Privacy Policy
Last Updated: June 12, 2026 | icmedicine.com
Welcome to the Institute of Complementary Medicine's Privacy Policy. This Privacy Policy describes our policies and procedures regarding the collection, use, and disclosure of your information when you use our website and online services, including our online dispensary and patient portal. It also explains your privacy rights and how applicable law protects you.
By using our website and online services, you agree to the collection and use of information in accordance with this Privacy Policy.
Related ICM Policies
Cookie & Tracking Technology Policy —
icmedicine.com/cookie-tracking-technology-policy/
Last Updated: June 11, 2026
icmedicine.com/cookie-tracking-technology-policy/
Last Updated: June 11, 2026
HIPAA and Protected Health Information
Institute of Complementary Medicine (ICM) is a HIPAA-covered entity. If you are a patient of ICM, your Protected Health Information (PHI) — including medical records, diagnoses, treatment information, and other health-related data — is governed by the Health Insurance Portability and Accountability Act (HIPAA) and is not subject to this website Privacy Policy.
ICM maintains a separate Notice of Privacy Practices (NPP) that explains in detail how we use and disclose your PHI and your rights as a patient under HIPAA. You may request a copy of our Notice of Privacy Practices at any time by contacting us at the information provided at the end of this policy.
ICM utilizes HIPAA-compliant electronic health record systems and engages qualified business associates to support the delivery of clinical services. All such systems and partnerships are governed by Business Associate Agreements (BAAs) as required under HIPAA.
This website Privacy Policy governs data collected through our website, online services, marketing communications, and digital tools. It does not govern your medical records or clinical information, which are separately protected under HIPAA.
Washington My Health MY Data Act — Overview
ICM is committed to complying with the Washington My Health MY Data Act (MHMD Act), which provides significant additional privacy protections for consumer health data collected outside the scope of HIPAA. The MHMD Act applies to information collected through our website, online forms, and digital tools that may relate to your health status, conditions, or behaviors.
We do not sell consumer health data. We do not share consumer health data with third parties for marketing or advertising purposes.
Washington Consumer Health Data Privacy Notice
This section provides the specific disclosures required under Washington's My Health MY Data Act (RCW 19.390).
Categories of Consumer Health Data We May Collect
We may collect the following categories of consumer health data through our website and online services:
• Appointment requests and scheduling information that may indicate health conditions or treatment needs
• Symptom descriptions, health history, and health questionnaire responses submitted through online forms
• Information related to supplement interests and dispensary purchases, which may indicate health conditions or wellness goals
• Website interaction data associated with health-related content pages
• IP addresses and device identifiers associated with visits to health-condition-related pages
• Information you voluntarily provide through contact forms, chat tools, or new patient inquiries
Purposes for Which Consumer Health Data Is Collected
• To respond to new patient inquiries and schedule appointments
• To provide access to our patient portal and online services
• To process and fulfill dispensary orders
• To send appointment reminders and health-related service communications
• To improve our website, services, and patient experience
• To comply with applicable legal and regulatory requirements
Categories of Sources
• Directly from you, through forms, inquiries, and account creation
• Automatically from your device and browser as you interact with our website
• From third-party authentication services when you use social or platform login options
• From service providers acting on ICM's behalf in delivering our services
Categories of Third Parties With Whom Consumer Health Data May Be Shared
We do not sell consumer health data. We may share consumer health data only in the following limited circumstances:
• With service providers who assist ICM in operating our website, patient portal, EHR, and related services, under contractual protections
• As required by law, court order, or valid governmental authority
• With your explicit consent
Consumer Health Data Rights
Under the Washington My Health MY Data Act, you have the following rights with respect to your consumer health data:
• Right to Know: You may request confirmation of whether ICM collects, shares, or sells your consumer health data, and a description of the categories and specific pieces of data collected.
• Right to Access: You may request a copy of the consumer health data ICM holds about you.
• Right to Delete: You may request deletion of your consumer health data, subject to applicable legal exceptions.
• Right to Withdraw Consent: You may withdraw consent for ICM's collection or sharing of your consumer health data at any time.
• Right to Appeal: If ICM declines to act on your request, you have the right to appeal that decision as described below.
To exercise any of these rights, please contact our Privacy Officer at privacy@icmedicine.com or at the contact information provided at the end of this policy.
Appeals Process
If ICM declines to take action on a consumer health data request, we will notify you of the reason within a reasonable timeframe. You may appeal our decision by submitting a written appeal to our Privacy Officer within 30 days of receiving our denial:
Privacy Officer — Institute of Complementary Medicine
privacy@icmedicine.com
1600 E. Jefferson St., Suite 603, Seattle, WA 98122
We will respond to your appeal within 45 days of receipt. If your appeal is denied, you may file a complaint with the Washington State Attorney General's Office at www.atg.wa.gov.
Interpretation and Definitions
Words with initial capital letters have meanings defined below. These definitions apply whether the terms appear in singular or plural.
