Last Modified: September 1, 2026

Introduction

This Consumer Health Data Privacy Policy (this “Policy”) describes how Inside Story, LLC, a Washington limited liability company (“Inside Story,” “we,” “us,” or “our”) collects, uses, shares, and protects “Consumer Health Data” as defined by the Washington My Health My Data Act, RCW 19.373 (“MHMDA”). This Policy applies to consumers as defined by MHMDA (natural persons who are Washington residents, or natural persons whose Consumer Health Data is collected in Washington) and supplements, rather than replaces, our general Privacy Policy. In the event of a conflict between any other policy, statement, or notice and this Policy, this Policy will prevail as to Consumer Health Data collected under MHMDA.

“Consumer Health Data” under MHMDA means personal information that is linked or reasonably linkable to a consumer, and that identifies the consumer’s past, present, or future physical or mental health status.

Consumer Health Data We Collect and How We Collect It

Depending on our relationship with you, we may collect Consumer Health Data, including but not limited to:

• Information about diagnoses, conditions, symptoms, or treatment.

• Information about health-related surgeries or procedures.

• Information about use or purchase of prescribed or over-the-counter medications, supplements, or health-related products.

• Information about bodily functions, vital signs, symptoms, or measurements.

• Internet information essential to running our website. Examples include Internet Protocol (IP) address, Media Access Control (MAC) address, operating system and version, and Internet browser type and version, which could identify your attempt to seek health care services or information. This includes services that allow you to assess, measure, improve, or learn about your or another person’s health.

We collect Consumer Health Data

• Directly from you when you provide it to us, including:

  • Information that you provide by filling in forms on our Website. This includes information provided at the time of submitting a contact form or requesting further services.

  • Information that you provide by completing retreat questionnaires, including health and wellbeing questionnaires, through our third-party booking and guest-management platform, YouLi.

  • Records and copies of your correspondence (including email addresses), if you contact us.

  • Your responses to surveys that we might ask you to complete for research purposes.

• Automatically as you navigate through our website. For more information about this, please see our Privacy Policy.

Purposes for Collection, Use, and Processing

We collect and use Consumer Health Data only for the purposes disclosed to you at or before the point of collection and to which you have consented, or as necessary to provide a product or service you have requested, including:

• To provide our products or services to you.

• To provide customer support.

• To fulfill any other purpose for which you provide your health data.

• For internal business operations that do not involve further collection, sharing, or sale beyond what is necessary to provide the requested product or service.

• In any other way we may describe when you provide your health data.

• For any other purpose with your consent.

We do not use Consumer Health Data for any purpose that is not necessary to provide a product or service requested by you, unless we obtain your separate, affirmative opt-in consent for that additional purpose.

Notice at Collection

Before or at the time we collect Consumer Health Data, we will provide notice describing the categories of data collected, the purpose(s) for collection and use, the categories of sources, and the categories of third-parties (and, for each, whether they are affiliates, processors, or non-affiliated third-parties) with whom the data is shared.

Affirmative Opt-In Consent to Collect or Use

We obtain your clear, affirmative, opt-in consent before collecting or using Consumer Health Data, except where such collection or use is strictly necessary to provide a product or service you have requested. Consent requests are separate and distinct from any other terms, are not bundled with unrelated consents, and do not rely on default settings, pre-checked boxes, or other dark patterns.

Sale of Consumer Health Data

We do not sell Consumer Health Data. If that ever changes, we will first obtain your separate, signed, valid authorization as required by MHMDA.

Sharing of Consumer Health Data

Your Consumer Health Data is treated with the highest level of confidentiality and is only shared in limited circumstances necessary to deliver our services and comply with legal obligations. Specifically, we may share Consumer Health Data with:

• Service Providers and Business Partners. This includes local retreat vendors, emergency medical assistance providers, and other third-parties who support our operations. All such service providers are required to adhere to strict contractual obligations regarding the protection and use of Consumer Health Data and may only process this data as instructed by us for the purposes specified in our privacy policies.

