Manage Your Care with MyHealth: Privacy Policy

MyHealth Privacy Policy

Last updated: July 22, 2022

Overview
Stanford Health Care takes very seriously its obligation to protect the confidentiality of your personal information.  This Privacy Policy applies to the MyHealth mobile application, website, and related services (“MyHealth” or “Services”).  This Privacy Policy incorporates Stanford Health Care’s Notice of Privacy Practices  (English version/ Spanish version) and includes the following supplemental terms.  The Notice of Privacy Practices and these supplemental terms are collectively this “Privacy Policy.” 

By using MyHealth, you acknowledge the practices and policies outlined in this Privacy Policy.  You acknowledge that we will collect, use, and share your information as described in this Privacy Policy.  This Privacy Policy is not a contract and does not create any contractual rights or obligations.  Your use of MyHealth is governed by our Terms of Use. 

Information Collected
We collect Personal Information that you enter into MyHealth.  For example, we collect

1. information you provide to create your MyHealth account, such as your name, email address, zip code, phone number, profile picture, and other demographic information,
2. payment information that you provide,
3. insurance information that you provide;
4. questionnaire responses that you provide, and
5. any communications and media that you provide or send through MyHealth. 
   

MyHealth may automatically collect usage data, such as your use of MyHealth and information from your device.  For example, we may collect information on your IP address, your device’s model and manufacturer, location information, MAC address, web browser, and operating system, performance issues, and your activity on MyHealth, including whether you have reviewed materials and communications on MyHealth. 

With your permission, certain versions of the MyHealth mobile application can connect to Apple HealthKit or Google Fit to collect health information.  MyHealth does not share your health information with Apple HealthKit or Google Fit.

How We Use Your Information
We may use your Personal Information for the following purposes:

a)     To verify your identity, register you for MyHealth, and allow you to access MyHealth;

b)    To provide the services associated with MyHealth;

c)     To communicate with you (including email, text messages and push notifications sent to your phone) and to solicit feedback;

d)    To evaluate the effectiveness of MyHealth and to improve MyHealth;

e)     To investigate or prevent actual or suspected fraud, criminal activity, injury or damage to us or others;

f)      When required by statute, regulation, other law, subpoena, court order, warrant, or similar legal process; and

g)     To assert or protect our rights or assets, if necessary.

We may also de-identify your Personal Information (“De-identified Information”).  De-identified Information is not Personal Information, because it cannot generally be used to identify you, and may be used by Stanford for any lawful purpose.  Despite our rigorous de-identification process, which includes removing identifiers that reasonably can be used to identify you directly (such as name or telephone number), experts in re-identification may be able to re-identify you if given sufficient cross-reference information.  Consequently, total anonymity cannot be guaranteed.

Additionally, Stanford may use your Personal Information for any other reason if we tell you (1) when we collect it, or (2) in an authorization or consent.  Stanford does not sell or license any information that you provide through MyHealth.

Sharing Your Personal Information
We may share your Personal Information (1) for the reasons we tell you when we collect it, (2) according to authorization or consent or at your direction, or (3) when we believe disclosure is necessary to protect the safety, rights, or property of Stanford or the public.

Children’s Information
We do not knowingly collect or solicit Personal Information from anyone under the age of 18 or knowingly allow such persons to register for MyHealth. If you are under 18, do not attempt to register for MyHealth and do not send your information to us unless you are registered as an emancipated minor or a minor receiving services you are legally allowed to without parental consent. If we learn that we have collected Personal Information from a person under age 18, we will delete that information. If you believe that we might have any information from or about a person under the age of 18, please contact us at
privacyoffice@stanfordhealthcare.org.

Information Security
The security of your information is very important to us.  We employ a variety of technical safeguards to protect the confidentiality, integrity, and availability of your personal information within MyHealth including supporting Transport Layer Security (TLS)/Secure Sockets Layer (SSL) certificate technology and encryption.  In addition, we protect the Stanford systems that MyHealth connects with using a variety of physical, administrative, and technical measures.  However, we cannot guarantee complete security.  Unauthorized entry or use, hardware or software failure, and other factors, may compromise the security of your Personal Information at any time.  

All information collected by MyHealth will be processed in the United States, and this may be done by another entity under contract with Stanford.  You acknowledge that the laws of the United States may not protect your privacy to the same extent as the laws in the country from which you are accessing MyHealth. 

Knowing Your Choices
Your choice to use MyHealth and use the related Services is completely voluntary.  But if you choose not to register and use MyHealth, you will not be able to use the MyHealth services, including viewing your appointments and selected medical record, or communicating with your provider. 

Do Not Track Signals
Stanford does not respond to Do Not Track signals to the extent received from a web browser.  Because there currently is not a universally accepted technological or legal standard for recognizing or honoring Do Not Track signals as reflections of user choice, we do not respond to them at this time.  Once such technology is created and has received applicable regulatory approval, we will consider (a) whether it is possible; and (b) if so, how it can be incorporated within Stanford’s environment in the future.