Consumer Health Data Privacy Policy

Effective Date: October 28, 2026

This Consumer Health Data Privacy Policy explains how VertexMD, Inc., a Delaware corporation doing business as KeepMD, handles consumer health data subject to the Washington My Health My Data Act. KeepMD is a trade name of VertexMD, Inc., not a separate recipient of your information.

Data and sources

Depending on what you choose to use, data may include health conditions, medications, laboratory results, medical documents, family or genetic history, visit recordings and transcripts, and activity or device measurements. Summaries and information derived from those records may also be consumer health data. Sources include you, records you select, authorized patient-portal or Medicare connections when available, supported health stores or wearable providers, and people you expressly authorize to share with you. Medicare production access is not yet available.

We use selected data to import, organize, display, search, transcribe, summarize, export or share records as you request. Local records are kept in an encrypted database. Document extraction and optional generated summaries use the KeepMD-owned processing hardware described in the main Privacy Policy. Their availability and consent requirements are explained before use.

The categories shared depend on your choices: selected documents or record context for requested processing; records or encrypted copies you choose to share; and information you voluntarily submit for support or communications. Recipients may include the people and providers you select, service providers needed to deliver the requested function, and authorities where disclosure is legally required. When enabled, encrypted sharing services may retain encrypted copies for synchronization. KeepMD Vision and KeepMD Intelligence processing on KeepMD-owned hardware does not send selected content to external OCR or model services.

We do not sell health-record contents or use them for third-party advertising. App medical-record contents are excluded from website advertising and analytics. Website page and attribution events can reveal interest in a health topic; those measurements remain subject to applicable consent and consumer-health-data rules.

We collect or share consumer health data with the consent required by law or as necessary to provide a product or service you request, where the law allows. Any new category or purpose requiring consent will be explained before it starts.

Your rights and requests

Where the Act applies, you may ask to confirm and access your consumer health data, obtain the required recipient information, withdraw consent, or request deletion. Email [email protected] or write to the address below. We may reasonably verify a request. Local records can be viewed or deleted in the app; KeepMD cannot retrieve device-only records for you.

We normally respond within 45 days and may extend once by 45 days when permitted, with notice and an explanation. You may appeal a decision by emailing [email protected]; we respond to appeals within 45 days. If an appeal is denied, you may complain to the Washington Attorney General. We do not discriminate for exercising applicable privacy rights.