Lenaya Health
Washington Consumer Health Data Privacy Policy
Effective Date: October 6, 2026 | Last Updated: October 6, 2026
Clargenta AI LLC ("Clargenta," "we," "us," or "our") operates Lenaya Health. This separate Policy explains our collection, use, and sharing of consumer health data under the Washington My Health My Data Act, chapter 19.373 RCW, and how to exercise rights under that law.
This Policy applies to consumer health data within the Act's scope. Covered consumers include Washington residents and individuals whose consumer health data is collected in Washington, subject to the Act's definitions and exclusions. Consumer health data includes personal information linked or reasonably linkable to an individual that identifies the individual's past, present, or future physical or mental health status. Information inferred from other data can qualify even when it was not expressly supplied as health information.
1. Consumer Health Data We Collect and Why
We collect the categories below depending on what you, or a person authorized to act for you, provide and which features you use. We do not require every category from every consumer.
| Category | What it can include | Collection and use purposes |
|---|---|---|
| Medical-visit recordings and transcripts | Audio recorded in Lenaya or uploaded from another source; your voice and statements; statements of clinicians and other participants; descriptions of health conditions, treatment, or care | Record or store a visit at your direction; transcribe it; let you review and understand the conversation |
| Uploaded medical records and extracted information | Laboratory values, after-visit notes, imaging reports, referrals, medications, diagnoses, procedures, treatment plans, and text extracted from documents | Store and organize records you upload; extract their contents; make them available for your requested summaries and questions |
| Health questions and communications | Questions you ask about your records; information provided in a support request; health information supplied by an authorized caregiver | Answer your questions using your records; provide requested assistance; support authorized care organization |
| Generated and inferred health information | Summaries, answers, action items, follow-up checklists, identified health concerns and their recorded status, My Care Journey groupings, and laboratory trends | Provide the features you request and connect information across your visits and documents |
| Health-service and appointment information | Visit dates, clinician and facility names, medical specialties appearing in your records, and information indicating that you sought or received care | Label and organize visits and documents; help you locate information and understand follow-up steps |
| Location information associated with care | A recording-location label, including a street address, if you enable it; a facility or location mentioned in the content you provide | Label the recording and organize your care information; location associated with obtaining care is treated as health data where the Act covers it |
| Identifiers, permissions, and technical information linked to health | Account identifiers associated with health records; Care Circle membership and permissions; activity, device, or diagnostic information that reveals or is linked to health activity | Authenticate access; carry out your sharing choices; operate, troubleshoot, and secure the requested features |
Depending on the content, these categories can reveal physical or mental health conditions, disabilities, symptoms, medications, diagnoses, tests, treatment, reproductive or sexual health, gender-affirming care, substance-use information, genetic information contained in records, and other health status or services. These are possible contents of the records you choose to provide, not a requirement to supply every type of information.
We process the data to provide the requested Services and authorized sharing, respond to support issues, and maintain secure operation. Where the Act permits processing for security or fraud prevention independently of consent, we limit it to that permitted purpose. We do not treat a general interest in improving our business as unlimited permission to reuse health content.
2. Sources of Consumer Health Data
We obtain these categories from:
- You: recordings you make or upload, documents you upload, questions you submit, health information you include in communications, and permissions or preferences you select.
- People you authorize: Care Circle members or legally authorized representatives who record or provide information on your behalf.
- Your device and your interactions with Lenaya: optional recording-location information, access activity, and technical information associated with your health records or use of health features.
- The contents of your records: clinician statements and medical documents you or an authorized person supply. A clinician mentioned in a document is not automatically a direct electronic data source to Lenaya.
- Processing of those sources: transcripts, extracted text, summaries, health concerns, answers, and other derived or inferred information generated by Lenaya and processors working on our behalf.
3. Categories of Consumer Health Data We Disclose
Depending on your instructions and the permitted purpose, disclosure may involve any relevant category in Section 1. The recipient and purpose determine the scope:
| Recipient category or situation | Data that may be disclosed | Purpose and limits |
|---|---|---|
| People you authorize, including Care Circle members | The recordings, transcripts, documents, summaries, questions, answers, health concerns, and associated visit details within the authorized scope | Let the people you choose participate in supporting your care; access depends on permissions and any required consent or authorization |
| Hosting, storage, transcription, document-processing, and AI processors | Content and associated identifiers needed for the requested processing | Provide and operate Lenaya features under our instructions and contractual restrictions; Microsoft Azure is our identified provider for these functions |
| Support, security, error-monitoring, and communications processors | Relevant account and technical information and, only where necessary, health content involved in the authorized support, delivery, or security function | Resolve your support issue, deliver requested functionality or messages, and secure the Services; access is limited to the function |
| Recipients of a legally required or otherwise legally permitted disclosure | Only information within the lawful scope of the request or permitted purpose | Meet the applicable legal requirement or permitted security purpose, subject to health-data confidentiality restrictions |
| A qualifying successor or transaction recipient | Consumer health data included in a legally permitted transaction | Continue the Services or complete a transaction consistent with the Act and applicable obligations; a transaction does not remove existing legal protections |
Under the Act, certain processor disclosures and qualifying business transfers are excluded from the definition of "sharing." We describe these disclosures so you understand how the Services operate; this does not expand any statutory exception. Other disclosures require the legal basis, consent, or authorization applicable to them.
