Skip to main content
MAGNUSRX
Sign inStart visit

Consumer Health Data Privacy Policy

Effective date: October 31, 2026. Last updated: October 31, 2026.

This is Obsidian Research Group, Inc.'s (ORG's) notice for consumer health data processed through MagnusRX that is subject to Washington's My Health My Data Act. Consumer health data includes personal information linked or reasonably linkable to you that identifies past, present or future physical or mental health status. It can include inferred health interests and seeking health services, not just medical records. We apply the rights described here without relying on a business-size or HIPAA exemption to deny them. Applicable HIPAA protections also remain in place for protected health information.

1. Categories of consumer health data we collect

  • Health conditions, symptoms, medical history, medications, allergies, treatment history, sexual or reproductive health information, body measurements and questionnaire/follow-up answers that you provide for the requested service.
  • Information identifying that you seek, receive or pay for health services: treatment selections, account/visit/appointment details, prescriptions, pharmacy fulfillment, lab information, shipment and subscription/payment records.
  • ID photos, requested health-related photos, prescription documents, lab requisitions and information in communications with your care team or support.
  • Name, contact information, birth date, sex, address, account and device identifiers when linked to health information or seeking care.
  • Health interests that may be inferred from treatment-page visits, referring links, campaign/referral identifiers and website interactions, including cookie and network/device information associated with those activities.

2. Sources of consumer health data

We collect information directly from you through account creation, intake, follow-up, uploads, messages, payments and other interactions. We receive information from Beluga and its clinicians, pharmacies and lab services arranged through Beluga, and Stripe. We collect website and device information through your browser, cookies, referral links and page interactions. Health interests may be inferred from those activities.

3. Why we collect and use it

We use consumer health data to establish and secure accounts, check eligibility, send your information to Beluga for clinician review, coordinate prescribed treatment, labs and pharmacy fulfillment, process payments and subscriptions, show service status, deliver communications, provide support and keep consent and audit records. ORG coordinates the platform; Beluga provides clinical care and maintains the clinical system of record.

We use referral, campaign and browsing information to attribute signups and purchases and measure public marketing-page activity. Those activities can involve inferred health interests. Google measurement is limited to public marketing documents, not account, intake, checkout or care pages. This notice does not itself supply consent; collection and sharing that require consent under the Act require that consent separately.

4. Categories we share, why, and with whom

  • Clinical services: identity/contact information, answers, health history, photos and care messages go to Beluga Health, P.A. and its clinicians for evaluation and care. Lab services arranged by Beluga receive information for requested testing.
  • Pharmacy and delivery services: identity/contact/shipping information, prescriptions and related fulfillment information go to Strive Pharmacy or the pharmacy arranged through Beluga, including TPH or VS Digital as appropriate to the order, and their fulfillment/delivery providers.
  • Platform service providers: Render processes information in our application/database for hosting. Network delivery/security providers process website requests. Amazon Web Services SES receives email addresses and service/security messages for delivery. Stripe receives identifying and transaction information for payments. These activities can identify that someone is using a health service.
  • Marketing measurement: Google receives browsing, network/device and interaction information from public marketing pages through Google Tag Manager and Google Analytics. Treatment-page URLs and identifiers can reveal health interests. The published configuration includes automatic detection of email, phone and address values where present on a tagged page; the public marketing pages have no patient signup or contact-capture forms.
  • Website verification: LegitScript receives normal network/browser request information when its verification image loads in the public footer; visiting a health-service site can itself reveal a health interest.

No ORG corporate affiliates receive consumer health data. The companies listed above receive information as clinical partners, service providers or the other third-party categories described above, not as ORG corporate affiliates. Applicable legal restrictions still govern these disclosures, including any required consent or separate authorization for a sale of consumer health data.

5. How to exercise your rights

For consumer health data covered by the Act, you may ask us to confirm whether we collect, share or sell it; access it; obtain a list of all third parties and affiliates with whom we shared or sold it, with an active email address or other online contact for them; withdraw consent to collection and sharing; and delete your data. Deletion rights extend to required notifications to affiliates, processors, contractors and other third parties, subject to the Act's requirements.

Obsidian Research Group (ORG) handles these requests. Email support@obsidianresearch.org with the subject "Consumer health data request," or write to ORG at PO BOX 16254, Seattle, WA 98116, United States. State the right you want to exercise and how to reach you. Do not send medical records or ID photos in ordinary email. We may need to authenticate your request through an appropriate channel. You do not need to create a new account to make a request. Requests are free within the limits provided by the Act.

We will respond without undue delay and within 45 days of receipt, with any extension permitted by the Act explained within that period. If we decline to act, we will explain why and how to appeal. Reply with "Consumer health data appeal" and your request reference to appeal; we will explain the appeal decision in writing within 45 days of receiving it. If the appeal is denied, you may complain to the Washington Attorney General.

We will not discriminate against you for exercising rights under the Act. Withdrawing consent or deleting information necessary for a requested service may mean we cannot continue that service. We will explain applicable limitations rather than treating cancellation of a subscription as a deletion request.