Washington My Health My Data Act and Equivalent Laws
Effective date: June 4, 2026
Last updated: June 4, 2026
Applies to: Consumer health data collected through the Camellia Labs App
Scope of this policy: This policy addresses consumer health data only. It is required by and written to comply with the Washington My Health My Data Act (MHMDA), RCW 19.373, and is structured to also serve equivalent protections in other states. It contains no marketing content. For all other personal information, see our general Privacy Policy.
Camellia Labs (“Camellia,” “we,” “us,” or “our”) operates an AI skincare personalization app. This policy explains how we collect, use, store, share, and delete consumer health data, and how you can exercise your rights. As used here, “consumer health data” means personal information that identifies your past, present, or future physical or mental health status — which, for our App, includes your skin photos, self-reported skin information, and AI-generated skin assessments.
We collect only the following categories of consumer health data, and only the amount necessary to produce a useful and safe skin assessment and routine recommendation:
Facial geometry. Facial geometry may be processed by the AI during analysis but is discarded immediately and never stored. See our Biometric Data Retention and Destruction Policy.
Date of birth. We do not collect or store your date of birth as health data. It is checked in memory only to confirm you are 18 or older and then discarded; only your age range is retained.
We collect and use consumer health data only for the following purposes:
We do not sell consumer health data. We do not use it for advertising, and we do not use your photos to train AI models — ours or any vendor’s.
We collect consumer health data only with your explicit, opt-in consent. We do not use pre-checked boxes, passive consent, or bundled consent. Specifically:
You may skip photo upload and still receive a routine based on your self-reported information. We log the date and version of each consent you provide.
We share consumer health data only as described below, and never for advertising or sale:
We will not share your consumer health data with any other party, or for any other purpose, without your explicit, separate consent. Sharing consumer health data without authorization is a reportable breach under the FTC Health Breach Notification Rule.
Specific recipients. As required by the Washington My Health My Data Act, the specific affiliates and third parties with which we share consumer health data are:
[LIST EACH RECIPIENT BY NAME, WITH CONTACT INFORMATION — e.g., the AI analysis provider, the backup analysis provider, and named hosting/storage providers].
You may request an up-to-date list of all third parties and affiliates that have received your consumer health data, including their contact information, by emailing privacy@camellialabs.com.
Data processing agreements. Each processor that handles consumer health data on our behalf is bound by a written data processing agreement requiring it to process the data only on our instructions, maintain appropriate security, and honor the deletion and non-retention obligations described in this policy.
We apply the safeguards described in our general Privacy Policy and Biometric Data Retention and Destruction Policy, including AES-256 encryption at rest with separately managed keys, TLS 1.2 or higher in transit, EXIF metadata stripping before transmission and storage, private and access-controlled storage with short-lived access links only, role-restricted and logged internal access, and a prohibition on human review of any photo without your explicit, separate consent.
Under the Washington My Health My Data Act and equivalent laws, you have the right to:
• Confirm and access — learn whether we are collecting, sharing, or selling your consumer health data, and access the data we hold (your stored photos and assessments) and a list of the parties with whom we have shared it;
• Withdraw consent — withdraw your consent to our collection and sharing of your consumer health data at any time;
• Delete — request that we delete your consumer health data, including from our archived and backup systems; and
• Be free from discrimination — exercise these rights without being denied goods or services, though some features (such as photo-based progress tracking) cannot function without the underlying data.
Email privacy@camellialabs.com. For deletion, use the subject line “Data Deletion Request” and include the email address associated with your account; no other information is required. You may also withdraw consent or make other requests through this address.
We respond to your request within 45 days of receipt. Where reasonably necessary, we may extend this period once by an additional 45 days and will notify you of the extension and the reason. Responses are free of charge up to twice per year. If we decline a request, we will explain why and how you may appeal.
Deletion timeline. When you request deletion, we permanently delete your consumer health data — including all backup copies — within 30 days, and we confirm completion to you in writing. We retain only an anonymized record that a consent event occurred, as noted above.
If we deny your request, you may appeal by replying to our response or emailing privacy@camellialabs.com with the subject line “Appeal.” We will respond to your appeal in writing. You may also contact the Washington State Attorney General’s Office. The Washington My Health My Data Act provides a private right of action, meaning Washington residents may bring a legal claim directly.
We do not and will not sell your consumer health data. MHMDA requires valid authorization, separate from consent, before any sale of consumer health data; because we do not sell this data, we do not collect such authorizations. If this ever changes, we will obtain the required valid authorization and update this policy first.
We do not use geofencing in or around any facility that provides in-person health care services to identify or track consumers seeking health care, to collect consumer health data, or to send notifications, messages, or advertisements related to consumer health data or health care services. This prohibition is required by the Washington My Health My Data Act.
We maintain reasonable administrative, technical, and physical safeguards to protect consumer health data, including the controls described in Section 7 and a least-privilege access model under which personnel may access consumer health data only as necessary to perform their roles.
If consumer health data is involved in a breach of security, we will notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery, as required by the FTC Health Breach Notification Rule (16 CFR Part 318). If 500 or more individuals are affected, we will also notify the Federal Trade Commission within 10 business days and notify prominent media outlets in the affected area. Any unauthorized disclosure of consumer health data — including sharing with an analytics provider, advertising network, or AI vendor without your consent — is itself a reportable breach under that rule.
We may update this policy. We will post the updated “Last updated” date and, for material changes affecting consumer health data, notify you and obtain new consent where the law requires it before applying the change.
This policy is maintained by our designated privacy contact. For any question or request regarding consumer health data:
Camellia Labs
Consumer health data contact: privacy@camellialabs.com
Mailing address: 4Tell, LLC
115 Melrich Rd
Ste 2
Cranbury, NJ
08512-3526