Washington Consumer Health Data Privacy Policy

Document status:

Draft v1

Drafted:

October 18, 2026

Effective date:

to be set on attorney clearance

Last updated:

draft

This policy is for Washington consumers under Washington's My Health My Data Act (RCW 19.373). Our Privacy Policy, at cryptobasis.ai/privacy, covers everything else.

1. The consumer health data we may collect, and why

We don't ask for health information. But a federal tax return can hold some, and Return Check reads the whole return you give it. These parts of a return can hold consumer health data:

• Form 8962 (Premium Tax Credit). It shows health insurance bought through a Health Insurance Marketplace. Return Check checks this form's figures.
• Schedule 1's deduction for a health savings account. Return Check checks this line only as a number that must add up with the other lines.
• Schedule 2 (Additional Taxes). Its line for repaying excess advance premium tax credit comes from Form 8962, and its additional-tax lines can carry amounts from Form 8889. Return Check checks these lines only as numbers that must add up with the other lines.
• Schedule A (Itemized Deductions) and Form 8889 (Health Savings Accounts). Schedule A's medical and dental expense lines show health care costs. Return Check doesn't check either form, but if they're in your PDF, their pages are read with the rest of the return.

Why we collect it: only to run the check you bought, which compares your return's figures with each other and with your CoinTracking files.

How it's used:

• Your return is read in memory while the check runs, and it's gone when the check ends. Nothing is written to disk, and we keep none of it.
• Your report can show a figure from these forms if a check of that figure found a problem. The report goes only to you.
• We don't use it for anything else, and we never sell it.

cryptoBASIS Load and the CoinTracking Audit read no tax return, so they collect no consumer health data.

2. Where it comes from

Only from you: the federal tax return you choose to give us.

3. Who it's shared with

We don't share it with any third party or affiliate, and we never sell it.

Two services handle it for us, as our processors:

• Vercel, which hosts our site, runs the check. Your return passes through its systems only while the check runs.
• Mailgun, our email service, sends the copy of your report when the purchase page says it will be emailed. The copy is locked with your password, and Mailgun never receives your return.

4. Your rights, and how to use them

Under RCW 19.373.040 you can:

• confirm whether we collect or share your consumer health data, and see it;
• withdraw your consent;
• have your consumer health data deleted.

We keep no consumer health data, so once your check ends we hold none about you, and there is none for us to show or delete. Stripe's record of your payment holds no health data. It does hold your answer on whether you live in Washington or are in Washington now and, on a yes, that you consented, with the version of the wording you saw.

Withdrawing your consent:

• Each check asks for your consent before you choose any file, so there's nothing to switch off. Not starting another check is withdrawing it.
• Before you pay, you can also leave the page. What you've chosen is gone with it.

Requests and appeals: we answer a request within 45 days. If we turn a request down, you can appeal, and we answer an appeal within 45 days. If we deny an appeal, you can complain to the Washington State Attorney General at atg.wa.gov.

5. No discrimination

We won't treat you differently for using these rights.

6. Changes to this policy

If we change what we collect or why, we update this policy and the consent's wording first, so each check after the change asks for your consent to the new version. The version in effect is the one at cryptobasis.ai/washington-health-data.

7. Seller

Cryptobasis Technologies LLC.