HIDEF Physical Therapy — Consumer Health Data Privacy Policy

Effective Date: May 8, 2026 Last Updated: May 8, 2026

Purpose of This Policy

This Consumer Health Data Privacy Policy is provided in compliance with Washington's My Health My Data Act, RCW 19.373 ("MHMDA"). It describes how HIDEF Physical Therapy and HIDEF Sports & Physical Therapy (collectively, "HIDEF," "we," "our," or "us") collect, use, share, and protect consumer health data about Washington consumers.

This Policy is one of three documents that govern how we handle your information:

• Our Website Privacy Policy covers general Site information collection, such as cookies, IP addresses, and analytics

• Our Notice of Privacy Practices covers protected health information ("PHI") under HIPAA, including any information you submit through appointment requests, contact forms, or other forms that include health, appointment, or treatment context. HIDEF has a Business Associate Agreement ("BAA") in place with our Site platform vendor (Wix), which means form submissions involving health, appointment, or treatment information are protected under HIPAA from the moment of submission

• This Consumer Health Data Privacy Policy covers consumer health data that is not governed by HIPAA — primarily, anonymous Site activity that may reveal health interests before you submit any identifying information through a form

Where MHMDA and HIPAA overlap, HIPAA generally controls. This Policy therefore applies to a narrower set of data than MHMDA might otherwise reach.

1. What Is "Consumer Health Data"?

Under MHMDA, consumer health data is personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status.

For HIDEF, the consumer health data covered by this Policy primarily includes:

• The fact that you visited or interacted with our Site

• Anonymous Site activity (page views, time on page, click patterns) that may indicate interest in particular health services

• Inferences drawn from your Site activity that may be associated with a health condition

• Precise geolocation information that could identify a visit to a healthcare provider, when you affirmatively share it

Information you submit through forms that include health, appointment, or treatment context is treated as PHI under HIPAA from the moment of submission, governed by our Notice of Privacy Practices, and protected by our BAA with our Site platform vendor.

2. Categories of Consumer Health Data We Collect

We may collect the following categories of consumer health data through the Site:

CategoryExamples

Site activity tied to health contextPages viewed (e.g., "ACL Recovery," "Pelvic Health"), time on page, scroll depth, aggregate click patterns

InferencesPatterns drawn from your Site activity that may indicate interest in a particular condition, body part, or service

Precise geolocationOnly when you affirmatively share location to find a clinic; we do not passively track precise location

We do not collect biometric data through the Site. Information you submit through forms that includes health, appointment, or treatment context is governed by our Notice of Privacy Practices, not this Policy. Biometric data collected during clinical care (such as force plate data or dynamometry) is also governed by our Notice of Privacy Practices.

3. Sources of Consumer Health Data

We collect consumer health data primarily from your device, through cookies, analytics tools, and aggregate Site interaction data you have consented to.

Information you provide directly through forms that include health, appointment, or treatment context is collected as PHI and governed by our Notice of Privacy Practices, not this Policy.

4. How We Use Consumer Health Data

We use consumer health data only for the following purposes:

• Operating and improving the Site and patient-facing communications in aggregate

• Detecting, preventing, and responding to security incidents and fraud

• Complying with legal obligations

We do not use consumer health data for targeted advertising. We do not sell consumer health data.

5. With Whom We Share Consumer Health Data

We share consumer health data only with the following categories of recipients, and only as needed to operate the Site or comply with law:

Recipient CategoryPurpose

Wix (Site platform, under a Business Associate Agreement)Host the Site and process Site activity data

Google AnalyticsAggregate traffic analysis

Legal authoritiesWhen required by law, subpoena, or court order

Successor entitiesIn the event of a merger, acquisition, or sale of assets

We do not share consumer health data with advertisers, data brokers, or social media platforms.

6. Sale of Consumer Health Data

HIDEF does not sell consumer health data. Under MHMDA, "sale" means the exchange of consumer health data for monetary or other valuable consideration. We do not engage in such exchanges. If our practices ever change, we will obtain a separate, valid written authorization from you before any sale, as required by RCW 19.373.030.

7. Your Rights Under MHMDA

As a Washington consumer, you have the following rights regarding your consumer health data:

A. Right to Confirm and Access

You have the right to confirm whether we are collecting, sharing, or selling your consumer health data, and to access that data.

B. Right to Withdraw Consent

You have the right to withdraw consent for our collection and sharing of your consumer health data at any time. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.

C. Right to Delete

You have the right to request deletion of your consumer health data. We will honor deletion requests and notify any affiliates, processors, contractors, or third parties with whom we have shared the data, who must also delete it (subject to limited exceptions under MHMDA).

D. Right to Appeal

If we deny your request, you may appeal that denial. We will respond to appeals within 45 days. If we deny your appeal, you may file a complaint with the Washington State Attorney General at https://www.atg.wa.gov/file-complaint.

8. How to Exercise Your Rights

To exercise any right under this Policy, contact us using one of the methods below. We will not require you to create an account in order to make a request.

Email: business@hidefpt.com

Mail: HIDEF Physical Therapy Attn: W. Zach Smith, Privacy Officer — Consumer Health Data 17709 SE 272nd St Suite C Covington, WA 98042

We will:

• Acknowledge your request within 10 business days

• Respond substantively within 45 days (extendable by an additional 45 days where reasonably necessary, with notice to you)

• Verify your identity using information already on file or, where necessary, additional information you provide

• Notify you of our decision and, if denied, your right to appeal

There is no fee for the first request in any 12-month period. We may charge a reasonable fee for additional or excessive requests, or decline to act, as permitted by MHMDA.

9. Data Security

We protect consumer health data using reasonable administrative, technical, and physical safeguards, including encryption in transit, access controls, vendor due diligence, and employee training. We limit access to consumer health data to personnel who need it to perform their duties.

10. Changes to This Policy

We may update this Policy from time to time. Material changes will be posted on the Site with an updated "Last Updated" date. We will provide additional notice as required by MHMDA.

11. Contact

W. Zach Smith, Privacy Officer HIDEF Physical Therapy 17709 SE 272nd St Suite C Covington, WA 98042 Email: business@hidefpt.com

To file a complaint with the Washington State Attorney General: https://www.atg.wa.gov/file-complaint

HIDEF Physical Therapy — The Best Is Ahead