Regulatory scoping for reproductive-health and sensitive consumer data
This vertical is about one thing: the privacy obligations that attach to consumer health data collected outside the HIPAA perimeter. Washington’s My Health My Data Act defines consumer health data broadly enough to reach location data and algorithmically inferred health status, which sweeps in adtech, SDK, and analytics businesses. Magist scopes the data-privacy obligations only and makes no statement about the underlying medical or legal questions.
Regulations Magist tracks for this vertical
Coverage of these newer regimes is published as draft and reviewed on a rolling basis.
Questions that determine your footprint
Could your data reveal a consumer’s health status?
Washington’s My Health My Data Act can treat precise location data that could indicate an attempt to acquire health services, and health status inferred from other data, as consumer health data — even for businesses that do not consider themselves health companies.
Do you run advertising or analytics SDKs?
SDK and location-data collection without separate consent is the leading theory in the early My Health My Data Act class actions, so an SDK audit can be a sensible scoping step.
Do you have separate consent and a standalone health-data policy?
The Act can require separate consent to collect, a separate authorization to sell, and a standalone consumer-health-data privacy policy distinct from the general one.
See exactly which of 155+ regulations apply to your reproductive-health & sensitive data product.
Magist is an instrument, not a consultancy. It does not sell compliance services or take payment from vendors for placement; the analysis is the same for everyone.
Magist provides legal information, not legal advice. Consult a licensed attorney.