Fundamentals
You may be feeling a profound sense of unease, a disconnect between the intimate details of your well-being that you have entrusted to a wellness app and the opaque digital world where that information resides. This feeling is a valid and intelligent response.
Your health data is a direct extension of your biological self ∞ a detailed chronicle of your body’s most personal rhythms and fluctuations. When you track your cycle, monitor your sleep, or log your moods, you are creating a dataset that is as unique to you as your own genetic code.
Understanding your right to control this data is the first step toward reclaiming a sense of agency over your digital and biological identity. The My Health My Data Act (MHMDA) is a piece of legislation that recognizes this intrinsic connection and provides a legal framework for you to exercise that control.
The journey to understanding your hormonal health often begins with data. You gather information, looking for patterns that might explain shifts in your energy, mood, or physical state. This process of self-discovery is a powerful one. It is also one that deserves protection.
The MHMDA was specifically designed to cover the types of sensitive health information that wellness apps frequently collect, information that often falls outside the protections of traditional medical privacy laws like HIPAA. This includes data related to your reproductive health, sleep patterns, biometric information, and even location data that could infer your health status or choices.
The act affirms that this information belongs to you and that you have the right to decide who has access to it and for how long.
The My Health My Data Act provides a legal pathway to erase your personal health information from a company’s digital records, including their backup systems.
At its core, exercising your right to data deletion under the MHMDA is an act of personal sovereignty. It is a declaration that your health journey is your own and that the data it generates will not be used without your ongoing consent.
The process of requesting data deletion is a tangible action you can take to protect your privacy and ensure that your personal health information remains just that ∞ personal. It is a way to draw a clear boundary between the data you use for your own wellness and the data that is used for commercial purposes.
This act of digital housekeeping is as important as any other aspect of your wellness protocol, as it safeguards the very information that underpins your health decisions.
What Is the My Health My Data Act?
The My Health My Data Act is a Washington state law that establishes new consumer rights and protections for personal health data. It was created to address a gap in existing privacy laws, which often do not cover the health-related data collected by wellness apps, websites, and other digital services.
The MHMDA gives Washington residents, and those whose data is collected in Washington, more control over how their health information is collected, used, and shared. A central component of this control is the right to have your data deleted upon request. This empowers you to manage your digital footprint in a way that aligns with your personal comfort and privacy needs.
The act defines “consumer health data” very broadly. This is a critical point to understand. It includes information that is obviously health-related, such as details about your physical or mental health conditions, diagnoses, and treatments. It also covers a wide range of other data points that can be used to infer your health status. This includes:
- Reproductive and sexual health information ∞ Data related to your menstrual cycle, fertility, contraception, and any other aspect of your reproductive health.
- Biometric data ∞ Information derived from your physical characteristics, such as your fingerprint, voiceprint, or facial geometry.
- Genetic data ∞ Your raw genetic sequence or any information derived from it.
- Precise location information ∞ Data that can identify your location with a high degree of accuracy, which could be used to infer that you have visited a healthcare provider.
- Data that can be used to infer health status ∞ Information about your purchases of certain products, your search history for health-related topics, or your use of health-related mobile applications.
This broad definition is intentional. It recognizes that in the digital age, many different types of data can be pieced together to create a detailed picture of your health and well-being. The MHMDA ensures that all of this data is protected and that you have the right to control its use and retention.
Intermediate
The process of deleting your data from a wellness app under the My Health My Data Act is a structured interaction governed by specific timelines and obligations. This is a mechanism designed to translate your abstract right to privacy into a concrete, actionable procedure.
When you initiate a deletion request, you are setting in motion a series of legally mandated steps that the wellness app’s parent company must follow. This is not a polite request; it is the exercise of a legal right.
The company is required to respond to your request within a specific timeframe, typically 45 days, and to carry out the deletion of your data across its entire network, including in its archives and backup systems. This comprehensive deletion is a key provision of the act, as it ensures that your data is not simply hidden from view but is truly erased.
Furthermore, the MHMDA requires the company to do more than just delete the data it holds directly. It must also notify any third parties with whom it has shared your data of your deletion request. This includes affiliates, data processors, and other partners.
These third parties are then also legally obligated to delete your data from their systems. This “flow-down” requirement is a powerful feature of the act, as it addresses the reality that our data is often shared with a wide network of companies, many of whom we may not even be aware of.
By requiring the company you have a direct relationship with to manage this downstream notification process, the MHMDA simplifies the process for you and ensures that your deletion request has the broadest possible impact.
Exercising your data deletion right under the MHMDA triggers a legal obligation for the company to erase your information and notify its partners to do the same.
How Do I Formally Request Data Deletion?
