1. Scope and our role
This policy is intended to satisfy the Washington My Health My Data Act when that law applies. Cocata Innovations may process consumer health data for its own consultations or as a processor providing AI reception, scheduling, communications, workflow, or support services to a business client. When a client determines why and how data is processed, that client’s health-data notice and instructions also apply.
This policy does not replace a HIPAA Notice of Privacy Practices. Before a deployment may process protected health information subject to HIPAA, Cocata Innovations and the client must complete the appropriate written agreements and approve the deployment for that use.
2. Categories of consumer health data we may collect
- Identity and contact information connected to a request for health, dental, chiropractic, medical-spa, wellness, behavioral, or related services.
- Appointment type, provider, location, scheduling preferences, and status.
- Symptoms, concerns, requested services, treatment-related questions, accessibility needs, and other information a consumer chooses to communicate.
- Call audio, recordings, transcripts, chat content, summaries, and AI-agent interactions that contain or reveal health information.
- Information about past, present, or future physical or mental health, care, treatment, medications, bodily functions, reproductive or sexual health, or health-related purchases.
- Biometric information only when an approved service is specifically designed to collect or use it. Ordinary call audio is not used to identify a person by voiceprint unless separately disclosed and consented to.
- Inferences that associate a consumer with health status or an attempt to obtain health services.
3. Purposes for collection and use
- Respond to inquiries and provide requested information approved by the client.
- Schedule, confirm, change, or cancel appointments and route messages.
- Record, transcribe, summarize, quality-check, and securely route communications when required notice and consent have been provided.
- Operate client-approved AI agents and workflows, perform human escalation, and provide technical support.
- Maintain security, prevent fraud or misuse, comply with law, and honor consumer requests.
We will not collect, use, or share additional categories of consumer health data or use it for materially different purposes without the disclosure and affirmative consent required by law.
4. Sources of consumer health data
Sources may include the consumer; the healthcare, dental, chiropractic, medical-spa, wellness, or other client providing the relevant agent; the client’s authorized staff; authorized caregivers or representatives; client-connected scheduling, CRM, telephone, portal, or record systems; and service providers acting at our or the client’s direction.
5. Consumer health data we share
Depending on the approved deployment, we may share the categories listed above only as needed to provide the requested service, follow the client’s instructions, protect the service, or comply with law. We do not sell consumer health data and do not use it for targeted advertising.
6. Categories of third parties and specific affiliates
Consumer health data may be shared with:
- The business client responsible for the relevant agent, its authorized workforce, and its designated providers.
- Hosting, cloud storage, security, backup, and technical-infrastructure providers.
- Telephony, call-recording, transcription, messaging, email, scheduling, CRM, and client-portal providers.
- AI model and AI-processing providers configured for the approved deployment.
- Professional advisers, regulators, courts, or law enforcement when disclosure is authorized or required.
Cocata Innovations has no corporate affiliates with which it currently shares consumer health data. Deployment-specific providers can vary by client. A verified consumer may request the list of third parties and affiliates that received their data.
7. Your Washington rights
You may have the right to:
- Confirm whether we collect, share, or sell your consumer health data and access that data.
- Receive a list of third parties and affiliates with which your consumer health data was shared.
- Withdraw consent to collection or sharing.
- Request deletion, including notification to applicable processors and third parties.
- Appeal our refusal to act on a request.
Submit a request by emailing support@cocatainnovations.com. We will authenticate and respond within the time required by applicable law. You do not need to create a new account. If we deny a request, reply with “Appeal” in the subject line to request review. If an appeal is denied, you may contact the Washington State Attorney General.
8. Retention, security, and changes
We retain consumer health data only as reasonably necessary for the approved service, the client’s documented instructions, security, legal obligations, or dispute resolution. We apply safeguards appropriate to the sensitivity of the data and require processors to handle it consistently with this policy and applicable agreements. Changes to the categories or purposes described here will be disclosed and consent obtained when required.