Consumer health data
The separate notice state consumer health privacy laws require — written for the people our customers serve.
This notice explains how we handle consumer health data — information that identifies your past, present or future physical or mental health. It applies wherever a state consumer health privacy law applies to you, including under Washington's My Health My Data Act, and it sits alongside our Privacy Policy. Where the two differ about consumer health data, this notice controls.
Advolutely is software used by independent patient advocates to run their practices. If your information is on this platform, your advocate put it there and your advocate decides what happens to it. Under consumer health privacy laws your advocate is the regulated entity and Advolutely is its processor: we handle your information only on your advocate's written instructions, under a contract that limits what we may do with it, and we may not use it for anything of our own.
Your advocate should have their own privacy notice covering the advocacy services themselves. Ask them for it.
Almost everything comes from your advocate. Typically: medical records, itemised bills and explanations of benefits, insurance and claims information, denial letters and appeal correspondence, identification and authorisation documents, your advocate's notes, messages, appointment details, and information the platform generates from those documents (see §4).
Some of it comes from you, in two places:
Our website has one form, asking a prospective advocate for their name, email and practice name. It has no free-text field, so nobody can describe a health situation in it. We do not infer health information from browsing, we do not use geofencing, and we do not buy health data from anyone.
We process your information only to provide the platform to your advocate: storing, organising, displaying and analysing it so they can do the work you engaged them for.
We do not:
Documents on your case are analysed by AI automatically. When your advocate opens your case, every document that can be read as a PDF, image, text or spreadsheet file — including one you uploaded — is summarised for them in a few sentences. Your advocate does not choose document by document, and there is no setting that turns it off. Your advocate can also ask questions about your documents in a chat.
Video and voice calls run on software we host ourselves, inside our own AWS account. Call content is never recorded or stored — the platform has no recording capability.
We share your information with no one else, except where the law requires it, and then we tell your advocate unless we are legally prohibited from doing so.
Depending on where you live, you may have the right to know whether we hold consumer health data about you and to see it, to have it deleted, to withdraw consent to its collection or sharing, and not to be treated worse for exercising any of those rights.
Ask your advocate first. They control your information on the platform: they can show it to you, export it, correct it and delete it, and we are contractually required to help them do so.
If you contact us instead, at hello@advolutely.com, we will acknowledge your request, identify your advocate where we can, and pass your request to them within 5 business days. We will not delete or disclose your information on our own initiative, because doing so could interfere with the advocacy work you asked your advocate to do.
For the limited information we collect directly (§2), we will respond within 45 days, and will tell you if we need up to 45 days more. We may need to verify who you are, and will ask only for what that takes.
If we refuse a request, you may appeal by replying to our answer or writing to hello@advolutely.com with "Appeal" in the subject line; we will respond within 45 days. If you are still unsatisfied you can complain to your state Attorney General — in Washington at atg.wa.gov, in Nevada at ag.nv.gov, in Connecticut at portal.ct.gov/ag.
Your information is encrypted in storage and in transit, with keys we manage.
Each practice's information is kept separate from every other practice's, and access to your case is limited to the practice that holds it. That separation is enforced by our software rather than by the storage systems underneath it: the platform's own service can technically reach any practice's data, and it is our code — and the tests we hold it to — that keeps one practice out of another's cases. We would rather say that plainly than imply a wall that is not there.
Nobody at Advolutely can sign in to your advocate's account. There is no impersonation feature and no support login. Two people hold the infrastructure credentials that could reach stored information directly; that access requires multi-factor authentication, every use is recorded, unusual access raises an alert the same day, and the records are reviewed twice a week.
No method of storage or transmission is completely secure, and we do not claim otherwise.
We will post any change here with a new date. If a change materially affects consumer health data, we will tell our customers at least 30 days beforehand so they can tell you.
Ebenezer Software LLC, doing business as Advolutely
196 Fox Run Court, Benson, NC 27504
hello@advolutely.com