Consumer Health Data Privacy Policy

When this policy applies

This policy applies to consumer health data that Solia Health processes through the consumer experience, for consumers in states whose consumer health data privacy laws apply to them. It does not expand or replace obligations that apply to the performing laboratory or to a licensed provider involved in your order.

Consumer health data we process

We do not collect precise location, biometric identifiers, genetic sequence data, or health data from third-party advertising sources through this implementation.

Testing selections — the panels, biomarkers, and add-ons you choose or that appear on a provider order you submit.
Result information — biomarker values and status returned by the performing laboratory and released to your account.
Testing history — prior orders and results associated with your account, used to show change over time.
Collection information — collection method, service area, appointment details, and specimen status.
Provider-order information — details of an order issued by your own provider.
Health-related account information — details such as date of birth or sex used for reference ranges and laboratory requirements.
Health-related information you volunteer in a support or privacy request.

Where it comes from

From you, when you choose testing, submit a provider order, or contact support.
From the performing laboratory, as specimen status and released results.
From ordering-provider and collection services involved in fulfilling your order.

Why we process it

Fulfilling the testing you requested and routing specimens to the performing laboratory.
Coordinating and completing collection, including recollection where a specimen is rejected.
Making released results and longitudinal history available in your account.
Supporting you when something goes wrong with an order, visit, or result.
Security, integrity, and legal or recordkeeping obligations.

Who receives it

Consumer health data is shared only with parties needed to deliver the service:

The performing laboratory.
The ordering or reviewing provider, where an order is required.
The mobile phlebotomist or partner collection site handling your visit.
Hosting, database, and messaging infrastructure operating the service, under contractual confidentiality and processing restrictions.
Others only with your direction, or where required by law.

Selling and sharing

Solia Health does not sell consumer health data, and does not disclose it for cross-context behavioral advertising or targeted advertising. No advertising or retargeting technology is deployed on this implementation, and health data is never passed to an analytics or marketing category.

If a future deployment introduces technology that could constitute a sale or share under applicable law, this policy and the opt-out control will be updated before that technology is enabled, and consent will be obtained where the law requires it.

Your rights

Depending on the law that applies to you, you may be able to confirm whether we process your consumer health data, access it, obtain a list of third parties that received it, withdraw consent, request correction, or request deletion. Rights may vary based on applicable law and your jurisdiction, and some records must be retained to meet laboratory and medical recordkeeping requirements.

Submit a request through Privacy Choices. We verify requests before acting on them and confirm when a deletion is complete. Where an appeal process applies to you, we describe it in the decision we send you.

Consent

We process consumer health data to deliver the testing you asked for. Where separate consent is required — for example, laboratory or provider consents presented during ordering, or optional analytics categories in — the consent is collected at that point and can be withdrawn. Withdrawing consent does not affect processing that already occurred, and does not undo laboratory testing already performed.

Security and contact

Consumer health data is encrypted in transit and at rest, and account records are readable only by the authenticated account holder and authorized personnel with an operational need, enforced at the database layer.

Questions reach us through the contact form; requests should use Privacy Choices. A dedicated privacy mailbox and postal address are established at deployment. If this policy changes, we update the date at the top of the page.