Skip to content

Consumer Health Data Privacy Notice

Original document

LAST VERIFIED 2026-10-01

Attention points

17 TO CHECK

Pointers to disclosures this policy may not clearly make, checked against major privacy laws. This is a heuristic — not legal advice, and not a finding that anything is missing or unlawful.

GDPR / UK-GDPR

4/13 ADDRESSED
  • Who controls your data (identity & contact of the data controller)GDPR Art. 13(1)(a)
  • Data Protection Officer contactGDPR Art. 13(1)(b)
  • The legal basis for using your dataGDPR Art. 13(1)(c)
  • Legitimate interests relied on (where that is the basis)GDPR Art. 13(1)(d)
  • International transfers and their safeguardsGDPR Art. 13(1)(f) / 46
  • How long your data is kept (retention)GDPR Art. 13(2)(a)
  • Whether providing your data is required, and what happens if you don'tGDPR Art. 13(2)(e)
  • Automated decision-making or profilingGDPR Arts. 13(2)(f), 22
  • Where your data was obtained, if not collected from you (source)GDPR Art. 14(2)(f)

CCPA / CPRA

2/10 ADDRESSED
  • Notice at collection: what categories of data are collected, and whyCCPA §1798.100(b)
  • Categories of third parties data is shared/sold toCCPA §1798.115
  • A 'Do Not Sell or Share My Personal Information' option (if it sells/shares)CCPA §1798.135(a)
  • A 'Limit the Use of My Sensitive Personal Information' option (CPRA)CPRA §1798.135(a)
  • Your CCPA rights (know, delete, correct, opt-out, limit, non-discrimination)CCPA §§1798.100–125
  • A non-discrimination promise for exercising your rightsCCPA §1798.125
  • Retention period (or criteria) per category of data (CPRA)CPRA §1798.100(a)(3)
  • At least two ways to submit a request, plus a contactCCPA §1798.130

Current text

General Published: April 23, 2024 This Consumer Health Data Privacy Notice (CHD Notice) supplements our Privacy Notice for Buyer Features and Square Pay. This CHD Notice applies only to personal information that may be considered "Consumer Health Data" ("CHD") under the My Health My Data Act ("MHMDA") in Washington and Nevada's Consumer Health Data Privacy law ("NV CHDP") (as well as any similar state laws in effect). This CHD Notice does not apply to "protected health…

Show full text