Your health data, and the rights two states give you over it.

Effective date: September 10, 2026 · This is a separate policy, required to be separate. It covers only consumer health data. Everything else about how Kascade Health LLC handles information is in the Privacy Policy.

01Who this covers

This policy is published by Kascade Health LLC under the Washington My Health My Data Act (RCW 19.373) and the Nevada consumer health data law (NRS 603A.400 to 603A.550). It applies to:

• Residents of Washington and residents of Nevada, and
• Anyone whose consumer health data is collected while they are physically in Washington or Nevada.

Kascade intends and markets the Service to people in the United States, and the website is served only to visitors in the United States and its territories. That restriction is applied to the pages you browse. The technical endpoints the site calls are not restricted the same way, so we do not tell you the Service is unreachable from anywhere else, only that it is not offered anywhere else.

If you are not in Washington or Nevada, the rights in this document are not ones we are required to give you, and the Privacy Policy is the document that describes what you do have. In practice we answer requests the same way wherever they come from.

02What consumer health data we collect, and why

Consumer health data means information linked to you that identifies your past, present or future physical or mental health status. We collect these categories, all of them from the intake form you fill in yourself:

• Lab and biomarker values you type in, such as fasting insulin, HOMA-IR, HbA1c, SHBG, testosterone, DHEA-S, hsCRP, vitamin D, thyroid markers and lipids, and the units you report them in.
• Diagnosis status, meaning whether you have been given a PCOS/PMOS diagnosis, are being evaluated, or neither.
• Symptoms you tick from a list, such as fatigue, hair changes, cycle irregularity, bloating or sleep disruption.
• Medications and supplements you tell us you take, including doses and forms where you give them.
• Reproductive health information, including whether you are trying to conceive or thinking about it, whether you use hormonal contraception or hormone therapy, whether you recently stopped the pill, and what your cycle is doing.
• Bodily and demographic measures relevant to reading the values: age, height, weight, and ancestry where you provide it.
• Anything you write in the free-text box, which is yours to use and which sometimes includes mental-health information such as mood, anxiety, or thoughts of self-harm.
• The interpretation we generate from all of the above, which is itself health data about you.

The purposes, and there are only these: to generate the educational lab interpretation you asked for; to deliver it to you by email and keep it reachable at your link so you can open it again; to have a person review it for safety and accuracy before it is sent; to answer you if you write to us about it; to keep the record of your purchase and your consent; and to comply with law.

We do not use consumer health data for advertising, for profiling you, for building or improving any product other than your own report, or for training any AI model. We do not use it to decide what marketing to send you, beyond taking people who have already bought a report out of the list of people who are offered one.

03Where it comes from

One source: you, directly, through the intake form. We do not obtain consumer health data from data brokers, laboratories, healthcare providers, insurers, public records, advertising networks, or any other source. Nothing about your health is inferred from your browsing, purchased, or received from a third party.

04What is shared, and what is not

We do not sell consumer health data. We do not share it for advertising. It is disclosed only to the service providers listed in Section 05, each of which processes it on our written instructions to run the Service, and only in these categories:

• The lab values, medications, symptoms, reproductive-health answers, free text and demographic measures described in Section 02, disclosed so that the interpretation can be generated and stored.
• Your generated interpretation, disclosed so that it can be stored and emailed to you.
• Your email address, disclosed so that the report can be delivered.

We may also disclose consumer health data if we are required to by law, legal process or a governmental request, or where it is necessary to protect someone’s safety. If we are legally able to tell you first, we will.

05The specific third parties, and our affiliates

These are the specific third parties with whom consumer health data is shared. The first five are service providers acting on our instructions under a contract, and none of them is permitted to use your data for their own purposes. The last two are our own mail providers, and we describe them separately below because the relationship is a different one:

• Netlify (Netlify, Inc.) · hosting, form handling, and the storage that holds your intake and your generated report.
• Anthropic (Anthropic PBC) · the Claude model that writes the educational interpretation from your values.
• Stripe (Stripe, Inc.) · payment processing. The payment record also carries a shortened copy of your intake, which is described in Section 01 of the Privacy Policy.
• Resend (Resend, Inc.) · email delivery, which is how your report reaches you and which means it holds the message and the link to your report.
• Amazon Web Services · the CloudFront network that answers for the link-measurement address our emails pass through.
• Namecheap (Private Email) · the mailbox behind hello@kascadehealth.com, which receives anything you send us and a copy of each report issued.
• Google (Google LLC) · the account that mailbox is collected into, so it holds the same mail.

