Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy explains how Caseworth, CO. ("Caseworth," "we," "us," "our") collects, uses, shares, and protects consumer health data. It is provided in addition to our general Privacy Policy and is intended to satisfy the standalone-notice requirement of Washington's My Health My Data Act (MHMDA) and to address similar consumer health data laws, such as Nevada's SB 370 and the health provisions of the Colorado Privacy Act.

"Consumer health data" means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status. If you are a Washington consumer (or a consumer in another state with a comparable law), this Policy describes your rights and how to exercise them. Where a term is not defined here, it has the meaning given in our general Privacy Policy.

Caseworth, CO. is a Delaware corporation and currently makes its Services available in approximately 13 U.S. states. This Policy applies to consumer health data we collect through our consumer Lexstimate tool, where Caseworth acts as the controller of the data you provide.

1. What Consumer Health Data We Collect

To generate the Lexstimate case-value report you request, we ask you to provide information that qualifies as consumer health data. This includes:

• Medical records and documents you upload, such as treatment records, medical bills, and imaging or diagnostic reports.
• Injury and health facts you enter, including the nature, cause, severity, and timeline of an injury and the treatment you received.
• Diagnosis and procedure codes (ICD, CPT, and similar codes) associated with your care.
• Case and claim details that reveal or relate to your physical or mental health condition, diagnosis, treatment, or health-care history.
• Any other health-related information you choose to enter into the Lexstimate tool in connection with your report.

We ask that you provide only the health information needed for the report you request, and that you not submit health data about other people without their permission.

2. Sources of Consumer Health Data

We collect consumer health data directly from you — through the files you upload and the information you enter into the Lexstimate tool. We do not purchase consumer health data from data brokers, and we do not collect it from other third-party sources for the purpose of generating your report.

3. How We Use Consumer Health Data

We use your consumer health data only for the purposes described below:

• To deliver the report you requested. We process your medical records, injury facts, and codes to generate the specific Lexstimate case-value report you asked for.
• To operate and secure that service. We use the data as reasonably necessary for security, fraud prevention, error monitoring, and compliance with our legal obligations in connection with delivering your report.

Secondary uses require your separate opt-in consent. We will not use your consumer health data for any purpose beyond delivering the report you requested — for example, using your medical content to train or improve our models, or to build our internal knowledge graph — unless you provide separate, affirmative opt-in consent for that specific use. You may decline, and you may withdraw a previously given consent at any time. Declining or withdrawing consent will not affect your access to the report you paid for.

4. Who We Share Consumer Health Data With

We do not share your consumer health data except with service providers (subprocessors) who process it on our behalf, under contract, and only as needed to deliver the Lexstimate report and operate the platform — for example, our hosting and database provider, our payment processor, and our error-monitoring provider. The specific named subprocessors, their providers, and the categories of data they receive are listed in the subprocessor tables of our general Privacy Policy (see "Named Subprocessors, Tracking Technologies, and Analytics Services"); we do not restate them here.

We may also disclose consumer health data where required by law or valid legal process, or to protect the rights, property, or safety of our users, Caseworth, or others. We do not disclose your consumer health data to any third party for that party's own independent purposes without your consent.

5. We Do Not Sell Consumer Health Data

Caseworth does not sell consumer health data. Consistent with MHMDA, we will not sell — or offer to sell — your consumer health data without first obtaining a valid, written MHMDA authorization signed by you that meets the statute's requirements. We currently have no such sale program and do not sell consumer health data for any purpose.

6. No Geofencing

Caseworth does not use geofences around health-care facilities, or around any other location, to identify or track consumers, to collect consumer health data, or to send notifications, advertisements, or messages related to consumer health data.

7. Your Rights and How to Exercise Them

If you are a Washington consumer (or a consumer in another state with a comparable consumer health data law), you have the following rights with respect to your consumer health data:

• Right to know / access: to confirm whether we are processing your consumer health data and to access that data, including a list of the categories of third parties and specific persons with whom we have shared it.
• Right to delete: to request that we delete your consumer health data.
• Right to withdraw consent: to withdraw consent to our collection or use of your consumer health data, including any consent you previously gave for a secondary use such as model training.

To exercise any of these rights, contact us at privacy@caseworth.io. We will verify your request as required by applicable law before acting on it, and we will respond within the timeframe the law requires.

Appeals. If we decline to act on your request, you may appeal that decision by contacting us at privacy@caseworth.io with the subject line "Consumer Health Data Appeal." We will respond to your appeal in writing and explain the reasons for our decision. If you believe your rights under the My Health My Data Act have not been honored, you may also file a complaint with the Washington State Attorney General's Office.

8. Data Security and Retention

We apply technical and organizational safeguards designed to protect consumer health data against unauthorized access, use, or disclosure. These measures, including our use of encryption and access controls, are described in more detail in our general Privacy Policy.

We retain consumer health data only for as long as reasonably necessary to deliver the report you requested and to meet the security, legal, and compliance purposes described above, after which it is deleted or de-identified.

9. Changes to This Policy

We may update this Consumer Health Data Privacy Policy from time to time. The "Last updated" date at the top of this Policy indicates when it was last revised. Material changes affecting consumer health data will be reflected here.

10. Effective Date and Contact

This Policy is effective as of the "Last updated" date shown above. If you have questions about this Policy or wish to exercise your rights, contact us at:

Caseworth, CO.
131 Continental Drive, Suite 305
Newark, Delaware 19713
Email: privacy@caseworth.io

This Consumer Health Data Privacy Policy supplements, and should be read together with, our general Privacy Policy.