Consumer Health Data Privacy Policy
Chime Health Group LLC respects the privacy of information concerning an individual’s health and healthcare.
This Consumer Health Data Privacy Policy describes how Chime Health may collect, use, disclose, and protect consumer health data where applicable state privacy laws provide additional protections.
This policy supplements Chime Health’s general Privacy Policy and HIPAA Notice of Privacy Practices.
Consumer Health Data We May Collect
Depending on the services requested, consumer health data may include:
- Health conditions, symptoms, medical history, and treatment information.
- Information provided through health assessments, questionnaires, or intake forms.
- Prescription and medication information.
- Laboratory testing information and results.
- Information concerning healthcare services requested or received.
- Treatment preferences and eligibility information.
- Information communicated to healthcare providers through the Chime Health platform.
- Information reasonably necessary to coordinate telemedicine, laboratory, pharmacy, or related healthcare services.
Chime Health collects consumer health data as reasonably necessary to provide requested services, operate the platform, comply with legal obligations, protect patients and the platform, and carry out other purposes disclosed to the consumer as permitted by applicable law.
Sources of Consumer Health Data
Consumer health data may be collected from:
- You directly, including through forms, questionnaires, intake processes, communications, and the patient platform.
- Licensed healthcare providers involved in your care.
- Laboratories involved in services requested by or provided to you.
- Licensed pharmacy partners involved in prescription fulfillment.
- Service providers supporting requested healthcare or platform services.
- Other sources where permitted or required by applicable law.
How Consumer Health Data May Be Used
Where permitted by applicable law, consumer health data may be used to:
- Provide and coordinate requested healthcare services.
- Determine service or treatment eligibility.
- Facilitate communication with licensed healthcare providers.
- Facilitate laboratory testing.
- Facilitate lawful prescription fulfillment.
- Maintain patient and service records.
- Provide customer and patient support.
- Protect against fraud, misuse, security threats, or unlawful activity.
- Operate, maintain, and improve Chime Health services.
- Comply with legal, regulatory, licensing, and professional obligations.
Sharing of Consumer Health Data
Chime Health may disclose consumer health data where reasonably necessary to provide services requested by the consumer or where otherwise permitted or required by applicable law.
Categories of consumer health data that may be shared include:
- Health assessment and intake information.
- Treatment-related information.
- Prescription and medication information.
- Laboratory information.
- Information necessary to coordinate requested healthcare services.
- Other consumer health data reasonably necessary to provide or support requested services.
Recipients may include:
- Licensed healthcare providers involved in the patient’s care.
- Licensed pharmacy partners involved in prescription fulfillment.
- Laboratories involved in requested testing or related services.
- Technology and service providers processing information on Chime Health’s behalf and subject to applicable contractual, privacy, security, or confidentiality requirements.
- Government authorities, regulators, courts, or other parties where disclosure is permitted or required by applicable law.
Sale of Consumer Health Data
Chime Health does not sell consumer health data as the term “sale” is defined under applicable consumer health privacy laws.
Consumer Health Data Rights
Depending on applicable state law, consumers may have the right to:
- Confirm whether Chime Health collects or processes consumer health data concerning them.
- Access consumer health data maintained about them.
- Request correction of inaccurate consumer health data.
- Request deletion of certain consumer health data.
- Withdraw consent for certain future collection or sharing of consumer health data.
- Obtain information concerning certain third parties or affiliates with whom consumer health data has been shared.
- Appeal certain decisions regarding privacy requests where applicable law provides an appeal right.
These rights may be subject to exceptions or limitations under applicable law, including medical-record retention, healthcare, regulatory, security, fraud-prevention, and other legal requirements.
How to Exercise Consumer Health Data Rights
Requests may be submitted to:
Chime Health Group LLC
Privacy Officer
Chime Health may request information reasonably necessary to verify the identity of the individual submitting the request.
Consumers are not required to create a new account solely to submit a privacy request.
Chime Health will respond within the timeframe required by applicable law.
Authorized Representatives
Where permitted by applicable law, an individual may authorize another person to submit a privacy request on their behalf.
Chime Health may request documentation reasonably necessary to verify the representative’s identity and authority.
Withdrawal of Consent
Where Chime Health relies upon consent for the collection or sharing of consumer health data, the consumer may withdraw that consent for future collection or sharing by contacting:
Withdrawal will not affect processing that was lawful before consent was withdrawn.
Deletion Requests
Where applicable law provides a deletion right, Chime Health will process authenticated deletion requests in accordance with applicable legal requirements.
Where required by applicable law, deletion requests will also be addressed with applicable processors, service providers, or other recipients of the consumer health data.
Certain information may continue to be retained where required or permitted by medical-record retention laws, healthcare regulations, legal obligations, security requirements, fraud-prevention requirements, or other applicable law.
Appeals
Where applicable law provides a right to appeal a decision concerning a consumer health data request, appeals may be submitted to:
Please include:
Privacy Request Appeal
in the subject line.
Consumer Health Data Security
Security
Chime Health maintains administrative, technical, and physical safeguards designed to protect consumer health data from unauthorized access, use, disclosure, alteration, or destruction.
Access to consumer health data is limited to individuals and service providers with an appropriate clinical, operational, legal, or business need.
Tracking Technologies / Health Data Safeguard
Do not deploy advertising pixels, advertising tracking technologies, session-recording tools, or similar technologies on:
- Patient portals
- Authenticated patient areas
- Health assessments
- Medical questionnaires
- Patient intake forms containing health information
- Clinical communications
- Pages displaying medical records
- Pages containing PHI or consumer health data
unless the specific technology and use have been reviewed and approved for that context.
If any such technologies are currently installed on these areas, please flag them before making changes.
Do not simply remove existing technology without first reporting what is installed and where.
Changes to the Consumer Health Data Policy
Changes to This Policy
Chime Health may update this Consumer Health Data Privacy Policy as applicable laws, services, or data practices change.
Where required by applicable law, Chime Health will provide appropriate notice and obtain any required consent before materially changing the collection, use, or sharing of consumer health data.
The current version and effective date will remain publicly available on this page.
Privacy Change Control
Going forward, please flag any proposed website or platform change that materially changes:
- The types of health information collected.
- The purposes for which health information is collected or used.
- The parties receiving health information.
- Tracking or analytics technologies used on health-related pages.
- Patient intake processes.
- Privacy-request procedures.
- Consumer consent processes.
These changes may require the applicable privacy policies to be updated before deployment.