Draft. This document is under legal review and is not yet in effect. Bracketed items will be completed before launch.

MedsClaim Consumer Health Data Privacy Policy

Effective date: October 25, 2026

This policy describes how MedsClaim, the operator of medsclaim.com ("MedsClaim," "we," "us") handles consumer health data, as defined by Washington's My Health My Data Act, Nevada's consumer health data law (SB 370), and Connecticut's consumer health data provisions. We apply it to every user, wherever they live. It supplements our Privacy Policy.

Information we handle as a HIPAA business associate for a healthcare provider or health plan is governed by HIPAA and our agreement with that organization, not by this policy.

1. Consumer health data we collect

• Receipts, invoices, and order details for health products and services
• Prescription and medication information, such as the drug name, dose, pharmacy, and fill date
• Healthcare provider names, service dates, and descriptions of care
• Explanations of benefits and claim history from health plans and benefit administrators
• Letters of Medical Necessity and the conditions or treatments they describe
• Eligibility determinations we infer, such as "this purchase is likely FSA-eligible"
• The same information about a spouse or dependents whose expenses you submit

We do not collect biometric data, genetic data, or precise location, and we do not geofence healthcare facilities.

2. Sources

• You, through uploads, photos, and forms
• Accounts you connect, such as email, pharmacies, retailers, health plans, and benefit administrators
• The partner that offered MedsClaim to you, if any
• Clinicians who write LMNs at your request

3. Why we collect and use it

• To find expenses that may be eligible for reimbursement
• To prepare and, when you authorize it, submit claims to your Benefit Account administrator
• To arrange LMNs when you request one
• To send you alerts and updates about your claims
• To prevent fraud and keep the Services secure

We do not use consumer health data for advertising, marketing, or any purpose unrelated to these.

4. Your consent

We collect consumer health data only after you give separate, specific consent when you sign up or turn on a feature. We ask for another separate consent before sharing it with anyone other than the parties listed in Section 5 who are needed to provide the Services you requested. You can withdraw consent at any time in settings. If you do, we stop collecting your data and delete what we have as described in Section 6.

We never sell consumer health data. We would need your signed authorization to do so under Washington law, and we will not ask for it.

5. Who we share it with

A current list of the specific third parties and affiliates that receive consumer health data is available on request (Section 6).

6. Your rights

You have the right to:

• confirm whether we collect, share, or sell your consumer health data;
• access it, including a list of every third party and affiliate we've shared it with, with their contact information;
• delete it. We'll delete it from our systems and tell our service providers and third parties to do the same, including from archives and backups within [35] days; and
• withdraw consent for its collection or sharing.

How to make a request: use the privacy settings in your account or email support@medsclaim.com. We'll verify your identity and respond within 45 days. We can extend that once by 45 days, and we'll tell you why. Requests are free.

Appeals. If we deny your request, email support@medsclaim.com with "Appeal" in the subject line within a reasonable time. We'll respond in writing within 45 days and explain our decision. If your appeal is denied, you may contact the attorney general of your state. In Washington, that is the Washington State Attorney General's Office (atg.wa.gov).

7. Contact

MedsClaim (medsclaim.com) Attn: Privacy [MAILING ADDRESS] support@medsclaim.com