Washington tool

Reproductive Health Data Risk Checker

Reproductive-health data creates a different risk profile because it can combine health status, location, timing, search behavior, app activity, and third-party advertising infrastructure on the same user record. A generic privacy policy usually does not answer the My Health My Data Act questions. This tool triages your product against Chapter 19.373 RCW and returns a risk score, the specific exposure points, and the recommended next step.

Answer the nine questions below. The tool returns a reproductive-health risk classification, the specific exposure points, a risk score, and the per-se CPA exposure note under RCW 19.373.090.

1App or business type

Which best describes your product or business?

This is the highest-level driver. Reproductive-health-direct products attract the most regulator and plaintiff attention; clinic-adjacent vendors and adtech sit at a different exposure layer.

2Location data collected

Do you collect location data from users?

Precise location near a healthcare facility is consumer health data under . Even coarse IP-geolocation can become consumer health data when it can be tied to clinic-area presence.

3Location SDKs

Does your product embed third-party location SDKs?

Location SDKs (Facebook Pixel, Google Ads, AppsFlyer, Branch, mobile attribution platforms) often collect location continuously even when the operator does not actively configure a geofence. Per , the operator inherits the exposure.

4Ads or retargeting

Do you serve ads or retargeting to users?

Retargeting and audience-building from reproductive-health context falls under prong (3) of (notifications, messages, or advertisements related to consumer health data or healthcare services) when the audience or context comes from reproductive-health signals.

5Clinic-proximity targeting

Do you target users by proximity to healthcare facilities?

bans geofences within 2,000 feet of an in-person healthcare facility used to identify or track consumers, collect consumer health data, or send notifications. This is a categorical prohibition with no consent override.

6Sharing with analytics or adtech

Do you share reproductive-health data or inferences with analytics or adtech partners?

Per , sharing requires a separate consent distinct from the collection consent. Per , sale (which can include valuable-consideration exchanges) requires a nine-element written authorization.

7Consumer deletion process

Do you have a documented consumer deletion process?

Per , consumers have a right to deletion, with downstream notification to affiliates, processors, contractors, and third parties. Response window is 45 days plus one 45-day extension.

8Written authorization for sale

If you sell consumer health data, do you obtain a written authorization with the nine required elements?

requires a written authorization signed by the consumer with all nine elements: identification of data, seller and buyer contact, purpose, non-conditioning statement, revocation right, redisclosure notice, one-year expiration, and signature plus date. Missing any element invalidates.

9Washington users

Do you have Washington users or target Washington consumers?

Per , "consumer" includes a Washington resident or a natural person whose consumer health data is collected in Washington. A regulated entity under includes any entity that conducts business in Washington or targets products or services to Washington consumers.

How the score is calculated

The score weighs the elements that drive reproductive-health MHMDA exposure. Weights total 100 points.

The four verdict bands are 80 to 100 (Significant exposure; remediation required before continued operation), 60 to 79 (Material gaps in geofence, consent, or sale posture), 30 to 59 (Discrete gaps to close), and 0 to 29 (Compliant or out of scope on the current record).

Authority notes

Citations from RCW 19.373.010 (definitions including geofence and consumer health data), RCW 19.373.020 (separate privacy policy and homepage link), RCW 19.373.030 (two-layer consent), RCW 19.373.040 (consumer rights and 45-day deletion window), RCW 19.373.060 (processor obligations), RCW 19.373.070 (nine-element written authorization for sale), RCW 19.373.080 (2,000-foot geofence prohibition), and RCW 19.373.090 (per-se CPA bridge).

For background, see my Washington My Health My Data Act resource and the cluster pages: Fertility apps, Period-tracking apps, Reproductive-health geofencing ban, Geofencing risk for adtech.