Consumer Health Data
Consumer Health Data Privacy Policy
Navara Health, PLLC
· Washington My Health My Data Act and Nevada SB 370
Last updated: August 23, 2026
This policy is provided under the Washington My Health My Data Act and the Nevada Consumer Health Data Privacy Law. It is a separate document from our Notice of Privacy Practices and applies specifically to consumer health data as those laws define it.
It applies to residents of Washington and Nevada. We provide it to everyone because we would rather have one clear standard than different rules for different visitors.
Read this first, it explains the scope
Most of the health information we hold is not covered by this policy, because it is already protected by something stronger.
Once you become a patient, your medical records, laboratory results, prescriptions, and clinical communications are Protected Health Information under HIPAA and Texas HB 300. Both statutes above specifically exempt information governed by HIPAA. That information is covered by our Notice of Privacy Practices, which gives you more protection than this policy does, not less.
This policy covers the narrow layer that sits outside HIPAA: website analytics, cookies, and what your browsing on our site might reveal about your health interests. Our forms are hosted on a HIPAA-compliant platform under a business associate agreement, so what you submit through them is protected as health information from the moment we receive it, whether or not you go on to become a patient.
What consumer health data we collect
| Information you give us on a form | Name, contact details, and what you tell us about your health concern when you complete a form on our site. Our forms are hosted on a HIPAA-compliant platform under a business associate agreement, so this information is generally treated as Protected Health Information and governed by our Notice of Privacy Practices rather than by this policy. |
| Health interest inferred from browsing | Which service pages you view. Reading a page about hormone therapy, weight management, or sexual wellness can reasonably suggest an interest in that condition, and both statutes treat that inference as health data. |
| Appointment and booking information | What service you selected and when, at the point of booking and before you are seen. |
| Technical information | IP address, device and browser type, and pages visited, collected automatically. This becomes health data when it is linked to the pages above. |
Where it comes from
- Directly from you, when you complete a form, book an appointment, or contact us.
- Automatically from your device, through cookies and similar technologies when you use our site.
- From our service providers, including our scheduling platform, our secure form provider, and our website host.
We do not purchase consumer health data, and we do not obtain it from data brokers.
Why we collect it
- To respond to your enquiry, callback request, or appointment booking
- To determine whether we can appropriately treat you, including whether we are licensed in your state
- To prepare for your visit, so clinical time is spent on you rather than paperwork
- To operate, secure, and improve our website
- To comply with legal obligations
We do not use consumer health data to make decisions about credit, employment, insurance, or housing.
Who we share it with
We share consumer health data only with service providers who need it to perform a function for us, under contracts that limit what they may do with it.
| Scheduling and records platform | To book your appointment and, once you become a patient, to maintain your chart. Under a business associate agreement. |
| Secure form provider | To collect intake, consent, and callback forms. Under a signed business associate agreement on a HIPAA-compliant plan. |
| Website host and analytics | To operate the site and understand how it is used. Analytics loads only if you consent to it, and we never pass your name, email, or any identifier into it. |
| Advertising measurement | Only if you switch marketing cookies on. Used to measure whether our advertising reaches the right people. Off by default, and we do not build audiences from the health pages you visit. |
| Payment processor | To process payment. Payment processors receive transaction data, not clinical information. |
We do not sell your consumer health data
Navara Health does not sell consumer health data, and we will not. Both statutes require a separate, signed authorization before any sale, and we do not intend to seek one.
We also do not share consumer health data with advertisers, data brokers, or third parties for their own marketing purposes.
Your rights
If you are a Washington or Nevada resident, you have the right to:
- Confirm whether we collect, share, or sell your consumer health data, and access that data, including a list of who we have shared it with.
- Withdraw consent to our collection and sharing of your consumer health data. For cookies and website technologies you can do this yourself at any time using the cookie preferences link in our footer, and it takes effect immediately.
- Have your consumer health data deleted, including from our archived and backup systems.
- Appeal if we decline your request, and to contact the Washington Attorney General if you are not satisfied with the outcome.
There is no charge to exercise these rights and we will not treat you differently for exercising them.
How to make a request
Email contact@navarahealthtx.com with the subject line "Consumer Health Data Request", or call (469) 653-3124. Tell us which right you are exercising and give us enough information to identify you.
We will respond within 45 days. If we need more time we will tell you why and may extend once by a further 45 days. An authorized agent may make a request on your behalf with written permission.
One limit on deletion, and we want to be clear about it
If you have become a patient, we cannot delete your medical record. Texas law requires us to retain medical records for seven years from the date of last treatment, and longer for patients who were minors. That obligation is not something we can waive at your request, and it exists to protect you as much as us.
What we can delete is consumer health data outside your medical record: website analytics, marketing contact records, and form submissions from before you became a patient. If you ask us to delete and part of your information falls into each category, we will tell you plainly which part we deleted and which part we are legally required to keep.
How long we keep it
- Enquiries and callback requests that do not become appointments: retained for up to two years, then deleted.
- Website analytics: retained for two months, then automatically deleted by our analytics provider.
- Patient medical records: retained for seven years from last treatment as required by Texas law, and governed by our Notice of Privacy Practices rather than this policy.
How we protect it
We use administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including encryption in transit, access controls limiting staff access to what their role requires, business associate agreements with vendors handling health information, and secure HIPAA-compliant platforms for forms, records, and messaging. We do not send identifying information to analytics or advertising services.
No system is perfectly secure. If a breach affecting your information occurs, we will notify you as required by law.
Cookies and tracking
Our website uses cookies and similar technologies to operate the site and understand how it is used. You can set your browser to refuse cookies, though some parts of the site may not function properly if you do.
Our website uses cookies and similar technologies. Nothing beyond what is strictly necessary loads until you choose.
You choose before anything runs
When you first visit, a consent banner appears with three options given equal weight: accept all, reject non-essential, or manage each category individually. Until you make a choice, analytics and marketing technologies are switched off by default, not merely unused.
- Strictly necessary. Required for the site to load, for security, for form submission and appointment scheduling, and to remember your cookie choice. These cannot be switched off.
- Analytics. Tells us which pages people read and where they leave, so we can improve the site. Reported in aggregate and never used to identify you. Off unless you allow it.
- Marketing. Used to measure whether our advertising reaches the right people and to avoid showing the same advertisement repeatedly. Off by default and loads only if you switch it on.
Your choice is recorded with a timestamp and kept for 12 months. You can change it at any time using the cookie preferences link in our website footer, and changing it takes effect immediately.
What we do not do
We do not use consumer health data for targeted advertising. We do not build advertising audiences from which service pages you visit. We do not permit third parties to collect health data through our site for their own purposes. We never pass your name, email address, or any identifier into analytics or advertising technologies.
Analytics data is set to delete after two months.
Changes to this policy
We may update this policy to reflect changes in our practices or in the law. We will post changes here and update the date at the top. Material changes affecting your rights will be communicated more directly. We will not apply a material change retroactively to data already collected without your consent.
Contact and complaints
Navara Health, PLLC
5301 Alpha Road, Suite 34, Room 21, Dallas, TX 75240
Phone and text: (469) 653-3124
Email: contact@navarahealthtx.com
If you are a Washington resident and are not satisfied with our response, you may file a complaint with the Washington State Attorney General's Office.
If you are a Nevada resident, you may contact the Nevada Attorney General's Office.
Written and clinically reviewed by Jessica Boggs, MSN, APRN, FNP-C, ENP-C, founder of Navara Health. Medical oversight by Simal Patel, MD.
Last reviewed September 6, 2026. This page is general information, not medical advice, and does not create a provider relationship.