Consumer Health Data Policy
This policy explains how Pro ESA Letter, as the platform connecting you with independent licensed mental health professionals, handles consumer health data under state privacy laws.
Pro ESA Letter Consumer Health Data Policy
This Consumer Health Data Policy supplements our Privacy Policy and HIPAA Notice of Privacy Practices. It specifically addresses how consumer health data is handled under state privacy laws, including Washington’s My Health My Data Act, California’s Confidentiality of Medical Information Act, and other applicable state consumer health data privacy laws.
Legal Compliance Notice
Pro ESA Letter is committed to complying with applicable state and federal laws regarding consumer health data privacy. This policy outlines our practices as the administrative platform connecting you with independent LMHPs, and informs you of your rights regarding your consumer health data.
What is Consumer Health Data?
Consumer Health Data refers to personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future health status. This includes but is not limited to:
Health Conditions
Information about physical or mental health conditions, disorders, or diagnoses
Treatments & Medications
Information about treatments, medications, or other health interventions
Health Measurements
Data derived from health measurements, tests, or evaluation instruments
Healthcare Services
Information related to seeking, obtaining, or receiving healthcare services
What This Policy Covers
This policy applies to all consumer health data collected, used, or disclosed in connection with our ESA evaluation platform. This includes data collected through:
- Our telehealth platform and evaluation intake forms
- Communications facilitated with licensed mental health professionals
- Customer support interactions
- Website usage and analytics (where health-related)
- Marketing communications (where health-related)
Our Data Collection Flow
Direct Collection
We collect consumer health data directly from you when you voluntarily provide it during the intake process — in evaluation forms, during telehealth consultations with your matched LMHP, and in communications with our support team.
Automated Collection
We automatically collect certain technical information when you use our website. This may include IP addresses, device information, browser type, and usage patterns. We only collect health-related data through automated means when you explicitly consent.
Third-Party Sources
In limited circumstances, we may receive consumer health data from third parties, such as when you authorize another healthcare provider to share information with us. We only accept such data with your explicit consent.
Types of Consumer Health Data We Collect
Consumer health data is used solely for purposes consistent with our platform’s role and as permitted by law:
Facilitating Your Evaluation
To connect you with a licensed mental health professional who independently conducts your assessment and determines eligibility for an ESA letter.
Communication Facilitation
To facilitate communication between you and your matched LMHP throughout the evaluation process.
Platform Improvement
To analyze and improve our platform, matching process, and the quality of the overall service experience.
Legal Compliance
To comply with legal obligations, respond to legal requests, and ensure the security of our platform.
Important Limitations
We do not use consumer health data for advertising. We do not sell consumer health data to third parties. We do not use consumer health data to make decisions about employment, credit, insurance, or housing.
Disclosure to Service Providers
We may disclose consumer health data to third-party service providers who assist in operating our platform. These providers are contractually bound to protect your data and use it only for the specific purposes we authorize. Examples include:
- The licensed mental health professional matched to conduct your evaluation
- Technical service providers maintaining our platform
- Payment processors handling transactions
- Customer support service providers
Legal and Required Disclosures
We may disclose consumer health data when required by law or legal process, including:
- Court orders, subpoenas, or other legal requirements
- Law enforcement requests, with appropriate legal process
- Government agency requests for oversight or compliance
- To prevent imminent harm to individuals or the public
Disclosure With Your Authorization
We will only disclose your consumer health data to third parties for purposes not covered by this policy with your explicit, written authorization, which you may revoke at any time.
Authorization Requirements
Any authorization for disclosure must be in writing, specify the recipient, describe the information disclosed, state the purpose, and include an expiration date or event. You may revoke any authorization at any time.
Depending on your state of residence and applicable laws, you may have the following rights:
Right to Access
Confirm whether we are processing your consumer health data and access such data.
Right to Delete
Request deletion of your consumer health data, subject to certain exceptions.
Right to Withdraw Consent
Withdraw consent for the collection and sharing of your consumer health data.
Right to Data Portability
Obtain a copy of your consumer health data in a portable, readily usable format.
How to Exercise Your Rights
To exercise any of these rights, please submit a verifiable request by contacting us using the details in the Contact Information section below.
Verification Process
We will need to verify your identity before processing most requests, which may involve asking for additional information. We will respond to verifiable requests within the timeframes required by applicable law.
Our Security Measures
We implement and maintain reasonable security measures to protect consumer health data from unauthorized access, use, or disclosure:
Technical Safeguards
Encryption of data in transit and at rest, secure access controls, and regular security updates.
Administrative Safeguards
Staff training, security policies and procedures, risk assessments, and incident response plans.
Physical Safeguards
Secure data facilities, access controls, and proper disposal of physical records.
Monitoring & Auditing
Regular security monitoring, vulnerability assessments, and audits.
Data Retention
We retain consumer health data only as long as necessary to fulfill the purposes it was collected for, and retention periods vary by the type of record and the law that governs it:
- HIPAA compliance documentation (such as authorizations and privacy policy records held on behalf of LMHPs) is retained for a minimum of 6 years, as required by federal law — HIPAA itself does not set a retention period for clinical records.
- Clinical evaluation records are retained by your LMHP according to their state’s medical record retention law, which commonly ranges from 7 to 10 years for adults and can be longer for minors, and varies by the state where your LMHP is licensed.
- Financial and billing records are retained for 7 years from the transaction date, consistent with standard recordkeeping practice for tax and accounting purposes.
- Deletion requests: where applicable state consumer health data laws (such as Washington’s My Health My Data Act) grant you a right to deletion, we will delete your consumer health data upon a valid request, except where limited exceptions apply — for example, where retention is necessary to prevent fraud or security incidents, or where a separate legal retention obligation applies.
Breach Notification
In the event of a security breach involving your consumer health data, we will notify you as required by applicable law:
- Prompt investigation of any suspected breach
- Notification to affected individuals without unreasonable delay
- Reporting to appropriate regulatory authorities as required
- Implementation of remedial measures to prevent future breaches
Your Privacy Matters to Us
We are committed to protecting your consumer health data and respecting your privacy rights. If you have questions about this policy or wish to exercise your rights, we’re here to help.
Contact Information
For questions about this Consumer Health Data Policy or to exercise your privacy rights, please contact us:
Privacy Team
Pro ESA Letter
Email Address
support@proesaletter.comWe typically respond to privacy requests within 45 days as required by law. Complex requests may require an additional 45-day extension, in which case we will notify you.