Effective Date: June 23, 2026
This Consumer Health Data Privacy Policy explains how Pure Grace AI, LLC (“Form Orah,” “we,” “us”) handles “consumer health data” under the Washington My Health My Data Act (MHMDA). It supplements, and does not replace, our general Privacy Policy.
Our role. In most cases Form Orah processes consumer health data only as a processor on behalf of the business customer that built and operates the form through which you provided it. That customer is the “regulated entity” responsible for obtaining any required consent and for its own consumer health data privacy policy. We process such data only on that customer’s instructions, as described in our Data Processing Addendum.
1. Categories of consumer health data we process, and the purpose
We may process health-related information that an individual voluntarily submits through a form built with Form Orah, including information that identifies a person’s past, present, or future physical or mental health, such as health conditions, symptoms, diagnoses, treatments or medications, mental or behavioral health information, reproductive or sexual health information, disability or accessibility needs, biometric data where a form collects it, and health-related inferences drawn from submitted data. Where a customer’s form collects precise location, we process it only as part of that submission and do not use it to infer health status.
We process this data for one purpose: to provide the Service to the customer who collected it — hosting, storing, transmitting, scoring, routing, and (at the customer’s direction) following up on form submissions. We do not use consumer health data for our own purposes, and we do not sell it.
2. Categories of sources
We collect consumer health data directly from the individual when they submit a form built with Form Orah; from the business customer that operates the form; and, where a form collects it, from the individual’s device.
3. Categories of consumer health data shared
We share consumer health data only as needed to provide the Service and only at the operating customer’s direction. We do not share it for advertising and we do not sell it.
4. Third parties and affiliates with whom we share
Affiliates: We do not share consumer health data with any affiliates.
Categories of third parties (service providers acting on our or the customer’s instructions): cloud hosting and database infrastructure providers; artificial-intelligence processing providers (only where the customer enables AI features on a form that collects such data); email and SMS messaging providers (to deliver communications the customer directs); security and anti-bot providers; and the third-party services each customer chooses to connect to its own account (for example, the customer’s CRM). A current, named list of our sub-processors is available in our Data Processing Addendum and on request.
5. How to exercise your rights
Under MHMDA you have the right to confirm whether we process your consumer health data and to access it, to withdraw consent to its collection and sharing, and to have it deleted. To exercise these rights, email privacy@formorah.com.
Because we usually process consumer health data as a processor on a customer’s behalf, we will, where appropriate, refer your request to that customer or assist them in fulfilling it; for any consumer health data we control directly, we will act on your request and, for deletion, will delete the data and notify our service providers to do the same. If we decline a request, you may appeal by emailing privacy@formorah.com with the subject “Privacy Appeal,” and you may contact the Washington Attorney General.
6. Geofencing
We do not use geofencing around any in-person health care service location.
Contact
Pure Grace AI, LLC — privacy@formorah.com