Consumer health privacy

Consumer health data privacy policy

Care Path Compare publishes educational information about telehealth and healthcare programs. This separate policy describes the consumer health data categories that may be processed through optional measurement, the purposes for that processing, the entities involved, and the choices available to consumers.

Scope

This policy is intended to provide disclosures associated with consumer health data laws, including Washington’s My Health My Data Act and Nevada’s consumer health data provisions in NRS Chapter 603A, when those laws apply. It supplements the general privacy policy and does not replace the privacy policies of clinics, pharmacies, affiliate networks, or other third-party sites.

Categories of consumer health data that may be collected

Care Path Compare does not ask visitors to create a health profile, submit medical records, or provide diagnosis, medication, prescription, insurance, or eligibility information. Optional analytics may process limited information that could be treated as consumer health data because the site discusses healthcare topics. That limited information may include:

• A first-party analytics identifier and session information used by Google Analytics.
• Browser, device, approximate location, and general technical information.
• A generic page category such as home, hub, article, policy, or contact.
• Opaque affiliate, destination, source-page, and CTA tokens plus general CTA placement.
• Fixed first-party interaction signals such as article view, scroll milestones, pricing-section reach, comparison-table visibility, CTA visibility or selection, and internal research-link selection, recorded with an opaque page token and coarse device class.
• Your analytics consent or withdrawal choice stored locally in your browser.

Our custom Google Analytics implementation does not send provider names, medication names, descriptive healthcare page paths, article titles, destination domains, affiliate-network names, or affiliate program identifiers. Our separate first-party aggregate interaction table does not store those descriptive fields, raw link text, free-text input, IP addresses, cookies, session identifiers, or user identifiers.

Sources of the data

The information described above may come from your browser or device, your interactions with the site, first-party local storage, and hosting infrastructure used to deliver and secure the site. A short-lived regional lookup may use Vercel request headers to determine whether the stricter health-data consent experience should be presented. Care Path Compare does not store the returned state value in Google Analytics or in its aggregate interaction table.

Purposes and manner of collection, use, and processing

When permitted or consented to, the information is processed to:

• Measure broad site usage using non-descriptive page categories.
• Count approved affiliate-link interactions using opaque tokens.
• Measure aggregate article engagement, including scroll depth, pricing-section reach, table visibility, CTA engagement, and progression to other Care Path Compare research.
• Compare general CTA placement performance.
• Identify technical problems, abuse, or security threats.
• Improve navigation, content organization, and consumer disclosures.

Care Path Compare does not use this information to diagnose a condition, determine treatment eligibility, provide medical advice, create advertising audiences, or personalize healthcare recommendations.

First-party aggregate interaction processing

On English-language editorial articles, after optional measurement is permitted or consented to, Care Path Compare may send a fixed interaction category, opaque page token, and coarse device class to a same-site measurement endpoint. The endpoint adds the event directly to a daily aggregate counter in Care Path Compare’s private intelligence database. Individual raw interaction records are not retained in that table, and no separate tracking cookie or session identifier is created for this system.

Care Path Compare can resolve the opaque page token internally to evaluate the performance of its own content. The aggregate interaction counters are not sent to Google Analytics or an affiliate network. They are used to distinguish issues such as low article engagement, low CTA visibility, or low CTA selection without collecting form answers or descriptive health browsing details in the measurement payload.

Categories of consumer health data shared

After the applicable consent, sanitized analytics identifiers, session information, generic page categories, opaque affiliate tokens, and CTA placement may be shared with Google Analytics for measurement and reporting. Provider names, medication names, descriptive healthcare URLs, and destination domains are excluded from our custom Google Analytics events.

The first-party aggregate interaction counters described above are stored by Care Path Compare and are not shared with Google Analytics. Hosting and security providers may process request information needed to serve pages, determine the applicable privacy experience, prevent abuse, and protect the site. Care Path Compare does not sell consumer health data and does not currently share covered consumer health data with a corporate affiliate.

Third parties, processors, and affiliates involved

• Google LLC, which provides Google Analytics after the applicable analytics and sharing consent has been granted.
• Vercel Inc., which provides hosting, content delivery, request routing, regional request headers, serverless execution for the first-party aggregate measurement endpoint, security, and related infrastructure.
• Neon, Inc., which provides the private database used by Care Path Compare’s intelligence system, including the daily aggregate interaction counters described above.
• Formspree, Inc., which processes contact-form submissions, including a privacy request or appeal that you choose to submit through the contact form. Do not include medical records or other sensitive health details in the form.

