Consumer Health Data Privacy Policy
PADO Psychological Wellness, PLLC
Effective and last updated: September 17, 2026
Scope
This policy addresses consumer health data subject to Washington’s My Health My Data Act (RCW 19.373). It applies to Washington residents and other consumers whose covered data is collected in Washington. Information exempt under the Act, including protected health information governed by HIPAA and qualifying health care information under RCW 70.02, is handled under the applicable clinical privacy rules rather than this policy.
Categories collected, purposes, and sources
Inquiries about care. When you contact PADO through the website form or email, you may provide information about seeking mental health services, your concerns or symptoms, and preferences such as language, availability, or type of service. Your name and contact details may be linked to that information. PADO uses it to respond to your request, discuss fit, and arrange requested consultations or services. The source is you, or a person you authorize to contact PADO for you.
Health-related website activity. Squarespace website logs and analytics may record pages viewed, referring links, visit times, browser and device details, IP addresses, cookie identifiers, and approximate location inferred from an IP address. When reasonably linkable to a person and identifying that person’s health status or seeking of health care, these data may qualify as consumer health data. They are used to operate and secure the website and understand visits and traffic sources. The sources are your browser or device and website hosting, analytics, and security technologies. Reading a page alone does not establish a diagnosis.
Form security data. Google reCAPTCHA receives device and interaction information in connection with the contact form for spam and abuse prevention. This policy covers that information to the extent it constitutes consumer health data under the Act.
Categories disclosed and recipients
PADO’s website and communication services receive information in these categories:
- Website hosting, form delivery, and analytics: Squarespace receives website activity and information submitted through the contact form, including any health-related content you choose to include.
- Email and communications: Google Workspace processes inquiry messages, contact details, and health-related content sent through PADO’s email service.
- Website security and spam prevention: Google reCAPTCHA receives browser, device, and interaction information associated with use of the contact form.
These are the categories of service providers and, to the extent they act independently rather than as processors, third parties receiving the data described above. Disclosure to a processor is excluded from “sharing” under the Act only when the applicable legal conditions are met. PADO has no affiliated entities receiving consumer health data under this policy.
PADO’s policy is not to sell consumer health data or use it for targeted advertising. A sale would require a separate valid authorization under the Act; this policy is not an authorization. Collection and sharing requiring consent must have the applicable consent, including separate consent for sharing where required. Publishing this policy or continuing to browse does not provide that consent.
Your rights and how to exercise them
To exercise rights under the Act, email Dr. Yeji Son at yeji@padopsychology.com with the subject “Consumer Health Data Request.” You may write in English or Korean. Describe the right you wish to exercise without sending clinical details or identification documents in the initial email. PADO will arrange an appropriate way to verify your identity and communicate securely. You do not need to create a new account.
Subject to the Act’s scope and exceptions, you may:
- Confirm whether PADO collects, shares, or sells your consumer health data and access that data.
- Obtain a list of third parties and affiliates with whom your data has been shared or sold, including an active email address or other online contact mechanism for those third parties.
- Withdraw consent to collection and sharing.
- Request deletion of your consumer health data. PADO will notify relevant recipients as required so they can honor the deletion request. Deletion from archived or backup systems may be delayed as permitted by the Act, but no longer than six months after authentication of the request.
PADO will respond without undue delay and within 45 days after receipt. If reasonably necessary because of the complexity or number of requests, PADO may extend that period once by up to 45 additional days and will notify you within the initial period with the reason. Information in response to requests is provided free of charge up to twice annually, subject to the Act’s provisions for manifestly unfounded, excessive, or repetitive requests.
Appeals. If PADO declines your request, you may appeal by emailing the same address with the subject “Consumer Health Data Appeal” and explaining what you would like reconsidered. PADO will provide a written decision and reasons within 45 days after receiving the appeal. If the appeal is denied, you may contact the Washington Attorney General to submit a complaint; PADO will also provide a complaint contact method in its response.
Changes to these disclosures
Before collecting, using, or sharing additional categories of consumer health data or using it for additional purposes, PADO will make the required disclosures and obtain affirmative consent as required by the Act. The revision date above identifies the current version of this policy.