Washington Consumer Health Data Privacy Policy
This is the consumer health data privacy policy of RYZEIN LLC, a Wisconsin limited liability company, the maker of Trial Lantern, required by the Washington My Health My Data Act (chapter 19.373 RCW). It is a separate document from our general privacy notice, and it covers only what that Act requires.
It applies to you if you are a Washington resident, and also if your consumer health data is collected in Washington.
1. The categories of consumer health data we collect, and why
Required by RCW 19.373.020(1)(a)(i).
| Category of consumer health data | The purpose for which we collect it |
|---|---|
| Genetic and molecular test-report contents — the genomic or molecular report you upload, and the genetic variants, biomarkers and molecular findings in it. This includes your genetic information. | To identify the clinical trials you may be eligible for, and the published evidence behind them. |
| Clinical context you give us — diagnosis, disease status, prior and current treatments, performance status, and other clinical details you type in. | To narrow trial matching to trials that fit your situation. |
| Health-related account data — your age attestation (18+), your state of residence, and your attestation that you are the patient completing this yourself. | To determine whether the service is open to you, and to verify a request you later make about your data. |
| Access and audit records tied to your health data — records of who accessed your health data and when, including timestamps and device/network information. | To secure your data, to detect and investigate security incidents, and to be able to tell you what happened if one occurs. |
We do not collect information about your health outcomes, your treatment results, or whether you enrolled in or responded to any trial.
2. The categories of sources we collect it from
Required by RCW 19.373.020(1)(a)(ii).
- From you, directly. Every item in section 1 comes from you — the report you upload and the details you type in. We do not obtain your health data from your doctor, your hospital, your health plan, a laboratory, a data broker, or any other outside source.
- Generated by our own systems as you use the service. The access and audit records in section 1, and the medical search terms our system derives from the report you uploaded.
We do not buy consumer health data, and we do not acquire it from any third party.
3. The categories of consumer health data we share
Required by RCW 19.373.020(1)(a)(iii).
- All of the categories in section 1 are shared with our cloud processor, because the service runs on infrastructure we do not own (see section 4).
- Derived medical search terms only — condition and biomarker words, a gene name, a gene-change name, or a drug name — and, at some steps, a public article or document number that identifies a published document, are shared with the public medical databases in section 4. Your report itself, your name, your date of birth, your contact information and your medical record number are not shared with any of them.
- We share nothing in any other category, and we share with no one not named in section 4, except where the law requires it of us — for example a subpoena or court order.
We do not sell your consumer health data. We have not sold it and we do not offer it for sale.
4. The third parties and affiliates we share it with
Required by RCW 19.373.020(1)(a)(iv).
We have no affiliates. RYZEIN LLC has no parent, subsidiary or commonly-controlled entity with whom consumer health data is shared.
Category — cloud processor. Amazon Web Services, Inc. (AWS) provides the cloud infrastructure on which the service stores and processes your data, including the artificial intelligence model that reads your report inside that infrastructure. AWS processes your data on our instructions and under contract, and is not permitted to process it in a manner inconsistent with this policy.
Category — public medical databases (disclosure recipients). These receive only derived medical search terms, or a public document number — never your report and never anything that identifies you. They are public reference services, not companies working for us. By what we send to each:
- Your medical search terms (condition and biomarker words) go to public trial and medical-literature databases: ClinicalTrials.gov, PubMed, MeSH, and the NCI cancer-terminology service (all operated by the U.S. National Institutes of Health); Europe PMC (EMBL's European Bioinformatics Institute, United Kingdom); Crossref and OpenAlex (nonprofit research indexes); and the Monarch Initiative (a consortium of research institutions).
- The name of a drug goes to public drug-information services: DailyMed, RxNorm, PubChem, and NCATS Inxight (all operated by the U.S. National Institutes of Health); the U.S. FDA's openFDA service; and ClinPGx (Stanford University).
- The name of a gene goes to HGNC, the official gene-name registry, and to MyGene.info (Scripps Research); the name of a gene change goes to CIViC, a public cancer-variant knowledgebase (Washington University School of Medicine in St. Louis).
