Overview

This Consumer Health Data Privacy Policy (“Health Data Privacy Policy”) supplements the Natural Grocers Privacy Policy and explains Vitamin Cottage Natural Food Markets, Inc.’s (“Natural Grocers”, “we”, “us”, or “our”) collection, use, and disclosure of personal data that may identify your past, present, or future physical or mental health status (“consumer health data”). While we do not collect consumer health data in the traditional sense, our collection of purchase data and transaction history for certain products we provide may include data that is defined as consumer health data under Washington state law, as further described below.

When This Consumer Health Data Privacy Policy Applies

This Health Data Privacy Policy applies solely to Washington residents who interact with us in an individual or household capacity and applies only to personal data defined as “consumer health data” defined under and subject to the Washington My Health My Data Act.

Consumer health data does not include data generated by your interactions with us, such as browsing or purchasing, that does not identify your health status. In other words, products that the public at large would use will not generate consumer health data. For example, products that are used for general hygiene such as toothpaste or toilet paper, common supplements such as Vitamin C, or products that are not used to measure a specific health condition such as a thermometer will not give rise to consumer health data when you browse or shop them. For more information regarding our data processing practices of non-consumer health data, please refer to our Privacy Policy.

Consumer Health Data We May Collect

Therefore, we may collect or receive the categories of consumer health data listed below: 

• Transaction Data. Data about your purchases, exchanges, or returns of certain products that could be deemed to include consumer health data. For example, products that could identify a certain health condition. 
• Other Health Data. Other consumer health data that you provide in your communications with us.
• Incident Data. Data pertaining to the incident where you endure an injury or adverse reaction or need medical attention while in one of our stores, or if an injury is reported that is associated with one of our products.
• Associated Data. Data that we derive or extrapolate from data that is not consumer health data and then could be used to associate an individual to the data listed above.

Sources From Which We Collect Consumer Health Data

The sources of data from which we may collect your consumer health data are:

• Provided directly by you or a member of your household.
• Collected from a device associated with you or your household.
• Collected through in-store technology.

Purpose for Collecting Consumer Health Data 

We may use consumer health data for certain purposes, including:

• To complete transactions or provide the products or services you request.
• To operate our {N}power customer loyalty program. 
• To fulfill our legal functions or obligations if required by subpoena or regulatory demand.
• To detect or prevent harmful behavior such as identity theft, fraud, harassment, deceptive activities, or activities that are illegal under applicable law.
• For other purposes with your consent.

What Consumer Health Data We Disclose; Who We Disclose It To

We disclose your consumer health data to processors when such disclosure is to provide goods or services you request, in a manner consistent with the purpose for which your consumer health data was collected.

Your Rights

Explanation of Your Rights

If you are a resident of Washington, you have the right to:

• request access to your consumer health data;
• confirm whether we have disclosed or sold your consumer health data;
• delete your consumer health data; or
• withdraw your consent or authorization relating to such data.

How to Exercise Your Rights

Only you may make a consumer request (that we verify) related to your consumer health data (subsequently referred to as a “consumer request”). You may also make a consumer request on behalf of your minor child or in the case of a guardianship or similar, you may exercise such rights on the ward’s behalf. The consumer request must:

• Provide sufficient information that allows us to reasonably verify that you are the person about whom we collected consumer health data.
• Describe the request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

Once we receive a consumer request, we will take commercially reasonable actions to authenticate the identity of the person exercising the request, including comparing any such identification data provided against the consumer health data requested. We authenticate a request by asking for the requestor’s name, phone number, and email.

We cannot respond to your request or provide you with consumer health data if we cannot verify your identity to make the request and confirm that the consumer health data relates to you.

Making a consumer request does not require you to create an account with us, but we may require authentication of the consumer that is reasonable considering the nature of the consumer health data requested.

To exercise the rights described above, please submit a consumer request to us by clicking this link and filling out the form.

Initial Request Format and Timing

We endeavor to respond to a consumer request within 45 days of its receipt. If we require more time (for a maximum total of 90 days), we will notify you within 45 days of receiving the initial consumer request that we require more time and will provide a reason for the delay.

We do not charge a fee to process or respond to your consumer request unless the request is made more than twice in a 12 month period. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing the request.

If we determine that we will not act on a request, we will provide a response to you that includes the basis of our reasoning. If the reasoning is our inability to authenticate the request, we will explain the efforts we took to authenticate the request and why we were unable to do so.

Appeal Response Format and Timing

If we decide that we cannot comply with your initial consumer request, you have the right to appeal our decision. Any appeal should be sent to the place where the initial consumer request was sent. The appeal should clearly indicate that it is an appeal of an initial consumer request and should include the initial consumer request along with our response explaining why we cannot comply with the initial consumer request. 

We will review all appeals and provide a response within 45 days of receipt of the appeal. In our response to your appeal we will inform you of any action taken or not taken, along with an explanation of the reason in support of the response. If your appeal is unsuccessful, you can contact the Washington State Attorney General to submit a concern or lodge a complaint at www.atg.wa.gov/file-complaint.