Consumer Health Data Privacy Policy

1.1. Which laws this answers to, and who it covers

This policy is published under Washington's My Health My Data Act (RCW chapter 19.373). It is also our consumer health data notice under Nevada's SB 370 (NRS chapter 603A) and the health data amendments to the Connecticut Data Privacy Act. All three define consumer health data the same way in substance: information linked or reasonably linkable to a person that identifies their past, present, or future physical or mental health status, including information suggesting an attempt to acquire health care services.

We apply this policy nationally. Rather than run three standards and ask you to prove where you live, we extend these protections to every person whose consumer health data we process. Residents of Washington, Nevada, and Connecticut also have the remedies their own statutes provide.

Information given to a marketing company about a health topic is generally not protected by HIPAA, which covers providers and health plans. These state laws exist to cover that gap.

2.2. Categories collected, the purpose, and how the data is used

Consent. Consent to collect and to share is obtained by the business at the point of collection, through checkboxes on the registration page or card. Those boxes are separate, unchecked by default, and unbundled, and registration does not require checking any of them.

How it is never used. Not for targeted or cross-context behavioral advertising, not to build advertising audiences, not to train artificial-intelligence models. ShowRunner runs no advertising pixels, no analytics, and no tracking technologies of any kind on the registration pages it hosts. Nothing there reports your visit to anyone.

3.3. Categories of sources

Consumer health data reaches ShowRunner from three sources, and no others.

• From you directly — what you type into a registration page we host, or write on an interest card at the event.
• From the business that invited you — records it enters or imports, including notes and condition tags recorded after speaking with you.
• From list vendors used by that business — some businesses purchase responder data from direct-mail response vendors. Where it shows which treatment topic a person responded to, it is consumer health data on arrival and treated as such. ShowRunner does not select or buy it; the business that did is responsible for obtaining it lawfully.

4.4. Categories of consumer health data shared

The categories that may be shared are the same five listed in section 2. Sharing happens only:

• To the business that collected it — the regulated entity for your record, and its staff.
• To service providers acting for ShowRunner — vendors that host, store, or deliver the data, under contracts barring their own use of it.
• Where legally required — a subpoena, court order, or other legally enforceable demand, or to establish or defend a legal claim.

Consumer health data is not shared for advertising of any kind, is not shared with data brokers, and is never sold. Nor is it shared between ShowRunner customers: each organization is isolated.

5.5. Categories of third parties and specific affiliates with whom it is shared

• Cloud hosting and database providers — the infrastructure the platform runs on.
• SMS delivery providers — transmit a text message you consented to receive.
• Email delivery providers — transmit email you consented to receive.
• An artificial-intelligence extraction provider — receives an image of a handwritten interest card only where the business has enabled optional card scanning, and only to convert handwriting to text.
• Legal and regulatory recipients — where a legally enforceable demand requires disclosure.

The specific companies in each category are named in the Subprocessor List. To learn which of them hold data connected to you, ask us as part of your access right.

Affiliates. ShowRunner LLC has no parent, subsidiaries, or corporate affiliates, so no consumer health data is shared with any affiliate. If that changes, this section will name each affiliate before any sharing begins.

6.6. Your rights

• Confirm and access. Confirm whether your consumer health data is collected, shared, or sold, and access it — including a list of all third parties and affiliates it has been shared with, with an active contact for each.
• Withdraw consent. Withdraw consent to collection and, separately, to sharing. No reason required.
• Delete. Have it deleted, including from archived and backup systems, and passed on to anyone we shared it with.
• Appeal. Appeal a refusal to act, and if that is refused, complain to the Washington Attorney General.
• Be free from retaliation. Using these rights will not mean denied service, a different price, or lower-quality service.

7.7. How to exercise your rights

Two routes work. Contact the business that invited you, which holds your record. Or contact ShowRunner: we will find the record, act on the request under our contract with that business, and confirm in writing.

1. Email privacy@showrunnercrm.com, subject line Consumer Health Data Request.
2. Say which right you are using: confirm and access, withdraw consent, or delete.
3. Give us enough to find your record — the name and the email or phone you registered with, and roughly when and where the seminar was.
4. If we cannot match you, we will ask for one further detail, use it only to authenticate you, and not keep it. If we still cannot, we will say so rather than guess.

Timing and cost. We respond within 45 days, extendable once by a further 45 days where reasonably necessary, on notice to you within the first 45. Requests are free up to twice in any twelve-month period; beyond that, or for a manifestly unfounded or excessive request, we may charge a reasonable fee or decline, and will explain how to appeal.

What deletion actually does. We delete from active systems promptly. Backup media are written on a rolling schedule and cannot be edited individually, so deleted data leaves backups as that media cycles, in every case within six months. We also notify the business that collected it and any service provider holding a copy, and instruct them to delete it.

Two caveats. We keep the minimum record needed to prove you opted out or asked for deletion, since that is what stops you being contacted again. We may also retain data where a law or legal claim requires it.

8.8. How to appeal a refusal

If we decline to act, our response will explain why and how to appeal. Reply to it, or email privacy@showrunnercrm.com, subject line Appeal.

We decide and respond in writing within 45 days of receiving the appeal, with reasons. The review is done by someone other than the person who made the original decision.

If the appeal is denied you may complain to the Washington State Attorney General at https://www.atg.wa.gov/file-complaint; our response will include that link. Nevada and Connecticut residents may complain to their own Attorney General.

9.9. We do not sell consumer health data

ShowRunner does not sell consumer health data. We have never sold it and do not exchange it for money or anything else of value. We do not share it with data brokers, advertising networks, or list resellers.

Washington law permits a sale only where the consumer signs a detailed, statutorily prescribed valid authorization separate from consent. ShowRunner does not offer that process and will not accept a valid authorization, including one obtained by a customer. Our contracts prohibit customers from selling consumer health data obtained through the platform.

10.10. Geofencing

Washington, Nevada, and Connecticut prohibit geofencing a facility that provides in-person health care services in order to track consumers, collect consumer health data, or send health-related advertising.

ShowRunner operates no geofence, collects no precise device location, and cannot trigger on physical proximity. Our contracts prohibit customers from using the Service to build, deploy, or use a geofence around any facility that provides in-person health care services. A violation is grounds for immediate suspension.

11.11. How to contact us

For any request or complaint about consumer health data, email privacy@showrunnercrm.com. support@showrunnercrm.com reaches the same team.

ShowRunner LLC is a Minnesota limited liability company operating www.showrunnercrm.com. A postal address is available on request.

You may also contact the business that invited you, which can act on your request itself. If you do not know how to reach it, ask us.