ellenrx

Ellen Consumer Health Data Privacy Policy

Last Updated: November 3, 2026 This Consumer Health Data Privacy Policy ("Notice") supplements the Ellen Privacy Policy and applies to Consumer Health Data subject to the Washington State My Health My Data Act (RCW 19.373), Nevada's consumer health data law (SB 370 / NRS 603A), and similar state laws (together, "Consumer Health Data Laws"). This Notice does not address Protected Health Information ("PHI") regulated by HIPAA when Bodinh LLC acts as a business associate to a provider under a signed BAA for LMN / provider PHI features. Direct-to-consumer Patient User use is not treated as Covered Entity activity. Review your health plan's or provider's notice of privacy practices for how those entities handle PHI.

1. Consumer Health Data We Collect and Why

"Consumer Health Data" means personal information linked or reasonably linkable to you that identifies your past, present, or future physical or mental health status as defined in applicable Consumer Health Data Laws. It does not include information that is de-identified under those laws. Categories Ellen may collect (usually because you choose to share them) include:

  • Health-related conditions, diagnoses, symptoms, medications, treatments, and lab values you enter or upload
  • Insurance coverage, denial reasons, denial letters, claims, bills, and EOBs you submit
  • Appeal and Cost Hub inputs (including ranges and codes for income, balance, cost, household size, partial ZIP, and insurance type when optional capture is enabled)
  • Information that could identify your attempt to seek health care or drug access help
  • Inferences derived from the above that relate to health status

Purposes (with consent where required):

  • Provide the Service (denial decoding, appeal drafts, bill/EOB tools, Cost Hub templates, related education)
  • Communicate service and care messages by email (Ellen does not currently send text messages; if text messaging is added, this Notice will be updated and consent will be requested before any texts are sent)
  • Authenticate you and protect security and integrity of systems
  • Customer support and quality improvement of Ellen's own services
  • Produce De-identified Aggregate Data for research and insights, only if you opt in and have not opted out
  • Comply with law

Ellen obtains affirmative, logged, versioned consent before collecting Consumer Health Data. Ellen does not rely on a passive "by using the site" notice for that collection.

2. Sources of Consumer Health Data

  • You, and people authorized to act for you (such as a caregiver using the Service on your behalf)
  • Documents and images you upload (denial letters, labs, bills, EOBs)
  • Your devices (technical data such as IP for security; not sold as health data)
  • Optional Cost Hub tool inputs when capture is enabled

Ellen does not buy Consumer Health Data from data brokers.

3. Consumer Health Data We Share

Ellen does not sell Consumer Health Data. Ellen does not share Consumer Health Data for targeted advertising. Ellen may share Consumer Health Data only as follows:

  • Service providers / processors that help operate Ellen (for example cloud hosting, AI processing under contract, email delivery, and fax delivery when you authorize a fax), under contracts that limit use to providing services for Bodinh LLC
  • At your direction, for example when you authorize a specific fax to an insurer and confirm the number
  • Legal obligations and rights, including lawful process, fraud prevention, and protecting safety
  • Business transactions, such as a merger negotiation, to the extent permitted by law
  • De-identified Aggregate Data with research, policy, health-system, payer, or commercial insight recipients under the public commitment below (only if you have not opted out of anonymized contribution)

Ellen has no affiliates with whom it shares Consumer Health Data at this time. If that changes, this Notice will be updated.

4. Public De-Identification Commitment

If Ellen processes de-identified data, Ellen will maintain and use that data without attempting to re-identify you except as permitted by law, and will contractually obligate recipients of such data to meet the same standard. Any data shared or licensed outside Bodinh LLC for research, insights, or commercial aggregate products is de-identified aggregate only. Technical method details are not published in this Notice while patents are pending. Retention of De-identified Aggregate Data: maximum 24 months from the capture year, with a logged automatic monthly purge. Purpose: improve Ellen tools and produce aggregate statistics about access, denials, and cost burdens. Anonymized-data opt-out: you may opt out in account settings or by emailing privacy@ellenrx.com. Opt-out is enforced before any shared or commercial dataset leaves Ellen.

5. How to Exercise Your Rights

Depending on your state, you may have rights to access Consumer Health Data, know with whom it was shared, withdraw consent to collection or sharing, and request deletion, subject to legal exceptions. Email privacy@ellenrx.com from the address associated with your use of Ellen (or with enough information for us to verify you). We respond within the timelines required by applicable law (generally 30 to 45 days, with notice if an extension is needed). If we decline a request and your state provides an appeal, reply to our decision with subject line "Appeal." A different reviewer will decide. If your appeal is denied, you may contact your state attorney general.

6. Washington-Specific Section (RCW 19.373)

This section is for Washington consumers and implements the six disclosures expected for a Consumer Health Data Privacy Policy:

  • Categories collected and why: as listed in Section 1 (service delivery; security; optional de-identified aggregate insights with opt-in / opt-out).
  • Sources: as listed in Section 2.
  • Categories of data shared: service-provider processing; user-directed fax; legal disclosures; De-identified Aggregate Data only for insight recipients (no identifiable Consumer Health Data sold).
  • Third parties and affiliates:
  • Categories of third parties that may receive Consumer Health Data as processors or at your direction: cloud hosting and AI processing provider; transactional email delivery service; fax delivery service (only packets you choose to send); privacy-focused web analytics (cookieless, anonymous page counts; health details removed from page addresses; no health data shared with analytics). No affiliates at this time. Named research or insight partners receive de-identified aggregate only when sharing occurs. A list of the specific service providers we use is available on request at privacy@ellenrx.com.
  • How to exercise rights (RCW 19.373.040): access, withdraw consent, deletion via privacy@ellenrx.com as in Section 5.
  • Public commitment (RCW 19.373.010(10)): keep data de-identified; do not attempt re-identification; require recipients to do the same.

Separate affirmative consent is required for collection, and a separate affirmative consent is required before sharing Consumer Health Data with a third party that is not a processor. Ellen does not sell Consumer Health Data under RCW 19.373. Ellen does not implement prohibited geofencing around healthcare facilities to identify, track, or message consumers about Consumer Health Data.

7. Nevada-Specific Section (SB 370 / NRS 603A)

This section is for Nevada consumers. Nevada law regulates consumer health data collection, sharing, and sale, and expects a conspicuous consumer health data privacy policy link on the main site.

  • Ellen collects the categories in Section 1 for the purposes stated there, with affirmative consent where required.
  • Ellen does not sell Consumer Health Data.
  • Sharing is limited as described in Section 3.
  • Nevada consumers may exercise access, deletion, and consent-withdrawal rights by emailing privacy@ellenrx.com.
  • Geofencing restrictions under Nevada law are honored; Ellen does not use prohibited geofencing to collect Consumer Health Data around regulated facilities.

8. Changes and Contact

We may update this Notice. The "Last Updated" date will change, and material changes will be communicated as described in the Privacy Policy. Bodinh LLC privacy@ellenrx.com | hello@ellenrx.com EllenRx (ellenrx.com), free for patients.