- A public article or document number — never a search term — goes to PubMed Central (U.S. National Institutes of Health) to fetch an article's full text; and we read fixed reference pages (the National Cancer Institute's PDQ treatment summaries) without sending any search terms at all.
Nineteen databases in all; each is named to you separately at signup.
Category — legal and safety recipients. Courts, regulators and law enforcement, where a law requires disclosure or where disclosure is reasonably necessary to protect rights and safety.
Category — payment processor. The beta is a paid service, so this category applies. Our payment processor, Stripe, LLC ("Stripe"), takes your payment on a payment page that Stripe hosts and receives billing information — your name, email address, payment-card details, billing postal code and the amount you pay — and not your report, your diagnosis, your genetic findings or any clinical detail. Charges appear on your card or bank statement as RYZEIN LLC, our legal name, not as Trial Lantern. Stripe processes your payment on our instructions under a written data-processing agreement and handles your payment information under its own privacy policy (stripe.com/privacy).
We share with no other category of third party. No advertiser, no data broker, and no advertising or analytics service receives your consumer health data.
5. How to exercise your Washington rights
Required by RCW 19.373.020(1)(a)(v); the rights are at RCW 19.373.040.
Your rights. As a Washington consumer you have the right to:
- Confirm whether we are collecting, sharing or selling your consumer health data, and to access that data, including a list of all third parties and affiliates with whom we have shared it (040(1)(a));
- Withdraw your consent to our collection and sharing of your consumer health data (040(1)(b));
- Have your consumer health data deleted (040(1)(c)) — see section 6;
- Appeal if we refuse to act on your request (040(1)(h)).
How to make a request. You may submit a request at any time (040(1)(d)) by any of:
- the "Your Data / Privacy" panel inside your account;
- our web request form at https://app.triallantern.com/privacy-request;
- email to privacy@triallantern.com.
Verifying you. We verify your request against your logged-in account. If we cannot authenticate your request using commercially reasonable efforts, we are not required to comply with it, and we will tell you so and explain what we need (040(1)(e)).
Cost. Information we provide in response to your request is free of charge, up to twice in any twelve-month period (040(1)(f)).
How long we take. We will act on your request without undue delay and in all cases within 45 days of receiving it. We may extend that once, by 45 additional days, where reasonably necessary, and we will tell you within the first 45 days if we do and why (040(1)(g)). We will also acknowledge your request within 10 business days.
How to appeal. If we refuse to act on your request, we will tell you why and how to appeal. You may appeal by replying to our decision or by writing to privacy@triallantern.com with "Appeal" in the subject line. We will decide your appeal and explain the result to you in writing within 45 days (040(1)(h)). If we deny your appeal, we will give you a way to contact the Washington Attorney General to submit a complaint.
Withdrawing consent ends the service. Every consent we ask for is necessary to run the service, so withdrawing any of them stops our processing of your consumer health data and locks your account's features. Withdrawing consent is not the same as deletion — you may ask for deletion separately.
6. Deletion
Required by RCW 19.373.020(1)(a)(v); the right is at RCW 19.373.040(1)(c).
Your right. You have the right to have your consumer health data deleted. On receiving your deletion request we will delete your consumer health data from our records, including from all parts of our network, and we will notify all processors, contractors and other third parties with whom we have shared it — each of whom must honour your deletion request in turn (040(1)(c)(i)(A)–(B), (1)(c)(ii)).
What deletion does not reach. Deleting your consumer health data does not delete the records of the consents you gave — the exact text you agreed to, its version, the time, and your action. We keep those, and we keep them after you ask us to delete your data or close your account. This is the one thing a deletion request does not remove, and nothing we publish anywhere says otherwise.
7. Changes to this policy
Required by RCW 19.373.020(1)(c)–(d).
We will not collect any category of consumer health data, and will not use your consumer health data for any purpose, that is not disclosed in this policy without first telling you and obtaining your affirmative consent (020(1)(c)–(d)). If we change this policy we will post the updated version here, with a new "last updated" date, and where the change is material we will ask for your fresh consent before it applies to you.
8. Contact
Write to us at privacy@triallantern.com, or use our web request form at https://app.triallantern.com/privacy-request.
This policy is published under RCW 19.373.020(1)(b), which requires a prominent link to it on our homepage.