• Regulators, government authorities, or as required by law. We may disclose Consumer Health Data to regulatory agencies, law enforcement, or other government entities when required to comply with applicable laws, regulations, legal processes or enforceable governmental requests.

We do not permit these third-parties to use Consumer Health Data for their own independent purposes, and we take reasonable steps to ensure that any sharing is limited to what is necessary, is subject to appropriate safeguards, and is consistent with your rights under the MHMDA.

Consumer Health Data is stored in our booking and guest-management platform (YouLi). Where needed to deliver your retreat, we may also hold copies in restricted-access storage and email provided by Google Workspace. These providers process the data only on our behalf and under their own security and confidentiality commitments. We do not use Consumer Health Data for marketing, and we do not share it with our email marketing platform.

Right to Withdraw Consent

You may withdraw your consent at any time. Upon withdrawal, we will stop collecting, sharing, or selling your Consumer Health Data as soon as practicable, but no later than the timeframe required under MHMDA, and no later than 30 days after your request unless a shorter period is required.

Your Privacy Rights

Subject to certain exceptions, you have the right to:

• Access: You have the right to request and receive a copy of the Consumer Health Data that we have collected about you.

• Correction: You may request that we correct any inaccuracies in your Consumer Health Data.

• Deletion: You may request that we delete your Consumer Health Data, subject to certain legal or contractual retention requirements.

• Withdrawal of Consent: You may withdraw your consent for the collection, use, or sharing of your Consumer Health Data at any time.

• Restriction of Processing: You may request that we restrict the processing of your Consumer Health Data in certain circumstances.

• Appeal: If we deny your request to exercise any of these rights, you have the right to appeal our decision. We will provide information on how to submit an appeal and will respond within the timeframe required by law.

• Non-Discrimination: You have the right not to be discriminated against for exercising any of your privacy rights under this Act.

To exercise any of these rights please email us at privacy@insidestorytravel.com.

Geofencing Restrictions

Consistent with RCW 19.373.030(1)(b), we do not implement a geofence around any entity that provides in-person health care services where such geofence is used to (a) identify or track consumers seeking health care services, (b) collect Consumer Health Data from consumers, or (c) send notifications, messages, or advertisements to consumers related to their Consumer Health Data or health care services, within a 2,000-foot radius of the entity.

Data Security

We maintain administrative, technical, and physical safeguards designed to protect Consumer Health Data from unauthorized access, use, disclosure, alteration, and destruction, appropriate to the volume and nature of the Consumer Health Data at issue, including encryption of data in transit and at rest by our platform providers, access controls that limit health information to those who need it to provide our services, separate restricted storage for health-related information, and assessment of the security practices of the vendors we use to process your information.

Data Minimization and Retention

We collect only the Consumer Health Data that is reasonably necessary and proportionate to provide the product or service requested or purchased by you, and retain it only for as long as necessary to fulfill the purpose(s) for which it was collected, comply with legal obligations, or as you otherwise direct, after which it is securely deleted or de-identified.

Other State Consumer Health Data Rights

State consumer health data laws may provide their residents with additional rights regarding our use of their health data. As of the last modified date of this Policy, Nevada and Connecticut have enacted consumer health data laws. The exact scope of these rights may vary by state. To exercise any of these rights please email us at privacy@insidestorytravel.com.

Changes to Our Health Data Privacy Policy

It is our policy to post any changes we make to this Policy on this page with a notice that the Policy has been updated on the Website home page. If we make material changes to how we treat our users’ health data, we will notify you through a notice on the Website home page and by email if you have purchased any of our Services (as defined in the Terms of Use). The date this Policy was last revised is identified at the top of the page. You are responsible for ensuring we have an up-to-date active and deliverable email address for you, and for periodically visiting our Website and this privacy policy to check for any changes.

Contact Information

To ask questions or comment about this privacy policy and our privacy practices, contact us at: privacy@insidestorytravel.com