Wren Clinical — Washington Consumer Health Data Privacy Policy

This Washington Consumer Health Data Privacy Policy is published by Wren Clinical LLC ("Wren Clinical," "we," "us") in accordance with RCW 19.373.020. It describes how we treat "consumer health data" as defined by Washington's My Health MY Data Act (RCW 19.373.010) with respect to Washington residents.

1. Our Position

Wren Clinical is a business-to-business software platform used by licensed mental health professionals and their practices to create clinical documentation. Wren Clinical does not collect "consumer health data" as defined in RCW 19.373.010 from Washington consumers. Specifically:

• Client data processed through the Platform on behalf of a therapist-customer is Protected Health Information (PHI) governed by the Health Insurance Portability and Accountability Act (HIPAA) and is expressly exempt from the My Health MY Data Act under RCW 19.373.100.
• Therapist account data that Wren Clinical collects directly (name, email address, practice name, authentication tokens, and usage metadata) is not linked or reasonably linkable to any individual's physical or mental health status and therefore does not meet the statutory definition of consumer health data.

Because we do not collect consumer health data, the categorical disclosures required by RCW 19.373.020(1) are reported as "not applicable" below. We publish this Policy to satisfy the publication requirement of RCW 19.373.020(1) and to inform Washington residents of our position.

2. Required Disclosures (RCW 19.373.020(1))

Required disclosure	Wren Clinical
Categories of consumer health data collected and purposes	None collected.
Categories of sources from which consumer health data is collected	None collected.
Categories of consumer health data shared	None shared (because none collected).
Categories of third parties and specific affiliates with whom consumer health data is shared	None.
How consumers may exercise RCW 19.373.040 rights (access, deletion, withdrawal of consent)	Because Wren Clinical does not collect consumer health data, RCW 19.373.040 rights are not actionable against us. If you believe Wren Clinical has collected your consumer health data and wish to exercise a right under RCW 19.373.040, contact support@wrenclinical.com and we will investigate and respond within forty-five (45) days.

3. No Sale, No Sharing for Advertising

Wren Clinical does not sell consumer health data. Wren Clinical does not share consumer health data for advertising or marketing purposes. Wren Clinical does not use consumer health data to serve targeted advertising. Wren Clinical does not geofence any healthcare facility as prohibited by RCW 19.373.050.

4. Client Rights Regarding Protected Health Information

Washington residents whose Protected Health Information is processed through the Platform on behalf of a therapist-customer should contact that therapist directly to exercise rights under HIPAA. Wren Clinical does not have a direct relationship with clients and cannot identify or authenticate client requests. The therapist or practice is the HIPAA Covered Entity and is responsible for responding to client requests under 45 CFR §§ 164.524, 164.526, and 164.528.

5. Contact

Questions about this Washington Consumer Health Data Privacy Policy may be directed to support@wrenclinical.com.

6. Changes

Wren Clinical may update this Policy at any time by posting a revised version at wrenclinical.com/legal/wa-consumer-health-data. Material changes will be communicated by email to the address associated with any affected Wren Clinical account.