Washington educational resource

Washington MHMDA for Health Coaching Apps: Coach Messages and Goal Tags Are Consumer Health Data

Health coaching apps occupy an unusual position in the consumer health data landscape. The model is not a regulated provider relationship under HIPAA, but the data the platform handles is the most narrative health data the user generates anywhere: intake forms, presenting concerns, goal statements, chat logs with the coach, progress notes, photos, and the categorizations the app assigns ("anxiety-related," "weight management," "burnout recovery"). The Washington My Health My Data Act reaches this entire surface area under RCW 19.373.010, including the inferences a coaching AI or matching algorithm derives from the inputs. RCW 19.373.090 converts any compliance gap into a per se Consumer Protection Act violation with treble damages capped at $25,000 on the enhancement and one-way attorney's fees under RCW 19.86.090.

Last legally reviewed: 2026-05-19. Citations verified against Chapter 19.373 RCW on app.leg.wa.gov.

What health-coaching data MHMDA reaches

Intake forms (health history, current concerns, medications, allergies).
Goal statements (weight loss, smoking cessation, anxiety reduction, fertility, chronic-condition management).
Chat logs and voice notes between user and coach.
Coach-assigned tags and categorizations.
Progress check-ins, mood logs, symptom diaries.
Photos uploaded for progress tracking (body composition, skin condition).
Inferences from coaching AI: matching algorithm tags, "user is high-risk," "user needs medical referral," "user is plateauing."

The four MHMDA hooks for coaching apps

1. Separate Consumer Health Data Privacy Policy under RCW 19.373.020. Coaching marketplaces sometimes have a "coach agreement" and a "user agreement" plus a privacy policy. MHMDA still requires a standalone Consumer Health Data Privacy Policy with the five substantive disclosures and a prominent homepage link. A "we collect health information to provide coaching" line buried in the main privacy policy does not satisfy.

2. Two-layer consent under RCW 19.373.030. Collection consent for the intake. Separate sharing consent for the coach access. Separate consent again for any third-party sharing (analytics, AI inference, employer reporting, insurance, partner platforms). Coaching apps with multiple receiving entities (the human coach, the AI matching engine, the supervising clinician, the employer-wellness program, the insurance carrier) need granular sharing toggles.

3. Employer and insurance sharing. Many coaching apps are sold through employer-wellness contracts or insurance programs. The moment data flows back to the employer or insurer in identifiable or near-identifiable form (cohort dashboards, individual progress reports, risk flags), the receiving entity must be disclosed and consented to under RCW 19.373.020 and RCW 19.373.030. If the platform receives consideration from the employer or insurer in exchange for any consumer-identifiable data, the transfer can be a "sale" under RCW 19.373.010 requiring the nine-element authorization under RCW 19.373.070.

4. Processor flow-down to coaches under RCW 19.373.060. Independent contractor coaches who access user data through the platform are processors under MHMDA. A binding contract limiting their use to documented instructions is required. A standard coach agreement that lets the coach reuse client material for marketing, case studies, or testimonials is non-compliant.

The mental-health overlay

Any coaching app that touches anxiety, depression, burnout, stress, eating disorders, or relationship issues handles mental-health information, which is named explicitly in the consumer-health-data definition. The mental-health prong is the part of the statute most often invoked in private complaints because the disclosure of mental-health categorization is uniquely damaging. Coaching apps that surface "anxiety pattern" or "depression risk" inferences to the coach or to third parties need defensible consent provenance.

The per se CPA hook

RCW 19.373.090 makes any MHMDA violation a per se CPA violation. A Washington user of your coaching app with a documented sharing or policy gap is a candidate plaintiff. Actual damages, discretionary treble damages capped at $25,000 on the enhancement, one-way attorney's fees under RCW 19.86.090, four-year SOL under RCW 19.86.120, public-interest and unfair-or-deceptive elements declared by statute.

The "we are not providing medical advice" disclaimer does not save the data flow. Coaching apps frequently rely on a disclaimer that the service is not medical advice and not a regulated provider relationship. That disclaimer is relevant to medical-practice and scope-of-license questions but irrelevant to MHMDA. The statute reaches consumer health data regardless of whether the entity is providing medical advice.

What I review when you send me a coaching-app matter

Privacy policy URL plus the separate Consumer Health Data Privacy Policy if one exists.
Signup and intake-form flow, consent banner, sharing toggles, coach-introduction consent.
Coach agreement and any independent-contractor contract template.
Data inventory: intake inputs, chat logs, coach notes, inference outputs.
Any employer-wellness, insurance, or B2B partner contract that defines data sharing back to the buyer.
SDK list and vendor list (analytics, video, voice, AI inference, customer support).
Processor and sub-processor list plus current DPA template.

Service tiers

$125 written email evaluation. Two-business-day turnaround.
$499 MHMDA scope memo.
$900 MHMDA review with DPA and vendor language.
$1,500 MHMDA compliance package.

Sergei's practical note

Coaching marketplaces are the category where the contractor-coach relationship is the part most operators have not thought through. Under RCW 19.373.060 the coach is a processor and the platform needs binding processor-instruction contracts down to each individual coach. Standard coach-marketplace agreements rarely meet that bar. If you operate a coaching platform with Washington users, send the privacy policy, the coach agreement, the intake-form flow, and any B2B contract that pulls data back to an employer or insurer. Regulatory advisory work under California license; not Washington representation.

Related Washington resources

For the full statutory walk-through, see my Washington My Health My Data Act resource. Self-assess via the Wellness App MHMDA Risk Checker. Adjacent verticals: wellness apps, meditation, weight loss, and nutrition.

Educational resource. Sergei Tokmakov is a California attorney (CA Bar #279869) currently seeking admission to the Washington State Bar. Nothing on this page creates an attorney-client relationship or is Washington legal advice.