Consumer Health Data Privacy Policy

Natal Health LLC, a Texas limited liability company

joinnatal.com

Effective Date: May 31, 2026

 

1.  Scope and What This Policy Covers

This Policy applies to “consumer health data” as defined under applicable state law — generally, personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status. For Natal, consumer health data may include the information described in Section 3 below.

This Policy applies to residents of states that grant specific consumer health data or genetic privacy rights, including Washington, Nevada, and Illinois, and we extend its core protections to all members of the Service. It applies to data that is not otherwise governed by the Health Insurance Portability and Accountability Act (“HIPAA”). Information that constitutes protected health information under HIPAA, or medical information governed by a state medical confidentiality law, is handled under those laws rather than under the state consumer health data laws, and is addressed in the Natal Privacy Policy.

2.  Important Note on Children’s Data

The Service is enrolled and managed by a parent or legal guardian on behalf of a minor child. The consumer health data and genetic data described in this Policy relates to enrolled children and is provided and controlled by the enrolling parent or guardian. References to “your” consumer health data include the data of the child you have enrolled, and the rights described in this Policy are exercised by the parent or guardian on the child’s behalf. We obtain the consents described in this Policy from the enrolling parent or guardian.

3.  Categories of Consumer Health Data We Collect

Depending on the components of the Service you use, we may collect the following categories of consumer health data:

•       Information identifying that a consumer is seeking or has obtained health-related services through Natal;

•       Laboratory test orders and laboratory results relating to an enrolled child;

•       Biological and biomarker measurements derived from laboratory testing;

•       Interpretive health information we prepare, such as result summaries and health-related guidance;

•       Where you elect genetic testing, genetic data and related sequencing results and interpretation; and

•       Information derived or extrapolated from the above, including health-related inferences generated within our interpretive framework.

We collect this data from you directly, from the enrollment information and documents you provide, and from the laboratories and the Clinical Entity that perform and review testing.

4.  How We Use Consumer Health Data

We collect and process consumer health data only as necessary to provide the components of the Service you have requested, and for the following purposes:

•       To order and facilitate laboratory testing for your child through the Clinical Entity;

•       To deliver results, result summaries, and health-related guidance to you;

•       To provide the personalized components of the Service you have requested;

•       To maintain records as required by clinical, laboratory, and legal obligations;

•       To secure the Service and prevent fraud and misuse; and

•       To comply with law.

We do not use consumer health data for advertising, and we do not sell consumer health data. We do not collect, use, or share consumer health data beyond what is necessary to provide the Service and the purposes described above without obtaining your separate consent or, where required, your written authorization.

5.  How We Share Consumer Health Data and With Whom

We share consumer health data only with the categories of recipients listed below, and only as necessary to provide the Service or as required by law. We do not sell this data and do not share it for cross-context behavioral advertising.

Category of Recipient	Purpose of Sharing
The Clinical Entity (Everwell Neuro PLLC, an independent physician-owned professional entity)	To order laboratory testing, review results, and prepare clinical interpretation under professional supervision.
Clinical laboratories and reference laboratories	To perform the laboratory and genetic testing you elect and return results.
Processors and service providers	Hosting, secure file intake and storage, scheduling, email delivery, and similar functions, under contracts that limit use to providing services to Natal and, where applicable, under Business Associate Agreements.
Legal, compliance, and safety recipients	To comply with law or legal process and to protect rights, safety, and security.
Successor entities	In connection with a merger, acquisition, financing, or sale of assets, subject to confidentiality protections and applicable law.
Recipients you direct	Any party you ask us to share data with, such as your child’s healthcare provider.

We do not share consumer health data with any affiliate or third party in a manner that would constitute a “sale” under applicable state law. We will not collect, share, or sell additional categories of consumer health data, or use it for materially different purposes, without first providing notice and obtaining any required consent.

6.  Consent and Authorization

Where required by applicable state law, we obtain your affirmative consent before collecting or sharing consumer health data beyond what is necessary to provide a product or service you have requested, and we obtain a separate, valid written authorization before any sale of consumer health data. We do not sell consumer health data, and accordingly we do not seek authorization for any such sale. Consent for genetic data is addressed in Section 9.

7.  Your Rights Regarding Consumer Health Data

Subject to applicable law, you have the following rights with respect to consumer health data:

•       Right to confirm and access — to confirm whether we are collecting, sharing, or selling your consumer health data and to access that data.

•       Right to know recipients — to obtain a list of the categories of third parties and affiliates with whom we have shared your consumer health data, and the third parties with whom we have sold it (none, in the case of Natal).