The first step in the data deletion process is to locate the company’s privacy policy. This document is the primary source of information about how the company handles your data and how you can exercise your rights under the MHMDA. The privacy policy should provide a clear and conspicuous method for submitting a deletion request.
This is often an email address dedicated to privacy-related inquiries, but it could also be a web form or a phone number. If you cannot find this information in the privacy policy, you may need to contact the company’s customer support and specifically ask for the contact information for the person or department responsible for handling data privacy requests under the Washington My Health My Data Act.
Once you have located the correct contact information, you will need to draft your deletion request. While there is no specific legal language you must use, it is important to be clear and direct in your communication.
Your request should state that you are a Washington resident (or that your data was collected in Washington) and that you are exercising your right to delete your consumer health data under the My Health My Data Act.
You should also provide enough information for the company to identify you and your data, such as your name, email address, and any account or user ID you may have. It is a good practice to keep a record of your request, including the date you sent it and the contact information you used.
Example Deletion Request
Here is a template you can adapt for your deletion request:
Subject ∞ Data Deletion Request under the Washington My Health My Data Act
Dear Privacy Team,
I am writing to exercise my right to delete my consumer health data under the Washington My Health My Data Act (MHMDA). I am a Washington resident, and I request that you delete all consumer health data associated with my account and my person from your systems, including any archives and backup systems.
My account information is as follows:
- Name ∞
- Email Address ∞
- Username/Account ID ∞
Please also notify all affiliates, processors, contractors, and other third parties with whom you have shared my consumer health data of this deletion request and instruct them to delete my data as required by the MHMDA.
Please confirm in writing once my data has been deleted and the relevant third parties have been notified. I expect a response to this request within the 45-day timeframe stipulated by the act.
Thank you for your prompt attention to this important matter.
Sincerely,
This template provides a clear and formal way to communicate your request and sets expectations for the company’s response. It also creates a written record of your interaction, which can be useful if you need to follow up or escalate your request.
What Happens after I Submit My Request?
Once you have submitted your deletion request, the company has a legal obligation to respond. The MHMDA provides a 45-day window for the company to process your request. The company may extend this period once by an additional 45 days if it is reasonably necessary, but it must inform you of the extension and the reason for it within the initial 45-day period.
The company must also authenticate your request, which means it will need to verify your identity to ensure that it is not deleting the wrong person’s data. The method for authentication should be reasonable and should not place an undue burden on you.
After your request has been authenticated, the company must proceed with the deletion of your data. This includes deleting it from all of its active systems, as well as from its archives and backup systems.
The act acknowledges that deleting data from backups can be a complex process, so it allows for a longer timeframe of up to six months for this part of the deletion. However, the company must ensure that the data is not used for any other purpose during this time.
The company is also required to notify its third-party partners of your request, and those partners must also delete your data. Once the deletion is complete, the company should provide you with a written confirmation.
The table below outlines the key stages of the data deletion process and the corresponding obligations for both you and the company.
| Stage | Your Action | Company’s Obligation |
|---|---|---|
| 1. Initiation | Locate the company’s privacy contact information and submit a clear, written deletion request. | Provide a clear and accessible method for submitting deletion requests in its privacy policy. |
| 2. Authentication | Provide the necessary information for the company to verify your identity. | Authenticate your request using reasonable means. |
| 3. Response | Monitor for a response from the company within the 45-day timeframe. | Respond to your request within 45 days (with a possible 45-day extension). |
| 4. Deletion | Await confirmation that your data has been deleted. | Delete your data from all systems, including archives and backups, and notify third parties to do the same. |
| 5. Confirmation | Receive written confirmation that your data has been deleted. | Provide you with written confirmation of the deletion. |
Academic
The Washington My Health My Data Act represents a significant evolution in the legal landscape of data privacy, particularly as it pertains to the complex and often sensitive data generated through personal wellness technologies. From a systems-biology perspective, the data collected by a wellness app is a digital proxy for the intricate interplay of an individual’s endocrine, metabolic, and neurological systems.
The MHMDA’s broad definition of “consumer health data” reflects a sophisticated understanding of this reality. It acknowledges that data points which may seem innocuous in isolation ∞ such as sleep patterns, dietary habits, or even location data ∞ can be aggregated and analyzed to reveal profound insights into an individual’s physiological and psychological state.
The act’s robust deletion right, therefore, can be viewed as a tool for maintaining the integrity of one’s “digital phenotype,” ensuring that this extension of the self is not subject to unauthorized or unwanted analysis.
The legal architecture of the MHMDA, particularly its provisions for data deletion, creates a new set of obligations for the entities that collect and process consumer health data. The requirement to delete data from all systems, including archives and backups, presents a significant technical challenge for many organizations.
