Last Updated: November 2, 2026
This Consumer Health Data Privacy Policy applies to consumers in Washington State under the My Health My Data Act, and to consumers in Nevada and Connecticut under their consumer health data laws. It explains what consumer health data Protocol Archive (operated by PrepQ LLC) collects, why, who we share it with, and how to use your rights. It adds to our Privacy Policy, which covers all the personal data we handle.
The short version: most of our tools keep your information on your own device. We collect a small amount of health-related information only when you ask us to email you a plan or handout, or to save your progress. We use it only to provide what you asked for. We never sell it, never use it for advertising, and never share it except with the service providers that help us run the site.
What “consumer health data” means here
Consumer health data is personal information that is linked or reasonably linkable to you and that identifies your past, present or future physical or mental health. Because some of our emails and features relate to a body part or condition, we treat the following as consumer health data.
Consumer health data we collect
- Plan and handout choices linked to your email address. If you ask us to email you a plan or handout, we record which one you chose (for example, a knee arthritis plan or a sciatica handout) along with your email address, so we can send it.
- Email topics. If you click a topic link in one of our emails (for example, “back pain”), we record that topic against your email address so we can send related content.
- Saved progress (optional). If you choose “Save my progress”, we store which plans and routines you are following and the days you have ticked, linked to your email address. Pain and how-you-feel scores are stored on our server only if you tick the separate box for them.
What we don’t collect
- Pain tools: the body pain chart and visit summary run entirely in your browser. What you enter is not sent to us, and Google Analytics is switched off on those pages.
- Trackers and routine builder: ticks, routines and pain scores stay in your own browser unless you choose to save your progress.
- Directory searches: the ZIP code, postcode or location you search with is used only to sort results by distance. We don’t store it with anything that identifies you, and we count searches only by broad area.
- We don’t collect precise location, biometric or genetic data, and we don’t ask about diagnoses, medications or treatments.
Where we get it
Only from you, when you use the forms and features described above. We don’t buy health data or obtain it from other companies.
Why we collect and use it
- To send the plan, handout or emails you asked for, including each day’s session for a plan
- To save your progress and sync it across your devices, if you choose to
- To send related content when you choose a topic
- To keep the site and our emails secure, and to meet legal obligations
We don’t use consumer health data for advertising, profiling or any purpose unrelated to what you asked for.
Your consent
We collect consumer health data only with your consent, which you give when you submit a plan or handout email form, choose a topic, or turn on saved progress. Each form tells you what we will store. You can withdraw consent at any time: unsubscribe using the link in any email, use “Delete my saved progress” on any plan page, or email us. Withdrawing consent stops future collection and use; it doesn’t affect anything done before.
Who we share it with
We don’t sell consumer health data, and we don’t share it with advertisers, data brokers or other third parties for their own purposes. We share it only with service providers (“processors”) that store or handle it for us under contracts that limit their use of it:
- Email delivery and subscriber list storage (MailPoet), which stores your email address, the plans, handouts and topics you chose, and whether emails were opened or links clicked
- Web hosting and security (SiteGround), which hosts our website, database and saved progress
We have no affiliates that receive consumer health data. We may disclose information if the law requires it, for example in response to a valid court order, and we will tell you if the law allows.
Your rights
You have the right to:
- Confirm and access: find out whether we collect, share or sell your consumer health data, and get a copy of it
- Know who receives it: get a list of all third parties and affiliates with whom we have shared your consumer health data, and an active email address or other contact for each
- Withdraw consent to our collection and sharing of your consumer health data
- Delete your consumer health data. We will also tell our service providers to delete it, including from backups as those are overwritten in the normal course.
To use these rights, email hello@protocolarchive.com with the subject “Consumer health data request” and the email address you used with us. To protect your data, we will confirm the request by sending a message to that email address before we act on it. An authorized agent may make a request for you where the law allows.
We will respond within 45 days. If we need more time, we may extend this once by up to 45 more days, and we will tell you why. We won’t charge you or treat you differently for using your rights.
Appeals
If we decline to act on your request, you can appeal by replying to our decision or emailing hello@protocolarchive.com with the subject “Consumer health data appeal”. We will respond in writing within 45 days, explaining what we decided and why. If your appeal is denied, you may contact the Washington State Attorney General at atg.wa.gov/file-complaint, or your own state’s attorney general.
Security and retention
Access to consumer health data is limited to the people who run Protocol Archive and our service providers, and our site uses encrypted connections. We keep consumer health data only while you use the related feature: until you unsubscribe or ask us to delete your email details, or until you delete your saved progress. See “Data Retention” in our Privacy Policy.
Geofencing
We don’t use geofences around health care facilities to identify, track or send messages to people.
Changes
If we change this policy, we will update the date above. If we want to collect or share consumer health data in a new way, we will ask for your consent first.
Contact
hello@protocolarchive.com
Protocol Archive (PrepQ LLC), 46 Danada Square W, Wheaton, IL 60189, USA