Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy applies to consumer health data collected by HMH Holdings LLC d/b/a Itemizeit (“Itemizeit,” “we,” “our,” or “us”). It applies in addition to our general Privacy Policy, and it governs if there is any conflict regarding consumer health data.

This policy exists to meet the requirements of the Washington My Health My Data Act and the Nevada consumer health data law. If you are a Washington or Nevada consumer, this policy describes your rights and how to exercise them.

Itemizeit Is Not Covered by HIPAA

Itemizeit is a direct-to-consumer service. We are not a covered entity or business associate under HIPAA, and information you provide to us is not protected by HIPAA. It is protected by this policy, our general Privacy Policy, our service provider agreements, and applicable state and federal law.

1. What Consumer Health Data We Collect

Consumer health data is information that identifies your past, present, or future physical or mental health status. Because medical bills describe the care you received, most of what you upload to Itemizeit is consumer health data.

We collect:

• Medical bills, itemized statements, and Explanations of Benefits
• Procedure, service, and treatment descriptions appearing on those documents
• Diagnosis and procedure codes appearing on those documents
• Dates and locations of care
• Healthcare provider, facility, and practitioner information
• Health insurance and plan information, claim numbers, and coverage determinations
• Amounts billed, adjusted, paid, and owed
• Information you write into your case about your care or your billing concern
• Correspondence with providers, insurers, and billing departments about your case
• Documents and letters generated for your case

We do not collect precise location data, and we do not use geofencing around any healthcare facility.

2. Where the Data Comes From

• Directly from you, including documents you upload and information you type
• From a person legally authorized to act on your behalf
• From healthcare providers, insurers, and billing departments responding to correspondence you authorized us to send
• From service providers processing your documents at our direction

3. How We Use Consumer Health Data

We use consumer health data only to provide the Services you asked for:

• To review and analyze your bill and identify items that may deserve further review
• To explain findings to you in plain language
• To generate action plans, questions, letters, and appeals for your case
• To send correspondence you have authorized and to track responses
• To provide human case support where included in the Service you purchased
• To maintain the security of your account and detect fraud
• To keep records of authorizations you signed and correspondence sent at your direction
• To comply with legal obligations

We do not use consumer health data for any other purpose without your consent.

4. We Do Not Sell Consumer Health Data

Itemizeit does not sell consumer health data, and we will not sell it. Selling consumer health data requires a separate signed valid authorization from you under Washington law. We do not seek that authorization because we do not sell this data.

We do not use consumer health data for targeted advertising, and we do not permit third parties to collect consumer health data through Itemizeit for targeted advertising across unrelated sites or services.

5. Who We Share Consumer Health Data With

We share consumer health data only as needed to deliver the Service you requested.

Categories of service providers and the function each performs:

Category	What they do
Cloud hosting and infrastructure	Store and run the platform
Document processing and AI analysis	Extract and analyze information from your bill
Payment processing	Process your payment (does not receive your documents)
Email delivery	Send account and case email
SMS delivery	Send text notifications (does not receive your documents)
Postal mail and certified mail	Print and mail letters you authorize
Mail receipt and scanning	Receive and digitize responses to your case
Security and monitoring	Protect accounts and detect fraud
Customer support tooling	Respond to your support requests

Every service provider that handles consumer health data is bound by a written contract limiting them to processing it only for the function above, prohibiting any other use, and prohibiting use of your information to train artificial intelligence models.

Recipients of correspondence you authorize: when you authorize us to send a letter or email, the information in that correspondence goes to the healthcare provider, hospital, medical practice, billing department, health insurer, claims administrator, or collections agency you identified. You review and approve the content before it is sent.

Legal disclosures: we may disclose consumer health data when required by law, valid legal process, or a valid government request, or when reasonably necessary to protect the rights, safety, or security of Itemizeit, our users, or the public.

Business transfers: if Itemizeit is involved in a merger, acquisition, or sale of assets, consumer health data may transfer as part of that transaction, subject to this policy and applicable law.

You may request a list of the specific third parties with whom we have shared your consumer health data. See Section 7.

6. Consent and Withdrawing Consent

We collect and share consumer health data only with your consent or as necessary to provide a Service you requested. You give consent when you create an account and upload a document, and separately when you authorize a specific letter or communication to be sent on your behalf. Each authorization is specific to that action.

You may withdraw consent at any time by emailing hello@useitemizeit.com with the subject line Withdraw Consent, or from your account settings.

Withdrawing consent stops future collection and sharing. It does not retract correspondence already sent at your direction, and it does not undo processing that already occurred. Withdrawing consent may mean we can no longer provide the Service.

7. Your Rights

If you are a Washington or Nevada consumer, you have the right to:

• Confirm whether we collect, share, or sell your consumer health data
• Access the consumer health data we hold about you, including a list of all third parties and affiliates with whom we have shared it, and, where available, contact information for those third parties
• Withdraw consent to our collection and sharing of your consumer health data
• Delete your consumer health data
• Appeal if we decline to act on your request

You will not be discriminated against for exercising these rights.

8. How to Exercise Your Rights

Email hello@useitemizeit.com with one of these subject lines:

• Consumer Health Data Request — for confirmation, access, or a list of third parties
• Delete My Health Data — for deletion
• Withdraw Consent — to withdraw consent

Include the email address on your Itemizeit account so we can locate your records. We will verify your identity before acting on a request, in order to protect your information.

Our response times:

• We respond within 45 days. If we need more time because a request is complex, we will tell you before the initial 45 days end and may extend once by 45 additional days.
• For an authenticated deletion request, we delete your consumer health data from our active records within 30 days, and we notify our service providers and affiliates to delete it from their records as well.
• Data in archived or backup systems is deleted when those systems are next accessed or through the normal backup lifecycle.

Exceptions to deletion: we may retain limited records where the law requires or permits it, including records of authorizations you signed and correspondence already sent at your direction, transaction and tax records, and records needed to resolve a dispute or investigate a security incident. We will tell you if any exception applies to your request.

Authorized agents: you may designate someone to submit a request for you. We will ask for proof of their authority.

9. Appeals

If we decline to act on your request, you may appeal by emailing hello@useitemizeit.com with the subject line Consumer Health Data Appeal. We will review the appeal and respond in writing within 45 days, explaining the reasons for our decision.

If we deny the appeal, we will provide you with a method to contact your state attorney general to submit a complaint:

• Washington: Office of the Attorney General, www.atg.wa.gov/file-complaint
• Nevada: Office of the Attorney General, ag.nv.gov/Complaints

10. Data Security

We protect consumer health data with encryption in transit and at rest, access controls and authentication, restrictions limiting access to personnel and systems that need it, secure document handling, and monitoring for security events. Our safeguards are appropriate to the volume and nature of the consumer health data we process. No online service can guarantee absolute security.

If a breach affects your unsecured health information, we will notify you and applicable regulators as described in our Privacy Policy.

11. Retention

Consumer health data is retained according to the schedule in Section 11 of our Privacy Policy, and is deleted or de-identified when it is no longer reasonably necessary for the purpose it was collected.

12. Changes to This Policy

We will update the Last Updated date whenever this policy changes. If we make a material change to how we collect, use, or share consumer health data, we will notify you through the website, your account, or email before the change takes effect, and we will obtain your consent where required. We will not apply material changes retroactively to consumer health data already collected without your consent.

13. Contact

HMH Holdings LLC d/b/a Itemizeit
Email: hello@useitemizeit.com
Website: useitemizeit.com