Be The First To Know
Sign up and receive a launch special offer!
Effective Date: May 19, 2026 • Last Updated: May 19, 2026
This Consumer Health Data Privacy Policy describes how ComposeRx collects, uses, shares, and protects "consumer health data" as defined under U.S. state laws including the Washington My Health My Data Act (RCW 19.373), the Nevada SB370 consumer-health-data law (NRS 603A.300–360), and the Connecticut Data Privacy Act's consumer-health-data amendments. It supplements the ComposeRx Privacy Policy and applies in addition to (not in place of) that Policy. To the extent of any conflict with the general Privacy Policy with respect to consumer health data, this Policy controls.
"Consumer health data" means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status, including data such as visible skin conditions and dermatological concerns (e.g., visible redness, melasma), efforts to research or acquire skincare-related services or products in connection with a skin condition, the use of medications or topicals, and biometric or photographic data depicting a skin condition. We treat the following as consumer health data:
Answers to our skin quiz that reference a skin condition (e.g., redness, melasma, sensitivity).
Before-and-after photographs or self-uploaded photographs of skin.
Communications with customer support that discuss skin conditions or reactions.
Inferences we derive that identify or suggest a skin condition.
We collect consumer health data directly from you when you choose to provide it (e.g., taking our skin quiz, uploading photos, sending us a question about a reaction). We do not purchase consumer health data from third parties.
We use consumer health data only for the following purposes: (a) to fulfill orders and provide customer service that responds to skin-condition information you have shared; (b) to personalize product recommendations within the Services with your consent; (c) where you have specifically opted in, to feature your before/after image or testimonial in marketing materials; (d) to defend legal claims and comply with legal obligations; and (e) for the limited purposes permitted by RCW 19.373.060 without consent (e.g., preventing fraud or providing a product you specifically requested).
We share consumer health data with service providers that help us deliver the Services (e.g., cloud hosting, customer-support tooling), under contractual restrictions that limit their use of the data to providing services to us. We do not sell consumer health data. If we ever intend to sell consumer health data, we will obtain your separate, signed valid authorization that complies with RCW 19.373.060(2), including all required elements (description of the data, name of seller and recipient, purpose, expiration, signature, and notice of revocation rights).
Right to access. Confirm whether we are processing your consumer health data and request a copy.
Right to deletion. Request deletion of your consumer health data. We will delete the data and direct any service providers, processors, contractors, and affiliates with whom we have shared the data to also delete it (RCW 19.373.050(2)).
Right to withdraw consent. Withdraw any previously given consent to collect, share, or sell consumer health data at any time.
Right to appeal. If we deny a request, you may appeal as described in our Privacy Policy.
To exercise any right, email hello@composerx.com or use the request webform linked at "Your Privacy Choices" in our footer.
We collect, use, and share consumer health data only for purposes permitted by RCW 19.373.040 or with your affirmative opt-in consent. Where consent is required, we will request it before collection through a clear, separate consent prompt that describes (a) the categories of consumer health data collected, (b) the purposes of collection, (c) the categories of third parties (if any) with whom the data will be shared, and (d) how you can withdraw consent.
We do not use geofencing to identify or track consumers seeking healthcare services, to send notifications or advertisements related to consumers' consumer health data, or to collect consumer health data from consumers, in each case within 2,000 feet of any facility providing in-person healthcare services (RCW 19.373.100).
We implement administrative, technical, and physical safeguards designed to protect consumer health data, including access controls, encryption in transit and at rest, and limited internal access on a need-to-know basis.
Consumer health data is retained only as long as reasonably necessary to provide the Services you requested or as legally required. Photographs you upload to your account are retained while the account is active and for 24 months thereafter, unless you request earlier deletion.
Washington residents may file a complaint with the Washington Attorney General under the Washington Consumer Protection Act (RCW 19.86). Nevada residents may contact the Nevada Attorney General. Connecticut residents may contact the Connecticut Attorney General. Questions or requests under this Policy can be sent to hello@composerx.com.
We may update this Consumer Health Data Privacy Policy from time to time. Material changes will be announced with at least 30 days advance notice on our website.
Sign up and receive a launch special offer!