This Washington Consumer Health Data Privacy Policy is published by Wren Clinical LLC ("Wren Clinical," "we," "us") for WrenEHR in accordance with RCW 19.373.020. It describes how we treat "consumer health data" as defined by Washington's My Health MY Data Act (RCW 19.373.010) with respect to Washington residents.
1. Our Position
WrenEHR is a business-to-business electronic health record and practice-management platform used by mental health practices. Wren Clinical does not collect "consumer health data" as defined in RCW 19.373.010 from Washington consumers. Specifically:
- Client data processed through the Platform on behalf of a practice – including client records, clinical notes, session transcripts, generated documentation, and information clients and their parents or guardians enter in the practice's client portal – is Protected Health Information (PHI) that Wren Clinical processes as a business associate of that practice under the Health Insurance Portability and Accountability Act (HIPAA). It is exempt from the My Health MY Data Act under RCW 19.373.100(1)(a)(i) and (1)(b)(i).
- Practice staff account data that Wren Clinical collects for staff accounts (name, email address, practice name, professional and licensing details, authentication data, and usage metadata) is not linked or reasonably linkable to any individual's physical or mental health status and therefore does not meet the statutory definition of consumer health data in RCW 19.373.010(8). It is also collected from individuals acting in an employment context, who are excluded from the definition of "consumer" in RCW 19.373.010(7).
Because we do not collect consumer health data, the categorical disclosures required by RCW 19.373.020(1) are reported as "not applicable" below. We publish this Policy to satisfy the publication requirement of RCW 19.373.020(1) and to inform Washington residents of our position.
2. Required Disclosures (RCW 19.373.020(1))
| Required disclosure | Wren Clinical |
|---|---|
| Categories of consumer health data collected and purposes | None collected. |
| Categories of sources from which consumer health data is collected | None collected. |
| Categories of consumer health data shared | None shared (because none collected). |
| Categories of third parties and specific affiliates with whom consumer health data is shared | None. |
| How consumers may exercise RCW 19.373.040 rights (access, deletion, withdrawal of consent) | Because Wren Clinical does not collect consumer health data, RCW 19.373.040 rights are not actionable against us. If you believe Wren Clinical has collected your consumer health data and wish to exercise a right under RCW 19.373.040, contact support@wrenclinical.com and we will investigate and respond within forty-five (45) days, consistent with RCW 19.373.040(1)(g). |
3. No Sale, No Sharing for Advertising
Wren Clinical does not sell consumer health data. Wren Clinical does not share consumer health data for advertising or marketing purposes. Wren Clinical does not use consumer health data to serve targeted advertising. Wren Clinical does not geofence any health care facility as prohibited by RCW 19.373.080.
4. Client Rights Regarding Protected Health Information
Washington residents whose Protected Health Information is processed through WrenEHR – including through a practice's client portal – should contact that practice directly to exercise rights under HIPAA. The practice is the HIPAA covered entity and is responsible for responding to client requests under 45 CFR §§ 164.524, 164.526, and 164.528. Wren Clinical processes that information only on the practice's behalf and will assist the practice as its business associate agreement requires, but cannot act on a client's request without the practice's instruction.
5. Contact
Questions about this Washington Consumer Health Data Privacy Policy may be directed to support@wrenclinical.com.
6. Changes
Wren Clinical may update this Policy at any time by posting a revised version at ehr.wrenclinical.com/legal/wa-consumer-health-data. Material changes will be communicated by email to the administrators of each affected WrenEHR practice account.