Consumer Health Data Privacy Policy
How we handle consumer health data under the Washington My Health My Data Act. Your access information goes only to venues you choose, and never to an AI model.
Effective: 21 September 2026
1. Who we are and what this policy covers
WelcoMe is run by Neatebox Limited, a company registered in Scotland (number SC409943), 5 South Charlotte Street, Edinburgh EH2 4AN, United Kingdom. In this policy, “we” and “us” mean Neatebox Limited.
This policy explains how we handle consumer health data under the Washington My Health My Data Act. It applies if you live in Washington State, or if we collect your data in Washington, for example when you share your access needs with a venue there.
We treat all the access information you give us as consumer health data, because it can reveal a disability or health condition. This policy sits alongside our main Privacy Notice. Where the two differ for Washington consumers, this policy applies.
2. The consumer health data we collect
We only collect what you choose to put in your WelcoMe Key profile, plus the details needed to arrange your visit.
| Category | Examples |
|---|---|
| Access preferences | Mobility, sensory, communication or cognitive needs; support you would like from staff; equipment you use; how you prefer to be greeted and helped; whether you travel with an assistance animal or companion |
| Health conditions you choose to add | An optional list of conditions you pick from, so staff understand the context of your needs. You control whether each one is shared with staff or kept private, and you can set that separately for each venue. |
| Companion details you choose to add | Whether someone comes with you, their name and relationship to you if you tell us, and whether staff should speak to them directly |
| Anything you write in free text | Extra detail you choose to add about your needs |
| Account details linked to the above | Your name, email address and phone number |
| Visit details linked to the above | The venue you are visiting, the date and time, how many people are coming, and the entrance you plan to use |
Adding health conditions is optional. We never ask for proof, test results or treatment records. We do not collect precise location data or biometric data.
3. Where the data comes from
Almost all of it comes directly from you, when you create and update your Key profile or share it with a venue. A venue may give us the date and time of your booking so we can link it to your visit. We never buy data from data brokers or collect it from other sources.
4. Why we collect and use it
We use your consumer health data only to:
- keep your access preferences so you only have to tell us once
- pass them to a venue you choose, so its staff can prepare for your visit
- send you visit confirmations, which contain the date and time only and never your access information
- run your account, keep it secure and help you if you contact us
- meet our legal obligations
We do not run AI or large language models over any of your Key information.
6. Your consent
We ask for your consent in two separate steps.
- To collect and store your data. When you create your Key, we ask whether you agree to us holding your access preferences.
- To share it with a venue. Nothing goes to a venue until you choose that venue and confirm you want to share. You do this separately for every venue.
You can withdraw either consent at any time, as easily as you gave it, from your Key settings or by emailing access@wel-co.me. Once you withdraw, we stop collecting or sharing that data from then on.
7. Your rights and how to use them
You have the right to:
- confirm whether we collect, share or sell your consumer health data, and get a copy of it
- get a list of every third party we have shared it with, and their contact details
- withdraw your consent
- have your data deleted. We will also tell every venue and service provider we shared it with to delete it. Copies held in our hosting provider’s rolling backups are overwritten within 30 days.
How to ask. Email access@wel-co.me. We may ask you to confirm your identity, usually through the email address on your account. Requests are free, up to twice in any 12 months.
When we will reply. Within 45 days. If we need longer, we will tell you why within those 45 days, and take no more than 45 extra days.
If we say no, you can appeal. Reply to our decision email with the word “Appeal” and tell us why. We will give you a written answer within 45 days. If we still refuse, we will explain how to complain to the Washington State Attorney General.
We will never treat you differently or give you a worse service because you used these rights.
8. What we never do
- We never sell your consumer health data.
- We never use it for advertising, or share it with anyone for advertising.
- We never set up virtual boundaries (geofences) around healthcare facilities to track people or send them messages.
- We never share it with a venue you have not chosen.
9. Security, retention and changes
Security. Only staff who need your data to run the service can access it. Data is encrypted in transit and at rest.
How long we keep it. We keep your Key profile for as long as you have an account. It is deleted when you delete it or close your account.
When you share with a venue, that venue’s staff can see what you shared from the moment you share it until one day after your visit date, after which their access ends automatically. We delete the access detail attached to that visit 30 days after the visit date. We keep the record that a visit happened, and at which venue, for up to three years so we can report on and improve the service. That record no longer contains your access information.
Changes to this policy. We will update the date at the top of this policy. If we want to use or share your data in a new way, we will ask for your consent first.
Contact us. Email access@wel-co.me, or write to Neatebox Limited, 5 South Charlotte Street, Edinburgh EH2 4AN, United Kingdom.
Want to use one of these rights?
Email us at access@wel-co.me and we will come back to you within 45 days. There is no charge.
Email access@wel-co.me