Consumer Health Data We Collect

As described in the Information We Collect section of the Privacy Statement, the data we collect depends on the context of your interactions with the Cystic Fibrosis Foundation (“CF Foundation”), what you choose to provide to us, location, and applicable law. Because consumer health data is defined very broadly, some of the categories of data we collect could also be considered consumer health data. 

Examples of consumer health data may include:

• Your connection to cystic fibrosis (“CF”), including diagnosis of CF, and connection to the CF Foundation;
• Health information associated with CF, including but not limited to mutation type, medications, or therapies;
• Information, directly collected from you, required to help you find a clinical trial upon your request;
• Your searches for information about accredited cystic fibrosis care centers, that could reasonably indicate your attempt to seek treatment there;
• Other information that may be used to infer or derive data related to the above or other health information.

This notice does not include data collected in the CF Foundation Patient Registry, pursuant to your consent. For more information about the Patient Registry, please contact your care center.

Sources of Consumer Health Data

As described further in the Information We Collect section of the Privacy Statement, we collect personal data (which may include consumer health data) directly from you or from your interactions with us, as well as from publicly and commercially available sources, as permitted by law.

Why We Collect and Use Consumer Health Data

We collect and use consumer health data for the purposes described in the How We Use Personal Information section of our Privacy Statement. Primarily, we may use consumer health data to provide and manage our services, online or offline. This may include:

• Providing you with information about CF;
• Communicating with you regarding CF and CF Foundation events;
• Providing people with CF and their families with insurance, financial, and legal assistance and other resources, connecting the CF community;
• Helping people with CF find accredited care centers and clinical trials; and
• Learning about the CF community in order to inform current and future programs and services.

We may use consumer health data for other purposes for which we give you choices and/or obtain your consent as required by law — for example, for advertising or marketing purposes. See the Tracking and Cookies section of our Privacy Statement and the How to Exercise Your Rights section below for more details on the choices you may have.

Our Sharing of Consumer Health Data

We may share each of the categories of consumer health data described above for the purposes described in the Personal Information We May Share section of the Privacy Statement. In particular, we may share personal data, including consumer health data, with your consent or in order to provide services, as described in the Privacy Statement, or as required by law.

Third Parties With Which We Share Consumer Health Data

As necessary for the purposes described above, we share consumer health data with the following categories of third parties:

• Service providers. Vendors or agents working on our behalf may access consumer health data for the purposes described above. For example, companies we’ve hired to assist in protecting and securing our systems and services may need access to data to provide those functions.
• Business collaborators. We may share consumer health data with other companies, for example, where you use a service that is operated by another company, or where you use another company to interact with our Services.
• Financial institutions and payment processors. When you make a purchase or enter into a financial transaction, we will disclose payment and transactional data to banks and other entities as necessary for payment processing, fraud prevention, analytics, or other related financial services.
• Other third parties. In certain circumstances, it may be necessary to provide data to other third parties or law enforcement, for example, to comply with the law or to protect our rights or the rights of others. 

How to Exercise Your Rights

The Washington My Health My Data Act provides certain rights with respect to consumer health data, including rights to access, delete, or withdraw consent relating to such data, subject to certain exceptions. You can request to exercise such rights using the various tools and mechanisms described in the Your Rights and Choices Regarding Your Information and the Exercising Your Rights and Choices sections of the Privacy Statement. For example, you can email privacy@cff.org to exercise any rights you may have.

If your request to exercise a right under the My Health My Data Act is denied, you may appeal that decision by contacting our Privacy Officer at privacy@cff.org. If your appeal is unsuccessful, you can raise a concern or lodge a complaint with the Washington State Attorney General at www.atg.wa.gov/file-complaint. 

Changes to this Policy

We may update this Policy at any time and, if so, we will post the new effective date below. If these changes would permit us to share your information more broadly than described above or use your information in a manner that is not described above, we will post an announcement on this Site and/or ask for your consent.

Your continued use of the Site after the effective date of the new Policy constitutes your consent to the new Policy.

Effective Date: May 9, 2024