Last Updated: September 2026
HealthMatch Pty Ltd (ABN 77 618 446 905) and HealthMatch United States Inc. ("HealthMatch," "we," "our," or "us") provide this policy under the Washington My Health My Data Act (chapter 19.373 RCW) ("MHMDA") and Nevada SB 370 (NRS chapter 603A) ("SB 370"). It applies to Washington and Nevada residents and to anyone whose consumer health data is collected in either state, and supplements our Privacy Notice — for consumer health data, this policy governs. "Consumer health data" is personal information that is linked or reasonably linkable to you and identifies your past, present, or future physical or mental health status. Because HealthMatch matches people to clinical trials, most personal information we collect is consumer health data.
Health questionnaire responses. Conditions, diagnoses, symptoms, treatments, medications, procedures, mental and physical health history, disability status, and lifestyle factors relevant to trial eligibility.
Reproductive and sexual health information. Pregnancy, breastfeeding, or planned pregnancy, where relevant to a trial's eligibility criteria.
Genetic information. Specific genetic variants or mutations relevant to a trial's eligibility criteria, or contained in retrieved medical records.
Information from medical records. With your explicit written authorisation, we retrieve your medical records for eligibility verification and store the relevant information from them securely on our Platform.
Trial application and screening information. Your trial applications, and the screening outcomes and enrolment status that trial sites report back to us.
Usage information that reveals health status. Such as the trial listings and condition pages you view and your interactions with health questionnaires.
We collect this data to: match your health profile to trial eligibility criteria and show you relevant trials; facilitate your trial applications; verify eligibility using records you have authorised us to retrieve; communicate with you about trials and your applications; operate, secure, and improve the Platform; verify and pay the partners who refer users to our Platform; and comply with law. We do not collect or use consumer health data for any other purpose without first obtaining your affirmative consent.
We collect consumer health data directly from you; automatically from your use of the Platform; from clinical trial sites for trials you have applied to; and from medical record and health information exchange providers you have authorised.
We do not sell consumer health data or disclose it to advertising networks. If a referral partner introduced you to the Platform, it processes limited attribution data (click identifier, event type, fee amount) solely as our service provider to verify referrals and reconcile payments, and for no other purpose. We share the categories above only with:
Clinical trial sites. When you apply to a trial and separately consent, we share your identifying information and relevant health profile data with the trial site named in the consent and, where you have authorised record retrieval, make the relevant medical records available to that site through our Platform.
Service providers. Providers of hosting, data warehousing, messaging, medical record retrieval services, and referral partners processing attribution data, each contractually limited to processing consumer health data solely on our behalf.
Our affiliates. HealthMatch Pty Ltd (Australia) and HealthMatch United States Inc. (United States), between which consumer health data is transferred to operate the Platform.
Legal disclosures. Where necessary to comply with law, respond to legally binding requests, or exercise or defend legal claims.
We ask for two separate consents. You can browse the Platform without either. To create an account, you must consent to us collecting and using your health information to assess your trial eligibility — we cannot match you to trials without it. Responses given before you register are not linked to you and are deleted within 24 hours if you do not register. Second, before anything goes to a research site, a consent that names the site and covers your profile and any medical records you have authorised us to retrieve, and explains how you may be contacted. You may withdraw either consent at any time in your account settings; withdrawal stops future sharing and contact but cannot undo a disclosure already made.
Non-essential cookies, pixels, session recording, and any sharing with advertising platforms happen only with your consent through our cookie banner; change your choices at any time via "Your Privacy Choices" on our Platform. Attribution reporting to the referral partner that introduced you operates under your signup consent, as described above.
Subject to verification, you may: (i) confirm whether we collect, share, or sell your consumer health data and access it, including a list of the third parties and affiliates that have received it and a means of contacting each; (ii) withdraw your consent at any time; (iii) have your consumer health data deleted, including from archives and backups within legally required timeframes, with notice of your request given to the affiliates, processors, and third parties that received it; and (iv) exercise these rights without being denied services, charged differently, or discriminated against.
To exercise any right, email privacy@healthmatch.io or use your account settings. We respond within 45 days of a verified request, extendable once by 45 days where reasonably necessary (with notice to you).
If we decline your request, you may appeal by emailing privacy@healthmatch.io with the subject line "Consumer Health Data Appeal." If your appeal is unsuccessful, you may contact the Washington Attorney General (atg.wa.gov/file-complaint) or the Nevada Attorney General (ag.nv.gov). Washington residents also have a private right of action under the MHMDA and the Washington Consumer Protection Act.
We will not collect or share new categories of consumer health data, or use it for new purposes, without first notifying you and obtaining your affirmative consent. The date of the most recent revision appears at the top of this page.
HealthMatch Pty Ltd (ABN 77 618 446 905), Attn: Privacy Officer, 10-14 Waterloo Street, Surry Hills NSW 2010, Australia — privacy@healthmatch.io.
HealthMatch United States Inc., 33 Arch Street, Boston, MA 02110, USA.