This Consumer Health Data Privacy Policy describes how Yoke’s Foods, Inc. (“Yoke’s” or “we” or “our” or “us”) treats certain information collected or provided in connection with an end user’s (“you” or “your” or “user”) use of Yoke’s website, https://www.yokesfreshmarkets.com/, and any other website, social media pages, or other digital medium owned or operated by Yoke’s (collectively, the “Site”). This Consumer Health Data Privacy Policy also applies to any “consumer health data” collected from Washington state residents and those whose consumer health data is collected, stored, or used by us, such as information you provide us through the above media, by email, mail, or telephonic communications in connection with our Site and any and all products or services provided to you by Yoke’s (“Services”), as well as those whose consumer health data is collected in the State of Washington..

This Consumer Health Data Privacy Policy is not a contract and does not create any legal rights.

This notice applies to Washington residents and those whose consumer health data is collected in Washington. Consumer Health Data means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status, under the Washington State My Health My Data Act (MHMDA). See also our other Privacy Policy that provides disclosures about personal information that is not consumer health data subject to MHMDA.

This notice does not apply where an exception or exemption applies such as with respect to protected health information under the Health Insurance Portability and Accountability Act (“HIPAA”) and data that is subject to the Gramm-Leach-Bliley Act (“GLBA”). When we are a covered entity, we provide separate HIPAA and GLBA privacy notices to certain customers and consumers as required under applicable laws and regulations. Most consumer health data we process is regulated under HIPAA or GLBA or is processed for a necessary function.

Consumer Health Data Collected

The Personal Information (as defined in our Privacy Policy), including Consumer Health Data, we collect varies based on your relationship with us. For example, if you visit our Site we may collect Personal Information through tracking technologies essential to running our Site. Or, if you visit our physical premises in Washington, we may collect video surveillance or other information that could incidentally include Consumer Health Data.

We may collect the following categories of Consumer Health Data:

• Individual health conditions, treatment, diseases, or diagnosis;
• Social, psychological, behavioral, and medical interventions;
• Health-related surgeries or procedures;
• Use or purchase of prescribed medication;
• Bodily functions, vital signs, symptoms, or measurements of other types of consumer health data;
• Diagnoses or diagnostic testing, treatment, or medication;
• Gender-affirming care information;
• Reproductive or sexual health information;
• Biometric data;
• Genetic data;
• Precise location information that could reasonably indicate a consumer's attempt to acquire or receive health services or supplies;
• Data that identifies a consumer seeking health care services; and
• Other information that may be processed to derive or infer data related to the above or other consumer health data.

The categories of Consumer Health Data above may include the following personal information, when collected in connection with your past, present, or future physical or mental health status:

• Identifiers such as name, contact information, online identifiers, and government-issued ID numbers;
• Characteristics of Protected Classifications under state or federal law such as age and medical conditions;
• Commercial Information such as transaction information and purchase history;
• Internet or Network Activity Information such as browsing history, interactions with our Site, Internet Protocol (IP) address, Media Access Control (MAC) address; operating system and version; Internet browser type and version;
• Geolocation Data such as device location; and
• Audio, Electronic, Visual and Similar Information such as call and video recordings;

We process any deidentified Consumer Health Data only in a deidentified fashion and will not attempt to reidentify such data.

Why We Collect and Use Consumer Health Data

To the extent we collect your Consumer Health Data as described above, we may use it for the following purposes:

• Services and Support. To provide and operate our Services, communicate with you about your use of the Services, provide you with information about our Services, including information about health care, health related services, resources and benefits that will help you manage your health; sending administrative information to you, such as changes to our terms, conditions, and policies; provide troubleshooting and technical support, respond to your inquiries, fulfill your orders and requests, process your payments and claims, communicate with you about the Services, complete transactions, provide quotes; and to provide our insurance products or services requested by consumers;
• Analytics and Improvement. To better understand how you access and use the Services, and for other internal research and analytical purposes, such as to evaluate and improve our Services and business operations and for internal quality control and training purposes;
• Research and Surveys. To administer surveys and questionnaires, such as for customer engagement purposes;
• Infrastructure. To maintain our facilities and infrastructure and undertake quality and safety assurance measures;
• Authentication. To authenticate or confirm your identity;
• Security and Protection of Rights. To protect the Services and our business operations; to protect our rights or those of our stakeholders; to prevent and detect fraud, unauthorized activities and access, and other misuse; conduct risk and security control and monitoring; where we believe necessary, to investigate, prevent or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety or legal rights of any person or third party, or violations of our Terms as well as any additional terms specific to the site;
• Compliance and Legal Process. To comply with the law and our legal obligations, to respond to legal process and related to legal proceedings;
• General Business and Operational Support. To consider and implement mergers, acquisitions, reorganizations, bankruptcies, and other business transactions such as financings, and related to the administration of our general business, accounting, auditing, compliance, recordkeeping, and legal functions; and
• Business Transfers. To consider and implement mergers, acquisitions, reorganizations, and other business transactions, and where necessary to the administration of our general business, accounting, recordkeeping, and legal functions.
• Deidentification. We may also aggregate or de-identify Consumer Health Data by removing identifying details so it no longer identifies an individual. If we de-identify Consumer Health Data, we will not attempt to reidentify it.

Categories of Sources

We generally collect Personal Information, including consumer health data, from the following categories of sources:

• Directly from you and automatically;
• Our affiliates; and
• Our vendors

Our Sharing of Consumer Health Data

The categories of third parties and other recipients with whom we may share Consumer Health Data as necessary to provide our products and services requested by consumers are:

• Our affiliates, including Rosie (https://shop.rosieapp.com/153) and Express Scripts (https://www.express-scripts.com/);
• Or business customers (as directed by that business partner); 
• Government or public authorities if (a) we believe that disclosure is reasonably necessary to comply with any applicable law, regulation, legal process, or governmental request, (b) to enforce our agreements, policies, and terms of service, (c) to protect the security or integrity of our services, (d) to protect the property, rights, and safety of us, our users, or the public from harm or illegal activities, (e) to respond to an emergency which we believe in the good faith requires us to disclose information to assist in preventing the death or serious bodily injury of any person, or (f) to investigate and defend ourselves against any third-party claims or allegations.

How to Exercise Your Rights

MHMDA grants certain rights including a right of access and deletion, subject to certain exceptions.

If you would like to exercise your rights under the MHMDA, you may make a request by contacting us at yokes@yokesfoods.com or Yoke’s Foods, Inc., 3426 S University Rd, Spokane Valley, WA 99206; phone: 509.921.2292 ext 11. Please indicate that you are making a request pursuant to your “Washington Privacy Rights” and provide us with the following information: (1) first and last name; (2) email address; (3) physical address; and (4) date of birth. We will take steps to verify your request by matching the information provided by you with the information we have in our records.

If your request to exercise a right under the MHMDA is denied, you may appeal the denial. A method for submitting an appeal will be contained in our response. If your appeal is unsuccessful, you can raise a concern or lodge a complaint with the Washington State Attorney General at www.atg.wa.gov/file-complaint.

The Effective Date of this Consumer Health Data Privacy Policy is April 1, 2024.