Affiliates
We do not share consumer health data with corporate affiliates. There are no affiliate recipients to list under this Policy. If that changes, we will identify the specific affiliate recipients and meet applicable notice and consent requirements before the new sharing occurs.
Uses and disclosures we do not make
We do not sell consumer health data; disclose it for targeted or cross-context behavioral advertising; use it to create advertising profiles; or use it to train or fine-tune generative AI models. We do not provide it to data brokers or to insurers or employers for their independent use or decision-making.
4. Collection, Sharing, and Your Permission
We collect consumer health data with the consent required by the Act or to the extent necessary to provide a product or service you requested. We share consumer health data only with the required separate sharing consent or under an applicable exception, including sharing necessary for a requested service where the law permits it.
When consent is required, the request identifies the data categories, specific purpose, categories of recipients when applicable, and how to withdraw consent. Consent to sharing is separate from consent to collection. We obtain additional consent before collecting, using, or sharing additional categories or using the data for additional purposes where the Act requires it. Accepting a general privacy policy does not replace required consent.
You can remove a Care Circle member to stop future access through Lenaya. You can withdraw other applicable health-data consent by contacting us as explained below. If information is necessary for a feature you requested, withdrawing permission may prevent that feature from operating. Withdrawal of optional permission does not require acceptance of an unrelated use.
5. Your Washington Consumer Health Data Rights
You may:
- Confirm and access: ask whether we collect, share, or sell your consumer health data and obtain access to that data.
- Identify recipients: obtain the list of third parties and affiliates with whom we have shared or sold your consumer health data, together with an active email address or other online contact mechanism required by the Act. We do not sell the data, but you may still request the applicable sharing information.
- Withdraw consent: withdraw consent to future collection and sharing of your consumer health data.
- Delete: request deletion of consumer health data concerning you.
- Appeal: challenge a refusal to act on your request.
How to submit a request
Email support@lenayahealth.com. You may use "Washington Health Data Request" as the subject, but a particular subject is not required. State the action you want, and use your account email address where possible. To withdraw consent, identify the permission you wish to withdraw. You can request withdrawal and deletion together.
Available account controls also let you export information, delete individual items or your account, and manage Care Circle access. If a control does not cover your request or you cannot access your account, email us. You do not have to create a new account.
We take reasonable steps to authenticate your identity and any representative's authority. We request only information reasonably necessary for that purpose. Do not send health records or identity documents with an initial request unless we ask for them through an appropriate verification process.
Response timing, cost, and verification
We act without undue delay and within forty-five days after receiving your request. Authentication does not restart or extend that deadline. When reasonably necessary and permitted by the Act, we may extend the response period once by another forty-five days; we notify you of the extension and reason during the original period.
Information in response to requests is free up to twice annually. Additional fees or refusals for requests that are manifestly unfounded, excessive, or repetitive are limited to what the Act permits and must be supported by an explanation. If we cannot authenticate a request using commercially reasonable efforts, we explain what additional information is needed or why we cannot act.
We do not unlawfully discriminate against you for exercising these rights.
What deletion and withdrawal do
A covered deletion request reaches consumer health data across our records and network, including applicable derived data and backups. We notify relevant affiliates, processors, contractors, and other third-party recipients of the request and require them to honor applicable deletion obligations.
Our ordinary process removes most health content promptly, with some derived data and routine encrypted backups clearing within about three weeks. If deleted information is reintroduced through system recovery during that window, we reapply the deletion. The Act's permitted backup-deletion limit does not replace this shorter ordinary schedule.
We retain information only where an applicable legal requirement or exception actually supports retention. General accounting convenience does not allow us to keep all of your medical content. Any retained information is limited to the supported purpose.
We cannot remove information from another person's memory or retrieve a copy they independently saved outside Lenaya. This does not excuse deletion of copies controlled by Lenaya or any legally required notice to recipients.
Withdrawing consent stops future collection or sharing covered by that consent, subject to applicable law. It does not itself erase existing records or undo a completed lawful disclosure. Ask for deletion as well if you want us to delete existing data.
Appeals and complaints
If we refuse a request, reply to the decision or email support@lenayahealth.com with "Washington Health Data Appeal" and the reasons you disagree. We respond in writing within forty-five days after receiving the appeal, explaining our decision and any action taken.
If the appeal is denied, we provide a way to contact the Washington Attorney General. You may also use the Attorney General's complaint page.
6. Contact
Clargenta AI LLC — Lenaya Health
Email: support@lenayahealth.com
Website: https://staging.lenayahealth.com