Draft. This text is not yet in effect.
This Consumer Health Data Privacy Notice (“Policy”) describes the practices of Payoff Genius, LLC, doing business as Afloat (“Afloat,” “we,” “us,” or “our”), for collecting and using your consumer health data, as that term is defined under applicable state consumer health data laws, including the Washington My Health My Data Act (RCW 19.373.005 to 19.373.900), the Nevada consumer health data law (NRS 603A.400 to 603A.550), and the Connecticut Data Privacy Act (Conn. Gen. Stat. §§ 42-515 to 42-526), and any other comparable state consumer health data laws (together, “consumer health data laws” and, the data they protect, “consumer health data”).
This Policy applies to residents of Washington, Nevada, and Connecticut, and to residents of any other state that has enacted a comparable consumer health data law. It applies to afloatfinance.com, afloatfinance.org, our Afloat mobile applications, and any other Afloat site, product, application, or service that links to this Policy (collectively, the “Service”). This Policy does not apply to any site, product, application, or service that does not directly link to this Policy.
Please read this Policy carefully to understand our policies and practices regarding your consumer health data and how we will treat it. If you do not agree with our policies and practices, you should not use the Service.
This Policy addresses only consumer health data. Other personal information we handle, and the information of individuals who are not residents of a state with a consumer health data law, is governed by our general Privacy Notice, available at afloatfinance.com/privacy and afloatfinance.org/privacy.
Consumer Health Data We May Collect About You
Afloat helps individuals and families organize financial accounts, bills, insurance policies, and legal documents in a secure vault and share access with people they choose. We do not request health information. However, documents that you or other members of your household account upload may contain consumer health data. The consumer health data we may collect is limited to information contained in those uploaded documents, and may include:
- Individual health conditions, treatment, diseases, or diagnoses.
- Diagnostic testing, treatment, or medication.
- Health-related surgeries and procedures.
- Medical insurance information.
- Data identifying a consumer seeking health care services, meaning services provided to assess, measure, improve, or learn about a person’s mental or physical health.
- Any inferences of the above categories derived, extrapolated, or inferred from non-health information.
We do not intentionally collect biometric data, genetic data, gender-affirming care information, reproductive or sexual health information, or precise location information, and we do not use the Service to track your location.
We use these categories of consumer health data for the following purposes:
- Organizing, interpreting, and displaying the documents and information you upload, and providing the features of the Service you request.
- Fulfilling the purposes for which you provided the data or that were described when it was collected and responding to your questions or requests for information.
- Facilitating the security, performance, and integrity of the Service, including preventing, detecting, and investigating security incidents, fraud, and misuse, identity verification and authorization, and quality control.
- Recordkeeping and auditing.
- Complying with our legal obligations and for other legal and compliance reasons.
This Policy does not itself serve as your consent. Where required by applicable consumer health data laws, we obtain your consent before collecting or sharing consumer health data, except to the extent necessary to provide a product or service you have requested. Because much of the information in the Service concerns family members and other individuals, if you upload a document containing another person’s consumer health data, you are responsible for obtaining that person’s consent to provide the information to us and to share it within your household account.
Consumer Health Data Sources
We collect consumer health data from the following sources:
- You, including the documents and information you upload to the Service.
- Other members of your household account, and the authorized or legal representatives, family members, and caregivers you invite, including the documents they upload.
- Your device, through cookies and similar technologies, to the limited extent described in our general Privacy Notice.
Consumer Health Data Disclosures
We do not sell your consumer health data.
We may disclose the consumer health data categories described above to processors, service providers, and contractors that help us operate and provide the Service, and its current and future affiliates. We do not disclose your consumer health data to third parties for their own purposes.
We instruct these processors, service providers, contractors, and affiliates to use consumer health data only as permitted by our contracts with them and consistent with applicable law.
We may also disclose consumer health data as permitted by applicable law, including:
- With your consent.
- To prevent, detect, protect from, or respond to security incidents, identity theft, fraud, harassment, or malicious or deceptive activities.
- To a third party acquiring our assets if Afloat sells its business or otherwise is part of a merger, acquisition, bankruptcy, or other transaction involving a third party taking control of our assets or business. If you do not want your consumer health data transferred in that situation, you may opt out by deleting your account before the transfer takes effect.
- To investigate, report, or take legal action to protect the rights, property, and safety of Afloat and others.
- To protect your or others’ vital interests, including health and safety.
We do not use a geofence to establish a virtual boundary around any health care facility to identify or track consumers seeking health care services, to collect consumer health data, or to send consumers health-care-related notifications, messages, or advertisements. We do not sell consumer health data; if this ever changes, we will first obtain the separate consumer authorization that applicable law requires.
This Policy, and the consumer health data laws, do not apply to information regulated by the Health Insurance Portability and Accountability Act (HIPAA) or to financial information regulated by the Gramm-Leach-Bliley Act (GLBA).
Your Privacy Rights
If you are a resident of a state with a consumer health data law, you have the right to:
- Request confirmation of whether we collect, share, or sell your consumer health data.
- Request access to your consumer health data that we have collected or control, including a list of all third parties and affiliates with whom we have shared or sold it and the means to contact them.
- Withdraw your consent to our collection and sharing of your consumer health data.
- Request that we delete your consumer health data.
We will not discriminate against you for exercising any of these rights. To exercise any of your rights, please contact us at support@afloatfinance.org. We may need to verify your identity before processing your request, and where another member of your household administers your account, we may need to coordinate your request with that member.
Contact Information
To make an inquiry or comment about this Policy or our consumer health data practices, contact us at:
302-219-7610
Payoff Genius, LLC
8 The Green #14144
Dover, DE 19901