It necessitates a deep understanding of data flows and storage architectures, as well as the implementation of robust data governance and lifecycle management policies. The “flow-down” deletion requirement, which extends the obligation to third-party data recipients, further complicates the compliance landscape.
It effectively creates a chain of responsibility, where the initial data controller is responsible for ensuring that the consumer’s deletion request is honored throughout the entire data-sharing ecosystem. This provision is a direct response to the often-opaque nature of the digital advertising and data brokerage industries, where personal data can be bought and sold multiple times without the consumer’s knowledge or consent.
The MHMDA’s comprehensive data deletion requirements compel a fundamental rethinking of data governance and lifecycle management within the wellness technology industry.
What Are the Limits of the Deletion Right?
The MHMDA, while providing a powerful right to data deletion, does include a narrow set of exceptions. These exceptions are designed to balance the consumer’s right to privacy with the legitimate needs of companies to protect their systems and to comply with legal obligations. A company may be permitted to retain certain data if it is necessary to:
- Prevent, detect, or respond to security incidents ∞ This allows a company to retain data that is necessary to investigate and mitigate a data breach or other security threat.
- Protect against fraud, harassment, or illegal activity ∞ A company can retain data that is needed to investigate and report fraudulent or other illegal activities.
- Preserve the integrity or security of its systems ∞ This exception allows a company to retain data that is essential for maintaining the stability and security of its IT infrastructure.
- Comply with a legal obligation ∞ If a company is required by another law to retain certain data, that obligation will generally override the MHMDA’s deletion right.
These exceptions are narrowly tailored and should not be used as a pretext for retaining data for other purposes. The burden is on the company to demonstrate that the retention of the data is truly necessary for one of these specified reasons.
It is also important to note that the MHMDA does not apply to data that is subject to the Health Insurance Portability and Accountability Act (HIPAA). This means that if you are seeking to delete your medical records from a hospital or other HIPAA-covered entity, you will need to follow the procedures set forth under that law, which are different from those under the MHMDA.
How Does the MHMDA Interact with Other Privacy Laws?
The My Health My Data Act is part of a growing patchwork of state-level privacy laws in the United States. While it shares some similarities with other laws, such as the California Consumer Privacy Act (CCPA), it is unique in its specific focus on health data and its more stringent requirements. The table below provides a comparative analysis of some of the key provisions of the MHMDA and the CCPA.
| Provision | Washington My Health My Data Act (MHMDA) | California Consumer Privacy Act (CCPA) |
|---|---|---|
| Scope | Focuses specifically on “consumer health data.” | Covers a broad range of “personal information.” |
| Consent | Requires opt-in consent for the collection and sharing of health data. | Generally follows an opt-out model, with opt-in required for minors. |
| Deletion Right | Provides a broad right to deletion, including from archives and backups, with limited exceptions. | Provides a right to deletion, but with more numerous and broader exceptions. |
| Private Right of Action | Includes a broad private right of action for any violation of the act. | Provides a limited private right of action, primarily for data breaches. |
This comparison highlights the MHMDA’s position as one of the most protective health data privacy laws in the country. Its emphasis on opt-in consent, its comprehensive deletion right, and its broad private right of action all contribute to a legal framework that is highly favorable to consumers. As more states consider similar legislation, the MHMDA is likely to serve as a model for how to effectively protect the privacy and security of personal health information in the digital age.
References
- Slatter, Vandana. “HB 1155 ∞ The My Health My Data Act.” Washington State Legislature, 2023.
- “My Health My Data Act.” Washington State Office of the Attorney General, 2023.
- Goldman, Eric. “Washington’s ‘My Health My Data’ Act Is a Mess.” Technology & Marketing Law Blog, 1 May 2023.
- Jelinek, Julie, and Andrew T. Serwin. “Washington’s My Health, My Data Act ∞ A Deep Dive.” IAPP, 27 April 2023.
- “The Washington My Health My Data Act ∞ Complying With New and Novel Protection for Health-Related Data.” American Bar Association, 9 April 2024.
Reflection
You have now been equipped with the knowledge and the tools to exercise your right to data deletion under the My Health My Data Act. This process is more than a technicality; it is a profound act of self-care and digital hygiene.
As you move forward in your health journey, consider the role that data plays in your life. What information are you comfortable sharing, and with whom? What are your personal boundaries when it comes to your digital privacy? The answers to these questions are deeply personal and will likely evolve over time.
The MHMDA provides a legal framework for enforcing these boundaries, but the first step is to define them for yourself. By taking control of your health data, you are not only protecting your privacy but also affirming your right to be the ultimate authority on your own well-being.
