Home › Legal

Consumer Health Data Privacy Policy

Interstate Medicine, interstatemedicine.com · Last updated: October 30, 2026

This Consumer Health Data Privacy Policy covers health information in the Interstate Medicine Ledger and the Interstate Medicine Roster. It is written for Washington’s My Health My Data Act, Nevada’s consumer health data law and Connecticut’s privacy act, and we apply it to everyone. It adds to our Privacy Policy.

1. Health data we collect

• Health and immunization records you add for credentialing: TB screening, influenza, COVID-19, Tdap and hepatitis B vaccinations, hepatitis B, MMR and varicella titers, N95 fit tests, drug screens, and physical or fitness-for-duty exams, with dates, results and the documents behind them.
• Health information that appears on other documents you add, such as an immunization line on an employment form.
• Your answers to health-related questions on an attestation you sign in the Ledger, if you answer them there.

We do not infer health conditions, and we do not collect patient information.

2. Where it comes from

From you, your assistant, an organization you have linked at a level that lets it add documents, or a sender you authorized to email documents in. We never buy health data.

3. Why we use it

Only to keep your credentialing file complete: show what you hold and when it expires, remind you before it does, and include it in packets you choose to share. We do not use it for advertising, and our AI reader does not learn from it.

4. Your consent

We ask for your consent before the first health record is saved to your Ledger. Until you agree, an organization or assistant cannot add one: it is refused, and they are told only you can agree. A record emailed to you waits in your inbox for your review. You can withdraw consent any time in Settings or by email. Withdrawing deletes your health records and the documents attached to them. AI readings of them expire within 30 days, and a copy emailed in stays in your inbox until you handle it.

5. Who can see it

• Organizations you link. At Level 2 an organization sees only expiration dates (for example, when your TB screening expires), never results. At Level 4 (Full control) it can open your whole Ledger, including health records. Choosing a level is your consent to share what that level shows, and you can lower or revoke it any time.
• Your assistant, if you name one. With View access or higher, your assistant sees the documents attached to your health records.
• People you send a packet link to, for the records you put in the packet.
• Service providers that process data for us under contract: Supabase (storage), Netlify (hosting), Anthropic (AI reader), Resend (email-in) and Google Workspace (only if you email us a record).

We never sell health data. We do not use geofencing around health care facilities.

6. Your rights

• Confirm whether we hold your health data, and see it.
• Get a list of every third party and organization we have shared it with.
• Delete it, from us and from our service providers.
• Withdraw your consent.

Use Settings, or email help@interstatemedicine.com with “Health data request” in the subject. We answer within 45 days. If we decline, reply with “Appeal” within 60 days; we decide within 60 days. If you disagree, you can contact your state Attorney General (Washington, Nevada or Connecticut).

7. How long we keep it and how we protect it

Until you delete the record, withdraw consent, or delete your account. AI readings expire within 30 days, and an emailed-in copy stays until you handle it. Only staff who need it to support you can reach it. Security details are on our Security page.

8. Contact

Interstate Medicine LLC, 5535 Memorial Drive, Suite F1150, Houston, TX 77007. help@interstatemedicine.com.