• Account — A unique account created for you to access our patient portal or other services.
• Company ("We," "Us," or "Our") — The Institute of Complementary Medicine, 1600 E. Jefferson St., Suite 603, Seattle, WA 98122.
• Consumer Health Data — Personal information linked or reasonably linkable to a consumer that identifies their past, present, or future physical or mental health status, as defined under the Washington My Health MY Data Act (RCW 19.390).
• Cookies — Small files placed on your device by a website, containing details of your browsing history.
• Device — Any device that can access the Service, such as a computer, mobile phone, or tablet.
• EHR — ICM's HIPAA-compliant electronic health record system used to manage patient records, scheduling, and clinical data.
• Patient Portal — The secure online portal connected to ICM's EHR system through which established patients may access certain non-clinical account information.
• Personal Data — Any information that relates to an identified or identifiable individual.
• PHI (Protected Health Information) — Individually identifiable health information held or transmitted by ICM as a HIPAA-covered entity.
• Privacy Officer — The individual designated by ICM to oversee privacy compliance, reachable at privacy@icmedicine.com.
• Service — This website, accessible at https://icmedicine.com, including the online dispensary.
• Service Provider — Any third party that processes data on behalf of ICM to facilitate or support our services.
• Usage Data — Data collected automatically when you use the Service, such as IP address, browser type, and pages visited.
• You — The individual accessing or using the Service.
Collecting and Using Your Personal Data
Types of Data Collected
Personal Data: While using our Service, we may ask you to provide personally identifiable information, which may include:
• First name and last name
• Email address
• Phone number
• Mailing address
• Health-related information submitted voluntarily through website forms
• Dispensary order and payment information, processed through a secure third-party payment processor
Usage Data: Collected automatically when using the Service. May include your IP address, browser type and version, pages visited, time and date of visit, time spent on pages, and other diagnostic data.
Third-Party Login Services
To provide a seamless experience between our website and our patient services platform, ICM offers the ability to authenticate using third-party login providers. These services are used solely to enable secure access to ICM's patient-facing tools and are not used to access or publish to your social media accounts.
The following third-party authentication services may be offered:
• Google
• Facebook
• Instagram
• Twitter / X
• LinkedIn
If you choose to authenticate using one of these services, we may receive basic profile information (such as your name and email address) solely for account identification. We do not post to your social media accounts or access your contact lists without explicit consent.
Tracking Technologies and Cookies
We use cookies and similar tracking technologies to monitor activity on our website and improve user experience. These technologies may include browser cookies, web beacons, analytics tools, and accessibility tools.
For a full list of the specific tools active on our website, the type of data each collects, and instructions for managing your cookie preferences, please review our Cookie & Tracking Technology Policy.
Under the Washington My Health MY Data Act, data collected through analytics or tracking tools in connection with visits to health-related pages may constitute consumer health data. ICM works with our website vendor to ensure tracking tools are configured appropriately and that consumer health data protections apply where required.
Patient Portal
ICM offers a patient portal that connects to our EHR system to provide established patients with access to certain account-related information.
• Patient portal accounts are created within our EHR system at the time of patient enrollment. No separate account creation is required on our website.
• Access is authenticated through your EHR credentials. Third-party login options may be enabled to streamline this process.
• Health information accessed through the patient portal is Protected Health Information governed by HIPAA and our Notice of Privacy Practices — not by this website Privacy Policy.
• Technical data generated during your portal sessions (login timestamps, device type, IP address) is governed by this Privacy Policy as Usage Data.
Telehealth Services
ICM offers telehealth services to established patients through HIPAA-compliant platforms. Telehealth sessions and the health information exchanged during those sessions are Protected Health Information governed by HIPAA and our Notice of Privacy Practices.
If you schedule a telehealth appointment through our website, the scheduling information you submit is subject to this Privacy Policy. Once you enter the telehealth platform, that platform's own HIPAA-compliant policies apply.
Online Dispensary
ICM operates an online dispensary offering professional-grade supplements and related wellness items, available exclusively to established ICM patients. For full dispensary policies, please review our Dispensary Supplement Policy.
Information Collected
• Name, shipping address, and contact information provided at checkout
• Order history and product selections
• Payment information, processed through a secure third-party processor and not stored on ICM's servers
How We Use Dispensary Data
• To process and fulfill your order
• To communicate order status and shipping updates
• To maintain purchase history for warranty, return, and regulatory purposes
• To improve our product offerings and dispensary experience
Dispensary and Consumer Health Data
Product selections and supplement purchases made through our dispensary may reflect or indicate health conditions, symptoms, or wellness goals. Such information may constitute consumer health data under the Washington My Health MY Data Act and is protected as described in the Washington Consumer Health Data Privacy Notice section of this policy. Dispensary purchase records may also be noted in your patient record when clinically relevant, in accordance with HIPAA.