•       Right to withdraw consent — to withdraw consent to the collection and sharing of your consumer health data.

•       Right to delete — to request deletion of your consumer health data, subject to legal, clinical, and laboratory recordkeeping obligations that may require retention.

•       Right against discrimination — to exercise these rights without being denied goods or services, except where the data is necessary to provide a service you have requested.

When we receive a deletion request, we will delete consumer health data from our records and direct our processors to do the same, except to the extent retention is required or permitted by law, including clinical and laboratory record retention requirements. Note that withdrawing consent or requesting deletion of data necessary to provide the Service may mean we can no longer provide some or all of the Service for your child.

8.  How to Exercise Your Rights

You may exercise any of the rights in this Policy by contacting Natal through the member support contact information at joinnatal.com, or through any consumer health data request method we make available there. We will verify your request consistent with applicable law and respond within the timeframe the law requires. You may use an authorized agent where the law permits, subject to verification. If we deny a request, you may appeal by contacting us, and depending on your state you may also contact your state Attorney General.

9.  Genetic Data and the Illinois Genetic Information Privacy Act

Where you elect genetic testing, such as whole exome sequencing, for your child, we and the Clinical Entity collect and process genetic data, including the test results and the interpretation we prepare. Genetic data receives heightened protection under this Policy and under laws including the Illinois Genetic Information Privacy Act (“GIPA”).

9.1  Consent for Genetic Testing

Before genetic testing is performed, the Clinical Entity, with Natal’s support, obtains the written informed consent of the enrolling parent or guardian for the collection, use, and disclosure of the child’s genetic data for the purpose of providing the testing and interpretation you have requested. Genetic testing is not performed without this consent. As part of this consent, you acknowledge that genetic findings may have implications for the biological relatives of the tested child, and that you have considered this before electing genetic testing.

9.2  Limits on Use and Disclosure of Genetic Data

We use genetic data only to provide the testing and interpretation you have requested and as otherwise permitted by law. We do not disclose genetic data to any employer, health insurer, life or disability insurer, or similar party, and we do not use genetic data to make any decision regarding insurance or employment. We do not sell genetic data, and we do not share genetic data except with the laboratories and the Clinical Entity necessary to perform and interpret the testing, with processors under appropriate contractual and legal protections, as you direct, or as required by law.

9.3  Protection and Retention of Genetic Data

Genetic data is maintained with heightened security safeguards and is retained in accordance with applicable clinical, laboratory, and legal requirements. We restrict transfers of genetic data consistent with applicable federal and state law. You may request access to or deletion of genetic data as described in this Policy, subject to recordkeeping obligations that apply to clinical and laboratory records.

10.  Washington My Health My Data Act Disclosures

This Policy serves as the Consumer Health Data Privacy Policy required by the Washington My Health My Data Act and is linked from the Natal homepage. For Washington residents, the categories of consumer health data we collect are described in Section 3, the sources are described in Section 3, the purposes of collection and use are described in Section 4, and the categories of recipients with whom we share consumer health data are described in Section 5. We collect consumer health data from the sources, and share it with the categories of recipients, identified in those Sections. Washington residents may exercise the rights described in Sections 7 and 8.

Natal does not use geofencing technology to establish a virtual boundary around any healthcare facility or location, or to identify, track, collect data from, or send communications to consumers based on their proximity to or presence at a location that provides healthcare services.

11.  Nevada Consumer Health Data Disclosures

For Nevada residents, this Policy describes the consumer health data we collect and the purposes for which we use it, the categories of recipients with whom we share it, and the rights available to you, consistent with Nevada law. Natal does not sell consumer health data as defined under Nevada law. Nevada residents may exercise their rights as described in Sections 7 and 8.

12.  Security

We maintain administrative, technical, and physical safeguards designed to protect consumer health data and genetic data, including encryption in transit and at rest, access restrictions on a need-to-know basis, and access logging. We require our processors to maintain comparable protections. No system is completely secure, and we cannot guarantee absolute security. In the event of a security incident involving consumer health data or genetic data, Natal will investigate and will provide notice to affected individuals and to regulators as and when required by applicable law.

13.  Changes to This Policy

We may update this Policy from time to time. We will post the updated Policy at joinnatal.com with a new effective date, and we will not collect, use, or share previously collected consumer health data for materially different purposes without your consent where required by law.

14.  Contact Us

If you have questions about this Policy or wish to exercise your rights regarding consumer health data or genetic data, contact Natal member support through the contact information provided at joinnatal.com.