Washington Consumer Health Data Privacy Policy

Effective: March 31, 2024

Genentech, Inc. (“Genentech,” “we,” “our,” or “us”) values your privacy and the protection of your Personal Data. This policy supplements Genentech’s Privacy Notice and applies to collection of “consumer health data” subject to the Washington State My Health My Data Act (the “MHMDA”).

In this policy, we use the term “consumer” to mean (1) residents of the Washington State and (2) other individuals whose consumer health data we collect in Washington State, consistent with the definition of “consumer” in the MHMDA. Also consistent with the MHMDA, we use the term “consumer health data” in this policy to mean personal information that is linked to, or reasonably linkable to, a consumer and that identifies the consumer’s past, present, or future physical or mental health status.

This policy does not apply to any other Personal Data we collect.

Collection, Sources, Uses, and Sharing of Consumer Health Data:

We collect, use, and share the following categories of consumer health data (as further described below):

  • Individual health conditions, treatment, diseases, or diagnosis;
  • Social, psychological, behavioral, and medical interventions;
  • Health-related surgeries or procedures;
  • Use or purchase of prescribed medication;
  • Bodily functions, vital signs, symptoms, or measurements of the information described in this subsection;
  • Diagnoses or diagnostic testing, treatment, or medication;
  • Reproductive or sexual health information;
  • Genetic data;
  • Data that identifies a consumer seeking health care services; and
  • Any information that we, or one of our processors, processes to associate or identify a consumer with the data described above that is derived or extrapolated from non-health information (such as proxy, derivative, inferred, or emergent data by any means, including algorithms or machine learning).

The types of consumer health data we collect and disclose depends on your relationship with Genentech. Not all of the consumer health data listed in the following charts may apply to you. If the nature of your relationship with Genentech changes, additional categories of consumer health data may also apply.

Exercising your rights

Subject to certain legal limitations and exceptions, you have the following rights with respect to any consumer health data we may collect about you:

  • The right to confirm whether we are collecting, sharing, or selling your consumer health data and to access such data, including a list of all third parties and affiliates with whom we have shared or sold the consumer health data and an active email address or other online mechanism that you may use to contact these third parties;
  • The right to withdraw consent from our collection and sharing of your consumer health data; and
  • The right to have your consumer health data deleted.

If you would like to exercise your rights pursuant to the MHMDA, please submit a consumer request to us by completing the form located here or, if you prefer, you may submit your request by calling us at 800-975-7105 (toll-free).

You may make a request on your own behalf, and if you are the parent or guardian of a minor child, you also may make a request related to your child’s consumer health data. If you wish to designate an authorized agent to make a request on your behalf, please provide us with a signed declaration stating that your intent is to permit that individual to act on your behalf and include such individual’s full name, address, email address, and phone number. That way we will be sure you have fully authorized us to act in accordance with the requests of that individual.

As indicated above, in order to protect your consumer health data from unauthorized disclosure or deletion at the request of someone other than you or your legal representative, we require identification verification before granting any request to access, withdraw consent, or delete your consumer health data. We take special precautions to help ensure this. We cannot respond to your request or provide you with consumer health data if we cannot verify your identity or authority to make the request and confirm that the consumer health data relates to you. We will only use consumer health data collected in connection with a verifiable consumer request to verify the requestor's identity or authority to make the request.

We endeavor to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to 45 additional days), we will inform you of the reason and extension period in writing.

If your request to exercise a right under the MHMDA is denied, you may appeal that decision by contacting our privacy support team via our web form. If your appeal is unsuccessful, you may raise a concern or lodge a complaint with the Washington State Attorney General at www.atg.wa.gov/file-complaint.