Effective Date: March 31, 2024
This notice supplements the Xandr Platform Privacy Policy and applies to personal data defined as “consumer health data” subject to the Washington State My Health My Data Act (MHMDA).
Consumer Health Data We Collect
As described in the Information Xandr Collects section of our privacy policy, the data we collect depends on the context of your interactions with third parties and digital properties that have integrated with our platform, your location, and applicable law. Because consumer health data is defined very broadly, many of the categories of data we collect could also be considered consumer health data.
Examples of consumer health data may include Platform Data and audience segmentation data provided by affiliates, clients, and third parties that, through inference or derivation, may relate to:
- Information about your health-related conditions, symptoms, status, diagnoses, testing, or treatments (including surgeries, procedures, medications, or other interventions).
- Information that could identify your attempt to seek health care services or information, including services that allow you to assess, measure, improve, or learn about your or another person’s health. For example, we collect your Bing search queries, which may include queries concerning nutrition, wellness, fitness, medical conditions, or other health-related topics.
Sources of Consumer Health Data
As described further in the Information Xandr Collects section of our privacy policy, we collect personal data (which may include consumer health data) directly from your device, from affiliates, and from third parties. For example, we may:
- Collect data directly from your device when you visit a digital property that has integrated with our advertising platform.
- Receive data about you or your device from affiliates, third party data providers, clients, and other third parties to facilitate the delivery of advertising to you.
Why We Collect and Use Consumer Health Data
We collect and use consumer health data for the purposes described in the How We Use the Information We Collect section of our privacy policy. Primarily, we collect and use consumer health data as reasonably necessary to provide advertising services to our customers in accordance with their instructions. We may also use such data to detect, investigate, and prevent fake, fraudulent, illegal, malicious, and unauthorized activity on our advertising platform. Please note that Xandr does not allow the use of consumer health data to target advertising campaigns to consumers in Washington state, nor do we utilize geofencing in Washington state.
See the What Are Your Rights as a Consumer in Certain US States section of our privacy policy for details on the controls and choices you may have in relation to our use of consumer health data.
Our Sharing of Consumer Health Data
We may share each of the categories of consumer health data described above for the purposes described in the How and Why We Disclose to Third Parties the Information We Collect section of our privacy policy. In particular, we may share personal data, including consumer health data, with your consent or as reasonably necessary to facilitate delivery of advertising to you, in accordance with our customers’ instructions, when you visit a digital property or other third party that has integrated with our platform.
We may also disclose data when we believe that doing so is necessary to comply with applicable law or respond to valid legal process.
Third Parties With Which We Share Consumer Health Data
As necessary for the purposes described above, we share consumer health data with the following categories of third parties:
- Service providers. Vendors or agents (“processors”) working on our behalf may access consumer health data to support the operation of our advertising platform and to maintain the safety and security of the online ecosystem. For example, companies we’ve hired to detect and prevent ad fraud and to secure our systems and services may need access to data to provide those functions.
- Clients and Third-Party Providers. We may share consumer health data with other companies, in accordance with client instructions, so they can decide whether to bid on ad inventory or serve an advertisement and choose the best ad for you using their data.
- Affiliates. We enable access to data across our subsidiaries, affiliates, and related companies, for example, where we share common data systems or where access helps us to provide our services and operate our business.
- Other third parties. In certain circumstances, it may be necessary to provide data to other third parties, for example, to comply with the law, respond to valid subpoena or legal process, meet security or law enforcement requirements, or to protect our rights or those of our customers.
How to Exercise Your Rights
MHMDA provides certain rights with respect to consumer health data, including rights to access, delete, or withdraw consent relating to such data, subject to certain exceptions. You can request to exercise such rights using the various tools and mechanisms described in the What Are Your Rights as a Consumer in Certain US States section of our privacy policy. You can also request access and deletion of your consumer health data through the Xandr Privacy Center.
If your request to exercise a right under the MHMDA is denied, you may appeal that decision by contacting our privacy support team via our web form. If your appeal is unsuccessful, you can raise a concern or lodge a complaint with the Washington State Attorney General at www.atg.wa.gov/file-complaint.