Selecting an affiliate link takes you to a separate provider, retailer, or affiliate-network site. That destination applies its own privacy policy. Care Path Compare’s Google Analytics event is sent before navigation only when measurement is permitted and uses opaque tokens rather than descriptive healthcare paths or destination names. Under the current stricter health-data consent design, Care Path Compare does not append optional affiliate-network attribution sub-IDs for visitors in Washington or Nevada.

Display advertising and consumer health data

Under Care Path Compare’s initial Google AdSense design, display advertising is not loaded for visitors in Washington or Nevada. A browser sending a Global Privacy Control signal is also treated as ineligible for Care Path Compare display advertising. This exclusion is separate from the optional analytics choices described above and does not limit access to editorial content.

If display advertising is later enabled for eligible visitors outside those excluded regions, Care Path Compare intends to request non-personalized advertising and not use site activity to create or target a health-related advertising audience. See the general privacy policy for the broader Google advertising-cookie disclosures and advertising preference options.

Cross-site collection

Care Path Compare does not intentionally authorize Google Analytics or another analytics provider to build cross-site health profiles for Care Path Compare. Advertising storage, Google Signals, advertising personalization, and advertising user-data features are disabled in our configured analytics measurement flow. The first-party aggregate interaction system is same-site and does not create a cross-site identifier. When you intentionally leave Care Path Compare for a provider, retailer, or affiliate-network site, that separate site may collect information under its own privacy policy.

Consent for Washington and Nevada visitors

Care Path Compare currently uses its stricter health-data opt-in flow for visitors in Washington and Nevada. Those visitors are asked to make two separate choices before optional measurement begins: consent for Care Path Compare to collect the sanitized measurement information, including the aggregate first-party interaction signals described above, and separate consent to share the sanitized Google Analytics information with Google Analytics. Declining analytics does not limit access to the site or its content.

Your rights and choices

Depending on applicable law, you may have the right to:

• Confirm whether Care Path Compare is collecting, sharing, or selling consumer health data.
• Access consumer health data associated with you and information about recipients.
• Withdraw consent from future collection or sharing.
• Request deletion of consumer health data.
• Ask to review or correct responsive information when applicable.
• Appeal a refusal to act on a request when an appeal right applies.

Use Analytics preferences in the footer to withdraw future analytics consent. You may also clear this site’s cookies and local storage. A Global Privacy Control signal keeps optional analytics and first-party interaction measurement disabled.

Submitting an access, deletion, or other health-data privacy request

Use the contact form and identify the message as a “consumer health data privacy request.” Do not include medical records, diagnosis details, medication information, or other sensitive health information in the message. Care Path Compare may request limited additional information when reasonably necessary to authenticate the request and determine whether responsive data can be located.

Because the first-party behavior table contains daily aggregate counters without user or session identifiers, Care Path Compare generally cannot use that table to locate a record associated with an individual visitor. We will evaluate any request against the data that can reasonably be linked to the requester and the requirements of applicable law.

We aim to respond without undue delay and within 45 days where applicable, subject to legally permitted authentication and extension rules. If a deletion request applies to information that was shared with a processor or other covered recipient, Care Path Compare will take the steps required by applicable law to communicate or implement the deletion request.

Appealing a refusal

If Care Path Compare refuses to act on a consumer health data privacy request and an appeal right applies, use the same contact form, identify the message as a “consumer health data privacy appeal,” and reference the prior request and decision. Do not include medical records or other sensitive health details. Care Path Compare will provide a written appeal response within the period required by applicable law. If an appeal is denied, the response will include the applicable attorney-general contact information or complaint method when required.

Retention

The local browser preference remains until you change it or clear browser storage. Google Analytics retention is controlled in the Care Path Compare property and should remain no longer than reasonably necessary for aggregate reporting. Care Path Compare’s first-party behavior system retains daily aggregate page-level counters rather than raw individual interaction records; those aggregate counters may be retained for longitudinal content-performance analysis. Contact and privacy-request messages are retained only as reasonably needed to respond, document the request, maintain necessary business records, or meet legal obligations. Hosting and security logs may be retained by service providers according to their operational and security practices.

Security

Care Path Compare limits the categories sent through custom analytics, keeps advertising storage and personalization disabled in the analytics measurement flow, uses HTTPS, stores first-party interaction information as aggregate counters without a behavioral session identifier, and applies reasonable access and security controls. No internet transmission or storage system can be guaranteed completely secure.

Changes to this policy

This policy may be updated when measurement practices, service providers, legal requirements, or consumer rights change. The updated date is published on this page. If a material change would introduce a new category, recipient, or purpose that requires additional consent, Care Path Compare will disclose that change and obtain the applicable consent before the new processing is enabled.

This policy describes Care Path Compare’s current practices and clearly labeled planned display-ad safeguards. It does not state that every consumer health data law applies to every visitor or every activity.

Effective August 5, 2026Last updated September 14, 2026