About those last two. Namecheap and Google are our own mail providers rather than contracted processors, and we want to be straight about the difference. When you email us, or when a copy of an issued report lands in our mailbox, that mail sits with them under their own terms, the same way any small company's email does. We keep health detail out of subject lines, we do not send lab values to that mailbox on purpose, and we are working through a review of what stays there and for how long. If you would rather not send health detail by email, say so and we will find another way.

Affiliates. Kascade Health LLC has no affiliates, parent company, or subsidiaries. No consumer health data is shared with any affiliate, because there are none.

You can ask us for this list, with contact information for each one, at any time. Section 06 says how.

06Your rights, and how to use them

If you are covered by Section 01, you have the right to:

• Confirm whether we are collecting, sharing or selling your consumer health data, and access that data.
• Obtain a list of all third parties with whom we have shared or to whom we have sold your consumer health data, including an active email address or other online mechanism for contacting each of them.
• Withdraw your consent to our collection and sharing of your consumer health data.
• Delete your consumer health data.
• Not be discriminated against for exercising any of these rights.

How to make a request

Email hello@kascadehealth.com with the subject line “Consumer Health Data Request” and tell us which of the rights above you want to use. Use the email address you gave us at checkout or sign-up if you can, because that is how we find your record. We do not require you to create an account and we do not ask for government identification. If we cannot match you to a record from what you send, we will write back and say so rather than guess.

We respond within 45 days of receiving the request. If we need longer, we may extend once by a further 45 days, and we will tell you within the first 45 days that we are doing so and why.

What deletion reaches

When we delete, we delete the intake and the interpretation: your lab values, medications, symptoms, reproductive-health answers, free text, age, height, weight, ancestry, diagnosis status and first name, the generated report itself, our internal copies of it, and the copy carried on the payment record at Stripe. Your report link stops working from that moment.

Four things are not reached by that deletion, and we would rather set them out here than have you discover them afterwards:

• The record that you gave consent at checkout, and the fact of the transaction, which tax and accounting law requires us to keep. Neither contains your health data once the deletion has run.
• The record that you asked us to stop emailing you, if you have, because deleting it would start the emails again.
• What our email provider holds about having delivered a message to you, which is their record rather than ours.
• Copies that have already left us, including the copy of your report sitting in our own hello@kascadehealth.com inbox and anything you forwarded to someone else. Tell us in the same email if you want the inbox copy removed and we will remove it.

Withdrawing consent

You can withdraw consent at any time by writing to the address above. Withdrawing consent stops any further collection or sharing. It does not by itself delete what we already hold, so if you want both, ask for both and we will do both.

If we say no

You may appeal any decision we make. Reply to our decision, or write to hello@kascadehealth.com with the subject line “Consumer Health Data Appeal,” within 45 days of receiving it. A person will review it again and we will write back within 45 days with the decision and the reason for it. If we deny the appeal we will also give you a way to complain to your state Attorney General.

Washington residents may file a complaint with the Washington State Attorney General at atg.wa.gov/file-complaint. Nevada residents may file a complaint with the Office of the Nevada Attorney General at ag.nv.gov.

07For Nevada residents

Nevada requires a few things to be stated in their own words, so here they are.

• The purposes for which we collect and use consumer health data are the ones listed in Section 02, and no others.
• The categories we process are the ones listed in Section 02.
• How we process it: you type it into a form on our website; it is transmitted over an encrypted connection and stored with our hosting provider and on the payment record; it is sent to Anthropic, which generates the educational interpretation from it; the interpretation is checked by deterministic safety rules and then read by a person before it is sent; it is emailed to you and kept reachable at a private link until it is deleted.
• The categories of third parties with whom it is shared, and the specific third parties themselves, are in Section 05.
• The process for requesting anything in Section 06 is the email address and subject line given there. The same address is used to review, correct or modify what we hold: ask, and we will send you what we have and change what is wrong.
• Material changes. If we change this policy in a way that materially affects your consumer health data, we will post the updated policy here with a new effective date and notify you by email at the address we hold for you, before the change takes effect where we are able to.
• Effective date: September 10, 2026.

08Two things we do not do

09Contact

Kascade Health LLC
hello@kascadehealth.com