MHMDA Privacy Policy

Last Updated: May 10, 2024

1.   Introduction & Scope

This MHMDA Privacy Policy (“MHMDA Policy”) supplements the CoinOut Privacy Notice (“CoinOut Notice”) and applies to personal data defined as “consumer health data” subject to the Washington State My Health My Data Act (“MHMDA”) and details our practices related to the collection, use, protection, and sharing of your consumer health data.

This MHMDA Policy describes how CoinOut, wholly owned and operated by Circana, LLC (“Company” or “we” or “our” or “us”), treats consumer health data collected or provided in connection with an end user’s (“you” or “your” or “User”) use of the Company’s website at https://www.coinout.com and mobile applications (the “Services”).

Please note that your use of the Services, and any necessary consent provided, constitutes your acceptance of this MHMDA Policy as set forth herein. Please also read our standard Privacy Notice and Terms of Use (“CoinOut Notice”) and applies to personal data defined as “consumer health data” subject to the Washington State My Health My Data Act (“MHMDA”) and details our practices related to the collection, use, protection, and sharing of your consumer health data.

2.   Consumer Health Data We May Collect

As described in Section 2 (Personal Information Collected) of the CoinOut Notice, the consumer health data we collect depends on the context of your interactions with our Services. Because consumer health data is defined very broadly, many of the categories of data we collect could also be considered consumer health data. Examples of consumer health data may include, either separately or together:

• Identifiers, such as name, alias, user ID, unique personal identifier; email address, phone number, zip code and other contact information; IP address and other online identifiers.

• Commercial or transactions information, including records of products or services purchased, obtained, or considered, or other purchasing or use histories or tendencies. For example, this may include, but is not limited to: (1) receipts you submit or allow us to collect that may contain products that are considered to be consumer health data; or (2) information that you choose to share with us through our voluntary surveys.

• Profiles and inferencesProfiles and inferences, including inferences drawn from any of the information identified above to create a profile reflecting a consumer’s preferences, characteristics, behavior or attitudes, or household size/composition. For example, we combine such information with predictive analytics to uncover new consumer insights.

3.   Sources of Consumer Health Data

As described in Section 2 (Personal Information Collected) of the CoinOut Notice, we collect personal data (which may include consumer health data) directly from you, from your interactions with the Services, and from third parties.

4.   Why We Collect and Use Consumer Health Data

We collect and use consumer health data for the purposes described in Section 3 of the CoinOut Notice.Primarily, we collect and use consumer health data as reasonably necessary to provide you with the products you have requested or authorized. This primarily includes the collection of the receipts you provide to us or allow us to collect. It may also be used for services and support, analytics and improvement, marketing and advertising, and other essential business operations that support the provision of the products (such as analyzing our performance, meeting our legal obligations, and conducting research and development).

5.   Our Sharing of Consumer Health Data

We may share each of the categories of consumer health data described above for the purposes described in Section 4 (Disclosures of Personal Information) of the CoinOut Notice. In particular, we may share personal data, including consumer health data, with your consent or as reasonably necessary to complete any transaction or provide any product you have requested or authorized, as described above.

6.   Third Parties With Which We May Share Consumer Health Data

As necessary for the purposes described above, we share consumer health data with the following categories of third parties:

• Service providers. Vendors or agents (“processors”) working on our behalf may access consumer health data for the purposes described above. For example, we use service providers to help us fulfill our contests and sweepstakes and to extract and process the purchase information from receipts.

• Data partners and business customers. We may share consumer health data with other companies, for example, where you use a service that is cobranded and jointly operated with another company, or where you use our services to interact with another company.

• Third party platforms, providers and networks. We may disclose or make available consumer health data to third party platforms and providers that we use to provide or make available certain features or portions of the Services, or as necessary to respond to your requests. We may also make certain information that includes personal information available to third parties in support of our marketing, analytics, advertising and campaign management.

• Parties to a corporate transaction. We may disclose consumer health data as part of a corporate transaction or proceeding such as a merger, financing, acquisition, bankruptcy, dissolution, or a transfer, divestiture, or sale of all or a portion of our business or assets.

• Affiliates. We enable access to data across our subsidiaries, affiliates, and related companies, for example, where we share common data systems or where access helps us to provide our services and operate our business.

• Compliance and legal obligations. We may also disclose personal information to third parties to comply with our legal and compliance obligations and to respond to legal process. For example, we may disclose information in response to subpoenas, court orders, and other lawful requests by regulators and law enforcement, including responding to national security or law enforcement disclosure requirements. This may include regulators, government entities, and law enforcement as required by law or legal process.

• Security and protection of rights. We may disclose consumer health data where we believe doing so is necessary to protect the Services, our rights and property, or the rights, property and safety of others. For example, we may disclose consumer health data in order to (i) prevent, detect, investigate and respond to fraud, unauthorized activities and access, illegal activities, and misuse of the Services, (ii) situations involving potential threats to the health, safety or legal rights of any person or third party, or (iii) enforce, and detect, investigate and take action in response to violations of, our Terms of Use. We may also disclose information, including consumer health data, related to litigation and other legal claims or proceedings in which we are involved, as well as for our internal accounting, auditing, compliance, recordkeeping, and legal functions.

7.   How to Exercise Your Rights

MHMDA provides certain rights with respect to consumer health data, including rights to access, delete, or withdraw consent relating to such data, subject to certain exceptions. To exercise any of your rights pursuant to applicable law, please use one of the following methods:

• Web Form

• Email: support@coinout.com.

If your request to exercise a right under the MHMDA is denied, you may appeal that decision by contacting us via our web form (linked above). If your appeal is unsuccessful, you can raise a concern or lodge a complaint with the Washington State Attorney General at www.atg.wa.gov/file-complaint.

8.   Contact Us

For any questions or concerns about this MHMDA Policy, the CoinOut Notice, or any of our privacy practices, please contact: support@coinout.com.