Your health data, and the rights two states give you over it.

Effective date: September 10, 2026 · Last updated: October 26, 2026 · This is a separate policy, required to be separate. It covers only consumer health data. Everything else about how Kascade Health LLC handles information is in the Privacy Policy.

01Who this covers

This policy is published by Kascade Health LLC under the Washington My Health My Data Act (RCW 19.373) and the Nevada consumer health data law (NRS 603A.400 to 603A.550). It applies to:

• Residents of Washington and residents of Nevada, and
• Anyone whose consumer health data is collected while they are physically in Washington or Nevada.

Kascade intends and markets the Service to people in the United States, and the website is served only to visitors in the United States and its territories. That restriction is applied to the pages you browse. The technical endpoints the site calls are not restricted the same way, so we do not tell you the Service is unreachable from anywhere else, only that it is not offered anywhere else.

This policy applies to Washington and Nevada residents and to individuals whose consumer health data is collected in Washington or Nevada, to the extent required by applicable law.

02What consumer health data we collect, and why

Consumer health data means information linked to you that identifies your past, present or future physical or mental health status. We collect these categories, all of them from you directly: from the intake form you fill in yourself, and, if you take part in the PCOS/PMOS Clarity Challenge and agree to a call being recorded, from that recording:

• Lab and biomarker values you type in, such as fasting insulin, HOMA-IR, HbA1c, SHBG, testosterone, DHEA-S, hsCRP, vitamin D, thyroid markers and lipids, and the units you report them in.
• Diagnosis status, meaning whether you have been given a PCOS/PMOS diagnosis, are being evaluated, or neither.
• Symptoms you tick from a list, such as fatigue, hair changes, cycle irregularity, bloating or sleep disruption.
• Medications and supplements you tell us you take, including doses and forms where you give them.
• Reproductive health information, including whether you are trying to conceive or thinking about it, whether you use hormonal contraception or hormone therapy, whether you recently stopped the pill, what your cycle is doing, and your confirmation at checkout that you are not currently pregnant or breastfeeding.
• Bodily and demographic measures relevant to reading the values: age, height, weight, and ancestry where you provide it.
• Anything you write in the free-text box, which is yours to use and which sometimes includes mental-health information such as mood or anxiety.
• What you say on a recorded PCOS/PMOS Clarity Challenge call, if you agree to the recording. It holds whatever you choose to tell us about your health on that call.
• The interpretation we generate from all of the above, which is itself health data about you.

The purposes, and there are only these: to generate the educational lab interpretation you asked for; to deliver it to you by email and keep it reachable with the access credentials we issue you, including fresh ones if you ask, so you can open it again; to check it for safety and accuracy with automated rules before it is sent, and to have a person review it afterwards when that is needed for support, quality assurance or correction; if you agree to a PCOS/PMOS Clarity Challenge call being recorded, to keep an accurate record of that call and to respond to any question or concern about it; to answer you if you write to us about it; to keep the record of your purchase and your consent; and to comply with law.

We do not use consumer health data for advertising, for profiling you, for building or improving any product other than your own report, or for training any AI model. We do not use it to decide what marketing to send you, beyond taking people who have already bought a report out of the list of people who are offered one.

03Where it comes from

One source: you, directly, through the intake form and, if you agree to a recording, on a PCOS/PMOS Clarity Challenge call. We do not obtain consumer health data from data brokers, laboratories, healthcare providers, insurers, public records, advertising networks, or any other source. Nothing about your health is inferred from your browsing, purchased, or received from a third party.

04What is shared, and what is not

We do not sell consumer health data. We do not share it for advertising. It is disclosed only to the third parties listed in Section 05, in the way that section describes for each of them, and only in these categories:

• The lab values, medications, symptoms, reproductive-health answers, free text and demographic measures described in Section 02, disclosed so that the interpretation can be generated and stored.
• Your generated interpretation, disclosed so that it can be stored and emailed to you.
• Your email address, disclosed so that the report can be delivered.
• A recording of a PCOS/PMOS Clarity Challenge call, where you have agreed to it, disclosed so that the call can be held and the recording stored.

We may also disclose consumer health data if we are required to by law, legal process or a governmental request, or where it is necessary to protect someone’s safety. If we are legally able to tell you first, we will.

05The specific third parties, and our affiliates

These are the specific third parties with whom consumer health data is shared. The first six are service providers acting on our instructions under a contract, and none of them is permitted to use your data for their own purposes. The last two are our own mail providers, and we describe them separately below because the relationship is a different one:

• Netlify (Netlify, Inc.) · hosting, form handling, and the storage that holds your intake and your generated report.
• Anthropic (Anthropic PBC) · the Claude model that writes the educational interpretation from your values.
• Stripe (Stripe, Inc.) · payment processing. For purchases made before 22 September 2026, the payment record also carries a shortened copy of your intake, which is described in Section 01 of the Privacy Policy. For later purchases it carries your first name and your checkout consent record, and no lab values, medications, symptoms or notes.
• Resend (Resend, Inc.) · email delivery, which is how your report reaches you and which means it holds the message and the link to your report.
• Amazon Web Services · the CloudFront network that answers for the link-measurement address our emails pass through.
• Google Workspace (Google LLC) · the video service (Google Meet) used for Challenge calls, and the storage (Google Drive) that holds a call recording you have agreed to.
• Namecheap (Private Email) · the mailbox behind hello@kascadehealth.com, which receives anything you send us. It used to receive a copy of each report email issued; it no longer does, but copies sent before that change may still be held there.
• Google (Google LLC) · the account that mailbox is collected into, so it holds the same mail.

