This Washington Consumer Health Data Privacy Notice applies to Washington residents and other individuals whose consumer health data is protected by the Washington My Health My Data Act.
Astoria Company Marketing LLC d/b/a Astoria Company operates websites, landing pages, forms, call flows, and marketing services that may collect, route, disclose, sell, share, or otherwise process information submitted by consumers who request information about health insurance, Medicare insurance, Medicare-related products, health coverage, insurance quotes, plan options, or related services.
This notice explains how Astoria collects, uses, shares, and protects consumer health data that may be covered by the Washington My Health My Data Act. It supplements Astoria's general Privacy Policy.
1. Consumer Health Data We May Collect
Depending on the website, form, call, or inquiry, Astoria may collect the following categories of consumer health data:
Health insurance inquiry information
Medicare or Medicare-related insurance inquiry information
Information about requested health coverage, insurance type, plan interest, eligibility interest, or coverage needs
Contact information submitted in connection with a health-related inquiry, including name, email address, phone number, mailing address, ZIP code, and state
Information submitted through quote request forms, lead forms, call flows, chat, email, SMS, or telephone calls
Call recordings, call logs, SMS records, email records, and related communication records where permitted by law
Consent records, including timestamp, IP address, user agent, form URL, landing page, consent language, TrustedForm certificate, Jornaya LeadiD, call tracking records, and similar documentation
Information that may be inferred from your inquiry, such as interest in health insurance, Medicare insurance, health coverage, plan options, or related services
Device, browser, IP address, approximate location, and website activity information related to your interaction with a health insurance or Medicare-related Astoria website
Astoria does not knowingly collect medical records, diagnosis records, prescription records, provider treatment records, or HIPAA-regulated protected health information unless expressly stated otherwise.
2. Sources of Consumer Health Data
Astoria may collect consumer health data from:
You directly when you submit a form, call us, text us, email us, use chat, or otherwise communicate with us
Astoria-operated health insurance, Medicare, or insurance-related websites, forms, landing pages, call tracking numbers, APIs, or campaign pages
Advertising, marketing, publisher, lead seller, call seller, affiliate, or commercial sources
Technology providers used for hosting, analytics, consent documentation, call tracking, fraud prevention, CRM, email, SMS, compliance, and security
Lead buyers, call buyers, insurance agencies, Medicare-related providers, advertisers, or other partners involved in responding to your request
3. Purposes for Collecting and Using Consumer Health Data
Astoria may collect and use consumer health data for the following purposes:
To respond to your request for information about health insurance, Medicare insurance, or related services
To match, route, transfer, disclose, sell, share, post, ping, validate, or otherwise process your inquiry so that insurance agencies, licensed agents, advertisers, service providers, or other partners may respond to your request
To contact you or allow partners to contact you where legally permitted and consistent with the consent language presented at the point of collection
To document, verify, preserve, audit, and defend consent records
To operate lead generation, call routing, pay-per-call, ping/post, host/post, compliance, fraud prevention, and data routing systems
To detect, prevent, and investigate fraud, invalid traffic, suspicious submissions, bot activity, abuse, security incidents, or unlawful activity
To maintain suppression, opt-out, do-not-contact, and legal compliance records
To comply with applicable laws, subpoenas, regulatory inquiries, legal claims, and contractual obligations
To enforce agreements, resolve disputes, process returns, investigate complaints, and defend legal rights
Washington law allows collection of consumer health data either with consent for a specified purpose or to the extent necessary to provide a product or service requested by the consumer. Sharing requires separate consent unless the sharing is necessary to provide the product or service requested by the consumer.
