Washington State
Consumer Health Data Privacy Policy.
This notice is for Washington State residents, and explains what we do — and do not — collect about your health.
Last updated 31 July 2026
This notice is published under Washington's My Health My Data Act (RCW 19.373). For everything else, see our general privacy policy.
Scope
This notice is required by Washington law.
Washington's My Health My Data Act (RCW 19.373) gives Washington residents specific rights over "consumer health data" and requires companies to publish a separate policy describing how they handle it. This is that policy, and it applies to consumers who are Washington residents or whose consumer health data is collected in Washington. It is published by DevPT LLC, a limited liability company registered in North Dakota, which operates 3DPainMap. Our general privacy policy covers everything else and everyone else; this notice sits alongside it and does not replace it. We publish this notice rather than assert an exemption, because the Act's definitions are broad and we would rather be accurate than clever.
Categories collected
We collect no consumer health data.
Stated as directly as the Act allows us to state it: 3DPainMap does not collect consumer health data. The information the Act protects — anything indicating your health status, symptoms, diagnoses, treatments, medications, bodily functions, or attempts to obtain health care — is created by you inside the workspace and is written only to your own browser on your own device. It is never transmitted to us. We hold no copy, on any server, at any time. Specifically:
- The areas you paint on the body model, and every measurement calculated from them, stay in your browser.
- Findings, intensity ratings, symptom types, and any notes you type stay in your browser.
- Any patient details you enter — name, record number, date of birth, medications, allergies, history — stay in your browser.
- We deliberately run no analytics of any kind on the workspace, the read-only viewer, or the embeddable model. On those pages no request is made to any analytics provider.
- We do not collect precise location data anywhere on this site.
Sources and purposes
Where the little we do collect comes from, and why.
On our public information pages — not the workspace — we collect ordinary website analytics, which we do not consider consumer health data and do not use to infer anything about your health. The Act asks us to describe the sources and the purpose, so:
- Source: your browser, directly, when you visit one of our public information pages.
- What: the page path (stripped of any query string or fragment), a page label derived from our own route names, and standard browser-supplied information such as approximate location from your IP address, device type, and referring site.
- Purpose: to count how many people visit which pages, so we know which explanations are useful. That is the whole purpose.
- We do not use any of it to infer health status, and we do not combine it with anything you create in the workspace — which we could not do, because we never receive that.
- We do not collect it for advertising, and we run no advertising or social-media trackers on this site.
Sharing
Who receives data, and who does not.
The Act requires us to list the categories of third parties and the specific affiliates with whom consumer health data is shared. Because we collect no consumer health data, we share none. For completeness, these are the only third parties involved in running the site at all:
- Google LLC (Google Analytics 4) — receives the public-page analytics described above. It receives nothing from the workspace, the viewer, or the embed.
- Microsoft Corporation (Azure Static Web Apps) — hosts the site and keeps standard server logs, including IP addresses, as any web host does.
- Specific affiliates: none. DevPT LLC has no affiliates or subsidiaries with which any data is shared.
- We have never sold consumer health data, and we do not sell it. Selling it would require your separate, signed authorization under the Act, and we have never sought one because we have nothing to sell.
Your rights
What you can ask us to do.
Washington residents have the rights below. Write to danstone.pt@gmail.com to exercise any of them, and we will respond within 45 days. We may need to ask you for enough information to verify your request, and if we cannot verify it we will tell you why rather than ignore it. You may appeal a refusal by replying to our response, and if we deny your appeal you may complain to the Washington Attorney General.
- Confirm whether we collect, share, or sell consumer health data about you, and access that data — including a list of every third party and affiliate we shared or sold it to, with a way to contact them. Today our answer is that we hold none, and the list is empty.
- Withdraw your consent to our collection and sharing of your consumer health data.
- Have your consumer health data deleted. Because we hold none, the effective way to delete what exists is to clear this site's data in your browser, which erases it permanently. If we ever do hold data about you, we will delete it from our systems and our backups and pass the request to any processor.
- Not be discriminated against for exercising any of these rights. We will not degrade the tool or charge you differently.
Geofencing
We operate no geofence, anywhere.
The Act makes it unlawful to place a virtual boundary within 2,000 feet of any facility providing in-person health care in order to identify or track people seeking care, collect their health data, or send them messages or advertising about it. We do not do this. We collect no precise location data, we operate no geofence of any size around any location, and we send no advertising at all.
Changes and contact
What changes, and how to reach a person.
We are building an optional account with an encrypted backup of your charts. If and when that ships, it will change this notice — that would be the first time we hold anything the Act protects, and it will be strictly opt-in, asked for separately from anything else, and revocable. We will update this notice in the same release that changes the behaviour, never after. Questions, requests, and complaints all go to danstone.pt@gmail.com, and a person will answer. You may also complain to the Washington State Attorney General at https://www.atg.wa.gov/file-complaint.
Exercise your rights
One address, answered by a person.
Email danstone.pt@gmail.com to confirm, access, delete, or withdraw consent for consumer health data, or to appeal a decision. We respond within 45 days. You may also file a complaint with the Washington State Attorney General.