Consumer Health Data Privacy Policy

This is a separate disclosure required by Washington's My Health My Data Act (RCW 19.373) and Nevada's SB 370. It describes how ShotLog collects, uses, and shares any data that may relate to a consumer's past, present, or future health status.

What may qualify as consumer health data

ShotLog sells injection supplies (syringes, needles, alcohol prep pads, vials, sharps containers, and related accessories). We do not sell medications and we do not collect symptom, diagnosis, or treatment information from you. However, your purchase history and browsing patterns on our site could, in some interpretations, be considered "consumer health data" because they may permit an inference about a health-related activity.

Categories collected

• Account / contact: name, email, billing and shipping addresses, phone (when you place an order or create an account).
• Order data: products purchased, quantities, timestamps, payment method (we do not store full card numbers — our payment processor handles those directly).
• Browsing data: pages viewed, products viewed, cart events. With your consent, we use Google Analytics 4 for aggregated traffic measurement.
• Marketing identifiers: with your consent, we use the Meta (Facebook) Pixel, Google Ads conversion tag, and Klaviyo onsite tracking for conversion attribution and email/ad personalization.

How we use this data

• To process orders, ship products, and provide customer support.
• To detect fraud and protect against abuse of our site.
• With your consent, to measure site usage and to attribute conversions for advertising campaigns.
• To send order-related and (with separate opt-in) marketing emails via Klaviyo.

Sources of data

Directly from you when you visit, browse, place an order, contact us, or subscribe to our email list. We do not buy consumer health data from third-party data brokers and we do not enrich your profile with purchased data.

Categories of third parties we share with

• Payment and fulfillment: our payment processor, shipping carriers (USPS, UPS, FedEx, DHL, OnTrac), and ShipStation for label generation.
• Advertising and analytics (with your consent): Google (GA4 + Google Ads conversion), Meta (Facebook Pixel for conversion + retargeting), Klaviyo (email and onsite tracking).
• Hosting and infrastructure: our web host (cPanel-managed) and Cloudflare as our content delivery network and DDoS protection.
• Legal and safety: we may disclose data to comply with valid legal process, to protect our rights, or in connection with a business transfer.

We do not sell consumer health data

ShotLog does not sell consumer health data and has not done so in the preceding twelve months. We do not authorize any third party to sell consumer health data on our behalf. If we ever change this, we will obtain your separate, prior, written authorization as required by RCW 19.373.030.

Geofencing

ShotLog does not use geofencing technologies around any healthcare facility, mental-health facility, or sexual or reproductive health facility, as prohibited by RCW 19.373.080.

Retention

Order and account data is retained for as long as you maintain an account, plus the period required to satisfy tax, accounting, and legal-defense obligations (typically seven years). Analytics data inside Google Analytics is retained per our GA4 retention setting (14 months). Marketing identifiers in Klaviyo are retained until you unsubscribe and request deletion.

Your rights

Washington residents (and residents of other states with consumer health data protections) may:

• Request access to the consumer health data we hold about you.
• Withdraw consent for collection, sharing, or sale at any time.
• Request deletion of your consumer health data.

To exercise these rights, email [email protected]. You may also use the controls on Your Privacy Choices to manage cookie consent. We will respond to verifiable rights requests within 45 days.

Appeals

If we deny your request, you may appeal by replying to our denial email or sending a new email to [email protected] with the subject line "Privacy Appeal." If your appeal is denied, you may contact the Washington Attorney General at atg.wa.gov/file-complaint.

Contact

ShotLog
[email protected]

This document is a separate Consumer Health Data Privacy Policy as required by RCW 19.373.020 and is not a substitute for our general Privacy Policy.