Consumer Health Data Privacy Policy

Who we are and who this covers

ClinicCompass (thecliniccompass.com) is a directory that helps people find med spas, plastic surgeons and dermatologists and request a consultation. It is operated by John Blackwood. We are not a healthcare provider.

Washington's My Health My Data Act (RCW 19.373) and Nevada's law on consumer health data (NRS 603A.400 to 603A.550) protect information that links a person to their health, including the treatments and procedures they are seeking. We follow this policy for everyone who uses the site, wherever they live.

Consumer health data we collect

We collect the following. Each part says where the information comes from.

When you request a consultation (from you)

Your name, phone number and email address; the treatment or procedure you choose, or that you are not sure yet; your city; the clinic, when you send the request from a clinic's page; your preferred contact time; anything you write in the message box; and the page you sent the request from. With the request we store your browser type and a hashed form of your IP address, not the address itself. The message box is optional and goes to the clinic as you wrote it, so please leave out medical history.

After your request (from you and from the clinic)

A few days after we send your request, we ask the clinic whether it reached you and whether you booked, and we ask you whether the clinic contacted you. We keep both answers, and any request from you to send your request to another clinic or to stop these follow-ups.

When you write to us (from you)

Your name, email address and what you write, through our contact form or by email. A message may mention a treatment or a health concern if you choose to include one.

When you subscribe to our newsletter (from you)

Only if you tick the newsletter box or use a sign-up form: your email address, your city, and the page where you subscribed, which can be a treatment page. A subscription made with the box on the consultation form is linked to that request in our records.

When you browse the site (from your browser, automatically)

The pages you view, which can name a treatment, a concern or a clinic; the treatment and city you pick in our search tools and in the consultation form, including when you start filling in the form; and taps on a clinic's call, text, email, booking, website or directions buttons. Google Analytics records these with a cookie identifier, your IP address and your device and browser type. Our host, Netlify, receives your IP address and the pages you request in its server logs. None of this includes your name, email address, phone number or message.

What we do not collect

We do not collect your precise location: the Nearest to me button finds the closest city inside your browser, and your exact location is never sent to us or anyone else. Our dermatologist pages have no request form. We do not buy health data, and we do not draw conclusions about your health from other information.

Why we collect and use it

• To deliver the request you made: send it to one clinic so the clinic can contact you, and email you that clinic's name and phone number.
• To follow up: ask the clinic and you whether you were reached, and send your request to another clinic when you ask us to.
• To answer your messages.
• To send the newsletter, only if you subscribed.
• To keep the service working: stop spam, tests and repeated submissions.
• To understand how the directory is used: count requests by city, treatment and clinic, see which pages lead to requests, and show each clinic how many requests its listing received. These counts do not name you.

We do not use consumer health data for advertising, and we do not give it to advertisers or data brokers.

Who receives it

The clinic you choose or are matched with

Your consultation request goes to one clinic: the clinic whose page you used or, if you used a city or treatment page, one of the clinics listed on that page. The clinic receives your name, phone number, email address, treatment, preferred contact time and message. We send it by email. If the clinic has no email address, we text it to the clinic from our business phone number or enter it in the contact form on the clinic's own website. When we later ask the clinic whether it reached you, we give your first name and the treatment. We send your request to a second or third clinic only when you ask us to in writing. Once a clinic has your request, the clinic handles it under its own privacy practices.

Google

Google receives the browsing information described above through Google Analytics, with a cookie identifier and your IP address. It never receives your name, email address, phone number or message. Google Signals is turned off on our Google Analytics property, and the property is not linked to any Google advertising account. Google Analytics collects information about your visits to our site over time.

Video services, when you press play

Some clinic pages show the clinic's own video from YouTube, Vimeo or Instagram. Nothing loads from those services until you press play. When you do, that service delivers the video, can tell which clinic's video you are watching, and may collect information under its own privacy policy.

When the law requires it

We disclose consumer health data when a law, court order or other legal process requires it.

Affiliates

We do not share consumer health data with any affiliate.

Service providers

These companies process consumer health data for us, to run the service this policy describes:

• Supabase, the database that stores requests, follow-up answers and newsletter consent records, and the server functions that route requests
• Resend, which sends the email that carries your request to the clinic and the emails we send you
• Netlify, which hosts the website, keeps its server logs and receives a copy of each form submission
• Google Workspace, our email inbox, which receives a copy of each request and your emails to us
• Quo, our business phone line, used to text a clinic your request when it has no email address and to ask clinics whether they reached you
• beehiiv, which sends the newsletter to subscribers
• Notion, where we keep follow-up notes about clinics, which can include a request's reference number and whether it led to a booking
• Anthropic, whose AI assistant, Claude, reads our request queue and inbox to help us sort requests and draft messages

We do not sell consumer health data

We do not sell consumer health data. Clinics receive consultation requests free of charge, and no one pays us for consumer health data.

Your rights

• Confirm and access. Ask whether we collect, share or sell consumer health data about you, get a copy of it, and get a list of every third party we have shared it with, such as the clinic that received your request, with an email address or other online way to contact each one.
• Withdraw consent, and stop collection and sharing. Ask us to stop collecting and sharing your consumer health data. We will stop follow-ups about your request and will not send it to anyone else. We cannot take back a request a clinic has already received, so you may also want to ask us to delete your data.
• Delete. Ask us to delete your consumer health data. We delete it from our records and systems, and we tell the clinic, our service providers and anyone else who received it about your request. Copies held in backups are deleted within six months.
• Correct. Ask us to correct consumer health data about you that is wrong.
• Newsletter and analytics. Every newsletter has an unsubscribe link. You can stop Google Analytics by blocking or deleting cookies in your browser, or with Google's opt-out browser add-on. The site works the same either way.

How to make a request

Email hello@thecliniccompass.com with "Health data request" in the subject. Send it from the email address you used with us, or tell us the email address or phone number you used, so we can find your data. We may ask you to confirm the request from that email address before we act on it. You do not need an account, and requests are free.

We respond within 45 days of receiving your request. If we need more time, we will tell you why within those 45 days and finish within 45 more. We complete a deletion within 30 days of confirming that the request is yours.

Appeals

If we decline a request in whole or in part, you can appeal by replying to our decision or by emailing hello@thecliniccompass.com with "Health data appeal" in the subject. We will tell you in writing within 45 days what we did or did not do, and why. If we deny your appeal, you can complain to the Washington State Attorney General or the Nevada Attorney General.

Using these rights never affects your use of the site or your ability to request a consultation.

Changes to this policy

We will post any change on this page with a new effective date. If a change affects how we handle consumer health data, we will also show a notice on our homepage for 30 days. We will not collect, use or share consumer health data in a way this policy does not describe without first telling you and getting your consent.

Contact

Questions about this policy or your consumer health data: hello@thecliniccompass.com.