Health Data Privacy Notice

Last Updated: August 27, 2025

This Health Data Privacy Notice supplements Fathom Care's Privacy Policy, providing additional details about how we collect, use, and disclose health information in compliance with state laws including Washington's My Health My Data Act and Nevada's Consumer Health Data Privacy Law.

Collection of Health Data

Depending on how you use our Services, we may collect the following categories of health data based on your discretion:

• Conditions and Diagnoses: Information about health conditions, diagnoses, and treatments
• Procedures: Information about surgeries and medical procedures
• Symptoms and Medications: Information about symptoms, medications, bodily functions, and vital signs
• Lifestyle Information: Diet, sleep, exercise, and other wellness-related data
• Medical Devices: Information about medical device usage and readings

Sources of Health Data

We collect health data from:

• Directly from You: Information you provide during account creation, when using the Services, through support requests, and in communications with us.

• Connected Services: Health information received through third-party integrations that you voluntarily connect, such as Apple HealthKit or Google Health.

• Derived Data: Health insights we generate based on information you provide.

Use of Health Data

We use your health data for the following purposes:

Service Delivery: Providing and maintaining the Services, including:

• Storing and organizing your health information
• Generating personalized health insights using AI
• Providing customer support

Protection and Compliance: Detecting security incidents, preventing fraud, protecting rights and property, and meeting legal obligations.

With Your Consent: Any additional uses require your consent as mandated by applicable law.

Disclosure of Health Data

We may disclose your health information to:

• Service Providers: Vendors and contractors who need access to provide the Services, including:

  • AI providers (such as Anthropic) for generating health insights
  • Cloud infrastructure providers for data storage
  • Analytics providers for service improvement

• Research Partners: Third parties receiving aggregated or de-identified data with your consent

• Legal Authorities: When required by law or to protect safety and rights

• Corporate Transactions: During mergers, acquisitions, or business sales

• Affiliates: Corporate parents, subsidiaries, and commonly-controlled entities

• Other Users: Information you choose to share publicly or with other users

• With Your Consent: When you explicitly authorize disclosure

Your Rights

Under applicable state laws, you may have the following rights regarding your health data:

Access: You may request access to the health data we have collected about you.

Deletion: You may request deletion of your health data, subject to certain exceptions (such as legal retention requirements).

Withdrawal of Consent: You may withdraw consent for the collection and use of your health data.

Appeal: If we deny your request, you may appeal the decision.

To exercise your rights:

1. Submit requests to support@fathom.care
2. If your request is denied, you may appeal by emailing privacy@fathom.care with "APPEAL" in the subject line

We will respond to requests within the timeframes required by applicable law.

Data Security

We implement appropriate technical and organizational measures to protect your health data, including:

• Encryption of data in transit and at rest
• Access controls limiting who can view your data
• Regular security assessments
• Employee training on data protection

Data Retention

We retain your health data for as long as your account is active or as needed to provide the Services. When you delete your account, we will delete or de-identify your health data within a reasonable timeframe, except where we are required to retain it for legal purposes.

Changes to This Notice

We may update this Health Data Privacy Notice from time to time. If we make material changes, we will notify you by updating the "Last Updated" date and, where appropriate, providing additional notice.

Contact Us

If you have questions about this Health Data Privacy Notice, please contact us:

• Email: privacy@fathom.care
• Mail: Fathom Care, Inc., 1522 Western Ave STE 24151, Seattle WA 98101