Consumer Health Data Privacy Policy

Published: 15 January 2026 · 11 min read

Effective Date: 19 August 2026

Evrima Technologies Pty Limited ("Evrima", "we", "us", or "our") values your privacy. This Consumer Health Data Privacy Policy supplements Evrima's general Privacy Policy and applies to personal information defined as "consumer health data" under the Washington My Health My Data Act (MHMDA), Nevada's Consumer Health Data privacy law and the Colorado Privacy Act (CPA). It explains how we may collect, use, disclose, share, or otherwise process consumer health data, how we protect it, and the rights and choices that may be available to you.

Scope

This policy applies to consumer health data that we collect from or about Washington, Nevada and Colorado consumers, and individuals whose consumer health data is collected or processed in Washington, Nevada or Colorado, in connection with clinical trial recruitment, pre-screening, matching, referral, related communications, and other patient recruitment services (Services).

For purposes of this policy, "consumer" means a Washington, Nevada or Colorado resident, or an individual whose consumer health data is collected or processed in Washington, Nevada or Colorado, as applicable. "Consumer health data" has the meaning given under Washington, Nevada or Colorado law, including personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status.

Consistent with Evrima's general Privacy Policy, "Candidate" means an individual who contacts us to participate in a clinical trial or seeks information about clinical trials, and "Client" means a researcher, host, sponsor, contract research organization, research site, academic medical center, health care provider, or other organization involved in clinical trial recruitment or research services.

This policy does not apply to protected health information that Evrima processes as a business associate (or subcontractor of a business associate) on behalf of a HIPAA-covered provider, other covered entity, or business associate customer — that information is governed by HIPAA, the customer's Notice of Privacy Practices, and Evrima's contractual obligations to that customer. It also does not apply to personal information we collect about our workforce members, job applicants or contractors in an employment or similar professional capacity, or to health information used to engage in public or peer-reviewed scientific, historical, or statistical research that adheres to applicable ethics, privacy, and research laws.

Our Collection of Consumer Health Data

Evrima collects consumer health data in connection with the Services. We do not collect broader consumer health data unrelated to clinical trial screening, recruitment, matching, referral, related communications, or patient support.

Examples of consumer health data we may collect include:

Health conditions, diseases, diagnoses, symptoms, medical history, treatment history, medications, allergies, procedures, test results, and other information relevant to potential clinical trial eligibility;
Sensitive health-related information, including biometric, physiological, genetic, mental health, physical trait, and related health attributes that you provide to us or that are generated through your use of the Services;
Information that identifies you as seeking or obtaining health care services or seeking participation in a clinical trial or other medical research opportunity;
Information provided through surveys, questionnaires, eligibility screeners, forms, portals, appointments, support requests, communications, uploaded documents or images, or other interactions with our Website or Services;
Information generated from your use of our Services, where it relates to clinical trial screening, eligibility, recruitment, matching, referral, or related patient support; and
Derived, inferred, algorithmic, aggregated, or de-identified information that we create from clinical patient data to support search, matching, eligibility assessment, recruitment operations, referral, patient support, service administration, security, compliance, service monitoring, quality improvement, or algorithmic improvements, where such information is linked or reasonably linkable to you.

The Categories of Sources From Which We Collect Consumer Health Data

You directly, including when you register for an account or clinical trial, submit information, complete pre-screening or eligibility forms, communicate with us, submit support requests, attend an appointment, upload documents or images, or otherwise interact with the Website or Services;
Your authorized representative, caregiver, family member, or other person who provides information on your behalf;
Clients and other clinical research parties, including clinical trial sponsors, research sites, academic medical centers, health care providers, contract research organizations, principal investigators, investigator teams, and study teams;
Our employees, contractors, related entities, service providers, and technology partners that support the Website, Services, screening, recruitment, matching, referral, communications, hosting, data storage, security, analytics, customer support, and service administration; and
Information that we generate, transform, or derive from your interactions with the Website or Services, including eligibility, matching, engagement, referral, recruitment operations, service performance, security, compliance, and aggregated metrics.

How We Use Consumer Health Data

Providing, operating, and improving the Website, Services, clinical trial screening, recruitment, matching, referral, patient support, and related clinical research support services;
Responding to your clinical trial-related inquiries, requests, support needs, and communications;
Assessing potential eligibility for clinical trials, studies, research opportunities, or related services;
Matching Candidates with clinical trial opportunities and facilitating communications with Clients, including sponsors, research sites, academic medical centers, health care providers, contract research organizations, principal investigators, investigator teams, and study teams;
Managing accounts, identity verification, clinical patient records, platform access, referral records, and service administration;
Conducting reporting, operational improvement, quality assurance, security, debugging, fraud prevention, compliance, and service administration related to the Services;
Creating derived data, de-identified information, or aggregated metrics from clinical patient data to support search, matching, eligibility assessment, recruitment operations, service monitoring, quality improvement, reporting, algorithmic improvements, and responsible use of AI technologies, where permitted by law and consistent with applicable consent choices;
Complying with legal, regulatory, contractual, research, audit, dispute-resolution, and safety obligations; and
Other purposes disclosed to you at the time of collection or for which you provide consent.