About those last two. Namecheap and Google are our own mail providers rather than contracted processors, and we want to be straight about the difference. When you email us, that mail, and any earlier report email copy still in our mailbox, sits with them under their own terms, the same way any small company's email does. We keep health detail out of subject lines, we do not send lab values to that mailbox on purpose, and we are working through a review of what stays there and for how long. If you would rather not send health detail by email, say so and we will find another way.

Affiliates. Kascade Health LLC has no affiliates, parent company, or subsidiaries. No consumer health data is shared with any affiliate, because there are none.

You can ask us for this list, with contact information for each one, at any time. Section 06 says how.

Third-party tracking across websites. No third party is permitted to collect consumer health data through our website over time or across different websites or online services for advertising or other purposes.

06Your rights, and how to use them

If you are covered by Section 01, you have the right to:

• Confirm whether we are collecting, sharing or selling your consumer health data, and access that data.
• Obtain a list of all third parties with whom we have shared or to whom we have sold your consumer health data, including an active email address or other online mechanism for contacting each of them.
• Withdraw your consent to our collection and sharing of your consumer health data.
• Delete your consumer health data.
• Not be discriminated against for exercising any of these rights.
• Review and request correction or modification of your consumer health data.

How to make a request

Email hello@kascadehealth.com with the subject line “Consumer Health Data Request” and tell us which of the rights above you want to use. Use the email address you gave us at checkout or sign-up if you can, because that is how we find your record. We do not require you to create an account and we do not ask for government identification. If we cannot match you to a record from what you send, we will write back and say so rather than guess.

We respond within 45 days of receiving the request. If we need longer, we may extend once by a further 45 days, and we will tell you within the first 45 days that we are doing so and why.

For Nevada residents, authenticated deletion requests will be completed within the period required by applicable law, currently no later than 30 days after authentication, subject to applicable exceptions for archived or backup systems.

What deletion reaches

When we delete, we delete the intake and the interpretation: your lab values, medications, symptoms, reproductive-health answers, free text, age, height, weight, ancestry, diagnosis status and first name, the generated report itself, our internal copies of it, any recording of a Challenge call, and the copy carried on the payment record at Stripe where there is one. Your report link stops working from that moment.

Four things are not reached by that deletion, and we would rather set them out here than have you discover them afterwards:

• The record that you gave consent at checkout, and the fact of the transaction, which tax and accounting law requires us to keep. The consent record includes your confirmation that you were not pregnant or breastfeeding when you bought. Apart from that, neither contains your health data once the deletion has run.
• The record that you asked us to stop emailing you, if you have, because deleting it would start the emails again.
• What our email provider holds about having delivered a message to you, which is their record rather than ours.
• Copies that have already left us, including any earlier copy of your report email still in our own hello@kascadehealth.com inbox and anything you forwarded to someone else. Tell us in the same email if you want the inbox copy removed and we will remove it.

Withdrawing consent

You can withdraw consent at any time by writing to the address above. Withdrawing consent stops any further collection or sharing. It does not by itself delete what we already hold, so if you want both, ask for both and we will do both.

If we say no

You may appeal any decision we make. Reply to our decision, or write to hello@kascadehealth.com with the subject line “Consumer Health Data Appeal,” within 45 days of receiving it. A person will review it again and we will write back within 45 days with the decision and the reason for it. If we deny the appeal we will also give you a way to complain to your state Attorney General.

Washington residents may file a complaint with the Washington State Attorney General at atg.wa.gov/file-complaint. Nevada residents may file a complaint with the Office of the Nevada Attorney General at ag.nv.gov.

07For Nevada residents

Nevada requires a few things to be stated in their own words, so here they are.

• The purposes for which we collect and use consumer health data are the ones listed in Section 02, and no others.
• The categories we process are the ones listed in Section 02.
• How we process it: you type it into a form on our website; it is transmitted over an encrypted connection and stored with our hosting provider and on the payment record; it is sent to Anthropic, which generates the educational interpretation from it; the interpretation is checked by deterministic safety rules before it is sent, and a person may read it afterwards for support, quality assurance or correction; it is emailed to you and reached with a private link and a separately emailed six-digit access code, which can expire or be replaced without deleting the report; deleting the report ends access to it. If you take part in the PCOS/PMOS Clarity Challenge and agree to a call being recorded, the call is held on Google Meet, the recording is stored in our Google Workspace account, and it is deleted as Section 05 of the Privacy Policy sets out.
• The categories of third parties with whom it is shared, and the specific third parties themselves, are in Section 05.
• The process for requesting anything in Section 06 is the email address and subject line given there. The same address is used to review, correct or modify what we hold: ask, and we will send you what we have and change what is wrong.
• Material changes. If we change this policy in a way that materially affects your consumer health data, we will post the updated policy here with a new effective date and notify you by email at the address we hold for you, before the change takes effect where we are able to.
• Effective date: September 10, 2026.

08Two things we do not do

09Contact

Kascade Health LLC
hello@kascadehealth.com