Consumer health data privacy policy

This policy is provided under Washington's My Health My Data Act (RCW 19.373), Nevada SB 370 (NRS 603A.300 et seq.), and the Connecticut Data Privacy Act. It is linked from the homepage and from the main privacy notice.

1. Scope

This policy applies to “consumer health data” — information linked or reasonably linkable to you that identifies your past, present, or future physical or mental health status — that we collect from a Washington, Nevada, Connecticut, or other US state resident. It does not apply to de-identified or aggregated information, or to information that is publicly available.

2. Categories collected

• Diagnosis, subtype, cytogenetics, and date of diagnosis.
• Treatment history, lines of therapy, prior therapies, and treating clinician.
• Pathology, imaging, and other reports you choose to send.
• Free-text answers about your condition, symptoms, and treatment preferences.
• Contact details, country, city, and preferred contact method.
• Technical information about your visit, with IP addresses hashed before storage.

3. Sources

Directly from you (the pre-screen, emails, records you send, and calls); from a family member or clinician who enquires for you with your consent; and automatically from your browser when you use the site after accepting measurement.

4. Purposes

• Assess whether a paid records review can take your enquiry further.
• Prepare and submit records to a hospital, at your direction.
• Coordinate appointments, admission, interpreting, and handover.
• Keep records of what was agreed and meet legal, tax, and accounting obligations.
• Measure which outreach channels work, only after you accept measurement.

5. Sharing

We share consumer health data only with the recipients described in the main privacy notice: the hospital international department you have specifically consented to, professional interpreters and translators bound by confidentiality, Cloudflare and our email provider as infrastructure processors, your own clinicians at your request, and regulators or courts where the law requires it. We do not share it with advertisers, data brokers, travel agencies, or insurers.

6. Sale and targeted advertising

We do not sell consumer health data. We do not rent it, trade it, or disclose it in exchange for money or anything else of value. We do not use it for targeted advertising or to build advertising audiences, and we do not use geofencing around health-care facilities.

7. Consent

We obtain affirmative, separate consent before collecting health information. The pre-screen has a dedicated health-data consent checkbox (PIPL Article 29) and a separate overseas-storage consent (Article 39); we do not treat a general “I agree” as consent for health data. You can withdraw consent at any time by emailing care@lukebridge.com, though that may mean we can no longer assess or coordinate your enquiry.

8. Your rights

Subject to applicable law, you can ask us to confirm whether we process your consumer health data and to provide access to it; to correct inaccuracies; to delete it; to provide a portable copy; and to withdraw consent. You can also appeal a refusal. Email care@lukebridge.com with the subject line “US health privacy request”. We respond within 45 days, may extend once where the law allows, and may ask for information to verify your identity. You may use an authorised agent.

We will not discriminate against you for exercising these rights: the free pre-screen and the paid review are offered on the same terms whether or not you exercise a privacy right. (We may be unable to process an enquiry if you withdraw the health-data consent the service depends on, but that is a consequence of the withdrawal, not retaliation.)

9. Retention and security

Enquiries that do not proceed are deleted 24 months after last contact. Coordination case records are kept for 7 years from the end of the engagement to support clinical handover and meet legal obligations. Data is encrypted in transit, access is limited to the named coordinator and records screener on your case, IP addresses are hashed, and we apply HSTS, CSP, frame denial, and content-type protection to the public site.

10. Contact and complaints

Privacy contact: care@lukebridge.com. LukeBridge (Shanghai), registered in Shanghai, People's Republic of China. If you are not satisfied, you can complain to your state attorney general — in Washington, the Attorney General's Office; in Nevada, the Attorney General; in Connecticut, the Attorney General — or to the regulator named in the main privacy notice.

Read this with the main privacy notice, the compliance notice, and the terms of service. Effective 10 November 2026; a summary changelog appears in the main privacy notice.