Third Parties and Affiliates With Whom We Share Consumer Health Data

Clients, including clinical trial sponsors, research sites, academic medical centers, health care providers, contract research organizations, principal investigators, investigator teams, study teams, and organizations responsible for clinical trials or medical research;
IT service providers, data storage providers, web-hosting and server providers, technology partners, security providers, identity verification providers, communications providers, analytics providers, reporting providers, customer support providers, and clinical patient service-administration providers;
Professional advisers, auditors, consultants, insurers, legal counsel, compliance advisers, and other business operations providers;
Regulators, courts, law enforcement, government authorities, or other parties where disclosure is required or permitted by law;
Successors, purchasers, investors, or counterparties in connection with an actual or proposed merger, acquisition, financing, reorganization, sale, or transfer of all or part of our business or assets; and
Other parties where you direct us to share information or provide consent.

Where a Candidate is matched to a clinical trial or medical research opportunity, we may disclose consumer health data to Clients and third parties that need the information to perform clinical trials, medical research, recruitment, referral, or related services. We limit the information we provide to what is reasonably necessary for those purposes.

Collection and sharing with consent. We collect and share consumer health data only as permitted by applicable Washington, Nevada or Colorado law, including where necessary to provide a product or service that you request, where we have obtained your consent, or as otherwise authorized by applicable law. You may withdraw consent for future collection or sharing of consumer health data, but withdrawal will not affect processing that occurred before we received and processed your withdrawal request.

Sale of consumer health data. We do not sell consumer health data. If Evrima ever engages in a sale of consumer health data, we will do so only with a valid authorization that satisfies Washington law and after providing all required disclosures.

Location information and geofencing. We do not knowingly collect precise location information that could reasonably indicate that a consumer is seeking or receiving health care services or supplies, and we do not use geofencing around facilities that provide in-person health care services.

How to Exercise Your Rights With Respect to Your Consumer Health Data

You may request confirmation of whether we collect, share, or sell your consumer health data;
You may request access to your consumer health data;
You may request a list of third parties and affiliates with whom we have shared or sold your consumer health data, including contact information where required;
You may withdraw consent for the collection or sharing of your consumer health data; and
You may request deletion of your consumer health data, subject to legal exceptions.

How to Submit a Request

To exercise your rights with respect to your consumer health data, please contact us at enquiries@evrima.com.au or through any consumer rights request webform that Evrima makes available for consumer health data requests. We may take reasonable steps to verify your identity and authority to make the request. If you are a third party submitting a request on behalf of another person as an authorized agent, you must provide proof of your authority, such as a signed declaration, power of attorney, or other documentation demonstrating that you are authorized to act on the consumer's behalf. Evrima may verify both the consumer's identity and the authorized agent's authority before responding to the request. A parent or legal guardian may submit a request on behalf of a minor child where permitted by law.

We will respond to verified requests within the timeframe required by applicable law. If we deny your request, you may appeal by contacting us at enquiries@evrima.com.au and stating that you are appealing a consumer health data rights decision. If your appeal is unsuccessful, you may contact the Washington Attorney General or other applicable regulator, depending on your state of residence and the law that applies to your request.

We will not discriminate against you for exercising any of the consumer health data rights described in this policy.

Data Security

We maintain administrative, technical, and organizational safeguards designed to protect consumer health data against unauthorized access, use, disclosure, alteration, and destruction. We restrict access to consumer health data to personnel who have a need to know. We choose technology partners based on their security and privacy practices. In case of a security incident involving consumer health data, we will respond in accordance with applicable data protection and breach notification laws.

Data Retention

We retain consumer health data for as long as reasonably necessary to provide our Website and Services, support clinical trial recruitment, comply with legal, contractual, research, audit, record-retention, good clinical practice, and regulatory obligations, resolve disputes, maintain security, and enforce our rights. We delete, de-identify, or anonymize consumer health data when it is no longer needed for these purposes, subject to applicable legal and contractual retention requirements.

Supplement for Nevada Consumers

This supplement applies to Nevada consumers for purposes of providing additional disclosures required by Nevada's Consumer Health Data privacy law. Terms used in this supplement that are defined under Nevada's Consumer Health Data privacy law have the meanings given to them under that law.

Purposes and manner of processing. We collect, use, process, and share consumer health data for the purposes and in the manners described above, including to provide the Services, support clinical trial screening and recruitment, facilitate matching and referrals, communicate with Candidates and Clients, maintain security, comply with legal obligations, and improve our Services.
Review and revision of consumer health data. If you would like to review or revise your consumer health data, you may submit a request using the methods listed above. We will respond in accordance with applicable law and, where Nevada law applies, no later than 45 days after receiving your request, unless an extension is permitted by law.
Changes to this supplement. We will notify you before making any material changes to our privacy practices with respect to consumer health data by posting an updated notice with an updated effective date or by providing other notice required by applicable law.
Third-party collection of consumer health data. Some third parties may collect consumer health data about you over time and across different websites or online services you may visit. Their collection, use, and disclosure of consumer health data is governed by their own privacy notices and practices.

Changes to This Policy

We may update this policy from time to time to reflect changes in our practices, technologies, services, or legal requirements. If we make material changes, we will provide notice as required by law. The version posted on our website will indicate the effective date.

Contact Us

If you have questions about this policy or wish to exercise your consumer health data rights, please contact Evrima Technologies Pty Limited at enquiries@evrima.com.au or through any consumer rights request webform that Evrima makes available on its Website.