4. Consumer Health Data We May Share
Astoria may share or disclose the categories of consumer health data described above with:
Health insurance agencies, Medicare insurance agencies, licensed insurance agents, advertisers, lead buyers, call buyers, service providers, or other partners who may respond to your inquiry
Call centers, call routing providers, pay-per-call platforms, lead routing platforms, consent documentation providers, fraud prevention vendors, analytics providers, hosting providers, email/SMS providers, CRM providers, security vendors, and other operational service providers
Attorneys, auditors, insurers, accountants, consultants, and professional advisors
Government authorities, courts, regulators, law enforcement, or other parties where required or permitted by law
Successors or potential successors in connection with a merger, acquisition, financing, bankruptcy, restructuring, or sale of assets
5. Sale of Consumer Health Data
Washington law defines "sale" broadly as the exchange of consumer health data for monetary or other valuable consideration. The sale of consumer health data requires a separate signed valid authorization from the consumer.
To the extent Astoria's transfer of Washington consumer health data is considered a "sale" under the Washington My Health My Data Act, Astoria will obtain a separate valid authorization where required before selling such consumer health data.
A valid authorization to sell consumer health data must be separate from consent to collect or share consumer health data, written in plain language, identify the specific consumer health data being sold, identify the seller and purchaser, describe the purpose of the sale and how the purchaser will use the data, state that services are not conditioned on signing, explain revocation rights, disclose redisclosure risk, expire after one year, and include the consumer's signature and date.
6. Your Washington Consumer Health Data Rights
Subject to applicable exceptions and verification, Washington consumers may have the right to:
Confirm whether Astoria is collecting, sharing, or selling consumer health data about them
Access consumer health data maintained by Astoria
Receive a list of third parties and affiliates with whom Astoria has shared or sold consumer health data, including available contact information
Withdraw consent for future collection or sharing of consumer health data
Request deletion of consumer health data
Appeal Astoria's refusal to act on a consumer health data request
Washington law requires businesses to respond to authenticated consumer health data requests without undue delay and within 45 days, with one 45-day extension when reasonably necessary. It also requires an appeal process if a request is denied.
7. How to Submit a Washington Consumer Health Data Request
You may submit a Washington consumer health data request by using our Washington Consumer Health Data Request Form.
You may also contact us at:
- Privacy Officer
Astoria Company Marketing LLC d/b/a Astoria Company
Fort Worth, Texas
Privacy Email: privacy@astoriacompany.com
Phone: 1-510-663-7016
You may also contact us by email or phone. We may need to verify your identity before fulfilling certain requests. We may request additional information reasonably necessary to authenticate the request. You are not required to create a new account to exercise your rights.
8. Withdrawal of Consent
You may withdraw consent for future collection or sharing of your Washington consumer health data by submitting the Washington Consumer Health Data Request Form or by emailing privacy@astoriacompany.com.
Withdrawal of consent may limit Astoria's ability to provide requested services, route your inquiry, match you with providers, or complete pending requests.
9. Deletion Requests
You may request deletion of consumer health data concerning you. If required by law, Astoria will delete covered consumer health data from its records and notify applicable affiliates, processors, contractors, and third parties with whom Astoria shared the consumer health data, subject to legal exceptions.
Astoria may retain limited records where permitted or required by law, including records needed for fraud prevention, security, consent documentation, do-not-contact/suppression, legal defense, regulatory compliance, accounting, dispute resolution, or enforcement of legal rights.
10. Data Security
Astoria uses reasonable administrative, technical, and physical safeguards designed to protect consumer health data. Access to consumer health data is restricted to personnel, contractors, and service providers who need access for the purposes described in this notice or to provide requested services.
Washington law requires regulated entities and small businesses to restrict access to consumer health data and maintain reasonable administrative, technical, and physical safeguards appropriate to the volume and nature of the consumer health data.
11. Geofencing
Astoria does not knowingly use geofencing around health care facilities to identify or track consumers seeking health care services, collect consumer health data from consumers, or send advertisements or messages based on consumer health data or health care services.
Washington law prohibits geofencing around entities that provide in-person health care services when used to identify or track consumers seeking health care services, collect consumer health data, or send health-related notifications, messages, or advertisements.
12. Changes to This Notice
We may update this Washington Consumer Health Data Privacy Notice from time to time. When we do, we will revise the "Last Updated" date above.