Consumer Health Data Privacy Policy
Effective and last updated September 8, 2026
This policy explains how Cutiefi LLC ("Cutiefi," "we," "us," or "our") handles consumer health data under Washington's My Health My Data Act.
Scope
Consumer health data is personal information that identifies or could reasonably identify a Washington consumer and relates to the consumer's past, present, or future physical or mental health, health care, or efforts to obtain health care. It includes information that identifies a consumer as seeking health care and inferences drawn from other information.
This policy applies to consumer health data Cutiefi collects through cutie.fi, the patient experience, related communications, and our work with participating or requested practices. It supplements our general Privacy Policy.
Categories of consumer health data we collect
- Requested care and provider information, including the service or procedure type, provider or practice, requested care amount, timing, and follow-up information that you or a practice enters.
- Care-linked conversations and inferences, including chat or support messages, preferences, activity, consent choices, and an inference that a person is seeking health care.
- Care-linked financial and bank information, including the requested amount, income, balances, transaction history and descriptions, recurring inflows and outflows, account ownership, institution, account type and last four digits, manually entered payment-account information, and payment history.
- Care-linked documents, including an identity document, voided check, bank letter, paystub, agreement, or other file you submit in connection with care financing.
- Identity, contact, device, and session information associated with a care request, including name, email, telephone number, date of birth, address, Social Security number, device or browser information, IP address, and session identifiers.
- Application and account information associated with care, including application status, eligibility information, terms, signatures, servicing activity, and communications with a practice.
Sources of consumer health data
We collect consumer health data from you; a co-borrower or representative you authorize; participating or requested practices and their personnel; conversations and other interactions with our services; Stripe Financial Connections and connected financial institutions with your permission; consumer reporting, identity, and verification providers with appropriate permission or authority; public professional registries; and processors that support the services.
Why we collect and use consumer health data
We collect and use consumer health data to:
- respond to your request and determine whether a provider or practice participates;
- identify or contact a provider at your direction;
- support an application for financing offered and owned by a participating practice;
- verify identity, account ownership, income, balances, cash flow, credit, fraud risk, affordability, and eligibility;
- prepare agreements, service an account on a practice's behalf, carry out payment instructions, and reconcile transactions;
- provide conversational assistance, customer support, and communications;
- keep records of permissions and requests, protect the services, prevent fraud, and troubleshoot errors; and
- comply with law and exercise or defend legal rights.
Categories of consumer health data we disclose
We may share or otherwise disclose the categories described above, including identity and contact information; requested care, provider, practice, and care-financing information; care-linked conversations and inferences; application, eligibility, account, payment, and servicing information; bank and transaction information; submitted documents; consent and request records; and device, session, security, or diagnostic information.
We limit a disclosure to what is reasonably necessary for the purpose described in this policy or what you direct or authorize.
Categories of recipients
We may disclose consumer health data to:
- a participating or requested provider or practice;
- processors that provide conversational artificial intelligence, hosting, database, storage, backup, documents, communications, customer support, security, authentication, bot protection, or error-monitoring services;
- Stripe Financial Connections, connected financial institutions, and payment or bank-verification providers;
- consumer reporting, identity, fraud, professional, and business-verification providers;
- professional advisers, auditors, regulators, courts, law enforcement, or other authorities where legally permitted or required; and
- another recipient you direct or authorize.
Cutiefi does not disclose consumer health data to any Cutiefi affiliate. We do not sell consumer health data.
Consent and changes in use
We collect and share consumer health data to the extent necessary to provide a product or service you request or with your consent, as permitted by law. When consent to share is required, it is separate and distinct from consent to collect. You may withdraw consent as described below.
Before collecting or sharing a new category of consumer health data, or collecting, using, or sharing consumer health data for a purpose not described here, we will update this policy and obtain affirmative consent when required.
Your Washington rights
Subject to applicable law, you may ask us to:
- confirm whether we collect, share, or sell your consumer health data;
- give you access to the data and a list of third parties and affiliates that received it, including an active email address or other online contact method for each;
- withdraw consent for future collection or sharing; or
- delete the data from our systems and notify processors, contractors, affiliates, and other third parties that received it.
Email legal@cutie.fi with the subject "Washington Consumer Health Data Request." You do not need to create an account. We may ask for information reasonably necessary to authenticate your request, but we will not use authentication information for another purpose.
We generally respond within 45 days. We may extend that period once by up to 45 additional days when reasonably necessary and will tell you why. If deletion from archived or backup systems is not immediately possible, we will complete it as required by law and within six months after authenticating your request.
If we deny all or part of your request, you may appeal by replying to our decision or emailing legal@cutie.fi with the subject "Privacy Appeal." We will respond to an appeal within 45 days. If we deny the appeal, you may contact the Washington State Attorney General.
Please do not send a Social Security number, bank login credential, or medical record by ordinary email.