request safely, including giving relevant information to eligible Providers considering your booking and the Provider assigned to it;
• confirm whether a requested service is available for your location and the person receiving the service;
• respond to safety concerns, incidents, complaints and payment disputes, and establish, exercise or defend legal claims;
• verify Provider applicants’ identity and prevent fraud; and
• comply with law.

We do not sell consumer health data or use health or accessibility notes for advertising or marketing.

➥ How We Process Consumer Health Data

We collect consumer health data through the forms, messages, chat and calls described above and from the sources listed above. We store it in our hosted databases and with our service providers, show relevant information through the Portal to eligible Providers considering the booking and the Provider assigned to it, and handle it with automated tools (such as our booking software and the AI that runs Book by chat and the phone booking assistant, and, for Provider applicants, the identity-verification services described in “Biometric Information” in our Privacy Policy) and through review by HereSpa staff who need it for the purposes above. How Book by chat and the phone booking assistant handle conversations is described in our Privacy Policy. Those conversations can include health details you share; for quality and process improvement, we may keep them in our service logs for up to 90 days and review them, including with the help of AI service providers that may not use them to train their models.

➥ Consumer Health Data We Share

We share the categories of consumer health data listed above only as needed for the purposes in this policy, with these categories of recipients:

• eligible Providers considering your booking and the Provider assigned to it;
• our service providers (processors) that act on our instructions under contract, including providers of hosting and storage, text messages and calls, email delivery, AI processing for Book by chat and the phone booking assistant, identity verification, payment processing and error monitoring;
• for a safety incident, the organization where the service took place, our insurers, lawyers and claims administrators, with your consent where the law requires it; and
• government authorities or other parties when the law requires.

HereSpa does not share consumer health data with affiliates. You may ask for a list of the specific third parties with which we have shared your consumer health data, as described below.

➥ Consent

We collect consumer health data only as necessary to provide a service you request, with your consent, or as the law otherwise permits, and we share it only as necessary to provide that service, with your separate consent, or as the law otherwise permits or requires (see “Consumer Health Data We Share”). You may withdraw consent at any time by contacting us as described below. Withdrawing consent may mean we cannot provide a service that requires that information. We will not collect additional categories of consumer health data, use consumer health data for additional purposes, or share it with additional categories of recipients not described in this policy without first telling you and obtaining your consent where the law requires.

➥ Your Rights

Subject to the law that applies to you, you may:

• confirm whether we collect, share or sell your consumer health data, and access that data, including a list of the third parties and affiliates with which we have shared it and their contact information;
• withdraw your consent to, or ask us to stop, our collection and sharing of your consumer health data (we do not sell it); and
• ask us to delete your consumer health data. We will delete it, including from archived or backup systems, and send the deletion notices the law requires to our service providers and other third parties with which we shared it, within the time the law requires and subject to the exceptions and backup delays the law allows.

Closing an account does not by itself delete all associated booking and service records. Your deletion rights include deletion by recipients and from backups where required by applicable law. To request deletion or exercise another consumer health data right, email privacy@herespa.com with the subject “Consumer Health Data Request” or call 1-234-437-3772. We will verify your request using information reasonably necessary to confirm your identity. We respond within the time the law that applies to you requires, which may be extended once where the law allows; if we extend it, we will tell you and give the reason within the original period. Requests are free of charge, except as the law permits for manifestly unfounded, excessive or repetitive requests.

Appeals. If we decline your request, you may appeal by emailing privacy@herespa.com with “Appeal” in the subject line. We will respond in writing within the time the law requires and explain our decision. If your appeal is denied, you may contact the Washington State Attorney General at www.atg.wa.gov/file-complaint or the Nevada Attorney General at ag.nv.gov.

➥ Third-Party Collection on Our Website

Our analytics and advertising partners may collect information about your use of our website over time and across other websites, as described in “Cookies, Analytics and Advertising” in our Privacy Policy. We do not intentionally send health or accessibility notes, chat or call content, or service photos to them.

➥ Security and Access

We limit access to consumer health data to employees, contractors and service providers who need it for the purposes in this policy, and we protect it with administrative, technical and physical safeguards appropriate to its sensitivity.

➥ Changes to This Policy

We post updates to this policy here with a new “Last updated” date. We give any additional notice, and obtain any consent, that the law requires before a change takes effect, including before using consumer health data we already have for a materially different purpose.

➥ Contact Us

HereSpa LLC, Atlanta, Georgia. Email privacy@herespa.com or call 1-234-437-3772.