Consumer Health Data Privacy Policy

About this policy

This policy applies to “consumer health data” as defined by Washington’s My Health My Data Act (RCW 19.373) and Nevada Senate Bill 370 (2023). It covers consumers who are Washington or Nevada residents, and people whose consumer health data is collected in those states.

It supplements our Privacy Notice, which explains our practices in full. Moonbrush Inc. (“Moonbrush,” “we,” “us” or “our”) is a U.S. behavioral intelligence company that builds scored audiences for business clients’ marketing. We do not provide health care, and we do not have a direct relationship with the consumers in our data.

What consumer health data means for Moonbrush

These laws define consumer health data broadly. It includes information that identifies, or is reasonably linkable to, a person and reveals their past, present or future physical or mental health status. It can include inferences drawn from activity that is not itself medical.

For Moonbrush, consumer health data could include:

• Inferred interest in health and wellness topics. For example, interest in fitness, nutrition, or a category of health-related products, inferred from engagement with online content and searches on those topics and from purchase categories.
• Model scores built in part from that interest. For example, a score estimating how receptive a person may be to marketing in a health or wellness category.

We build our audiences without protected health information:

• We do not ingest protected health information (PHI) in our standard services.
• We do not collect diagnoses, prescriptions, medical records, claims or patient files.
• We do not offer targeting of individuals based on a health condition.
• We do not collect precise geolocation, and we do not use geofences around places that provide health care services.
• For our standard services, we are not a business associate under HIPAA.

Categories of consumer health data we collect

Sources

• Third-party data providers and data cooperatives, from which we license behavioral information.
• Our own models, which create inferences and scores from that licensed information.

We do not collect consumer health data through moonbrush.com.

How we use it

We collect and use this data to:

• build, score and deliver audiences for clients’ marketing and engagement;
• develop and validate the models that produce those scores;
• measure how clients’ campaigns perform;
• honor privacy requests and keep the suppression records that make them last; and
• keep our systems secure, prevent misuse and comply with law.

Our client agreements prohibit using our data for healthcare diagnosis or treatment, for insurance underwriting, or for any other decision about a person’s eligibility. They also prohibit targeting that exploits acute medical or mental-health distress, or addiction or recovery status. See our Data Use and Responsible Use Policy.

With whom we share it

The table lists the categories of recipients of our data. For consumer health data of Washington and Nevada consumers, our commitment below limits what we disclose to clients and platforms.

Our commitment. Moonbrush does not sell consumer health data of Washington or Nevada consumers, and does not collect or share it for purposes that require consent under those laws unless we have that consent. In practice, we exclude Washington and Nevada consumers from the audiences and scores we build on health and wellness interests.

Your rights

If these laws apply to you, you have the right to:

• Confirm and access. Confirm whether we collect, share or sell your consumer health data, and access that data. This includes a list of all third parties and affiliates with which we have shared or sold it, with an email address or other online way to contact each of them.
• Withdraw consent. Withdraw any consent you have given for us to collect or share your consumer health data.
• Delete. Have your consumer health data deleted. We will also notify our processors, and any third party with which we shared the data, to delete it.
• Appeal. Appeal our decision if we decline to act on your request.

We will not discriminate against you for exercising these rights.

How to exercise your rights

Tell us that your request is about consumer health data, and which state you live in. Because we have no direct relationship with you, include your name, postal address and email address so we can find your record.

We verify requests by matching the name, postal address and email address you give us against the information we hold. We never ask for your Social Security number or any account number. You may use an authorized agent where the law allows it.

Timing. We respond within 45 days of receiving your request. If we need more time, we may extend that once by up to 45 more days, and we will tell you why within the first 45 days.

Appeals. To appeal, reply to our decision or email privacy@moonbrush.com with “Appeal” in the subject line. We will respond in writing within 45 days and explain our decision. If we deny your appeal, you can contact the Washington State Attorney General (for Washington consumers) or the Nevada Attorney General (for Nevada consumers). Our response will tell you how.

Changes to this policy

This policy is effective as of the date at the top of this page. When we update it, we change that date. If we make a material change, we will post a prominent notice on moonbrush.com before the change takes effect.

Contact us

Moonbrush Inc.
Attn: Privacy
5830 E 2nd Street, Suite 7000
Casper, Wyoming 82609, USA

Email: privacy@moonbrush.com\