Regulatory Retention
Dispensary transaction records may be retained for the period required by applicable federal and state regulations governing the sale of supplements and health products.
Use of Your Personal Data
ICM may use personal data collected through this website for the following purposes:
• To provide and maintain our website and online services, including the dispensary and patient portal
• To respond to your inquiries, appointment requests, and new patient outreach
• To process and fulfill dispensary orders
• To send appointment reminders, health-related communications, and service updates
• To send marketing communications such as newsletters, only where you have opted in or where permitted by law
• To manage and improve our website, online tools, and overall patient experience
• To comply with legal and regulatory obligations
SMS / Text Messaging
By providing your mobile number and consenting to receive text messages from ICM, you agree to receive SMS communications related to your care, appointments, and services. The following terms apply:
• Consent to receive SMS messages is not required as a condition of receiving medical treatment, enrolling in a Concierge Medicine tier, or purchasing products through our dispensary.
• Message frequency will vary based on your care, appointments, and communication preferences.
• Message and data rates may apply depending on your carrier and plan.
• To opt out at any time, reply STOP to any message. You will receive one confirmation message and will not receive further messages unless you re-opt in.
• To request help or contact information, reply HELP.
• No mobile information will be shared with third parties for marketing or promotional purposes. All opt-in data and consent are not shared with any third parties.
Service Providers and Third-Party Sharing
ICM works with trusted third-party service providers who assist us in operating our website, EHR system, patient portal, dispensary, and related services. These providers may process certain data on ICM's behalf and are contractually obligated to protect your information. Where required by HIPAA, these providers are engaged under Business Associate Agreements.
Categories of services our providers support include:
• Practice management, automation, and patient engagement technology
• Electronic health records and clinical data management
• Administrative and billing services
• Marketing and patient communication platforms
• Secure payment processing for dispensary transactions
• IT infrastructure, hosting, and website services
We do not sell your personal data. We do not share your personal data with third parties for their own marketing purposes. We may share your information in the following limited circumstances:
• With service providers, to the extent necessary to deliver our services
• As required by law, court order, or governmental authority
• To protect ICM's legal rights or the safety of our patients and staff
• In connection with a merger, acquisition, or transfer of assets, with advance notice provided to you
• With your explicit consent for any other purpose
Retention of Your Personal Data
ICM retains personal data collected through this website in accordance with the following general guidelines:
• Website inquiries and contact form submissions: 2 years
• Marketing and patient communication records: 5 years
• Dispensary transaction records: 7 years, or as required by applicable regulations
• Security and access logs: 1 year
• Patient health records (PHI): Retained in accordance with HIPAA and applicable Washington State law
Transfer of Your Personal Data
Your information may be processed at ICM's operating offices and at the facilities of our service providers, which may be located outside your state. We take all reasonable steps to ensure your data is treated securely and in accordance with this Privacy Policy. No transfer of personal data will occur unless appropriate safeguards are in place.
Your Right to Delete Personal Data
You have the right to request deletion of personal data ICM has collected about you through this website and online services. To submit a deletion request, please contact our Privacy Officer at privacy@icmedicine.com.
Please note that we may be required to retain certain information to fulfill legal obligations, resolve disputes, or enforce agreements. Deletion requests related to PHI in your medical record are handled separately under HIPAA and our Notice of Privacy Practices.
Data Breach Notification
In the event of a data breach involving personal data or consumer health data collected through our website, ICM will provide notice as required by applicable law, including Washington's data breach notification statute (RCW 19.255) and, where applicable, HIPAA's Breach Notification Rule. Notification will be provided to affected individuals and relevant regulatory authorities within the timeframes required by law.
Disclosure of Your Personal Data
Business Transactions
If ICM is involved in a merger, acquisition, or asset sale, your personal data may be transferred. You will be notified before your data becomes subject to a different privacy policy.
Law Enforcement
ICM may disclose personal data when required by law or in response to valid requests from public authorities, such as a court order or government agency.
Other Legal Requirements
ICM may disclose personal data when we believe in good faith that such action is necessary to comply with a legal obligation, protect our rights or property, investigate wrongdoing, protect user safety, or prevent legal liability.
Security of Your Personal Data
The security of your personal data is important to us. We implement commercially reasonable administrative, technical, and physical safeguards to protect your information. However, no method of internet transmission or electronic storage is 100% secure, and we cannot guarantee absolute security. Patient health information processed through our EHR system is protected by HIPAA-mandated safeguards, including encryption, access controls, and audit logging.
Children's Privacy
Our website and online services are not directed to children under the age of 13. We do not knowingly collect personally identifiable information from anyone under 13. If you believe your child has provided us with personal data without appropriate consent, please contact us and we will take steps to remove that information.
ICM does provide medical care to pediatric patients. Health information related to minor patients is handled exclusively under HIPAA and our Notice of Privacy Practices. Parents or legal guardians may exercise applicable privacy rights on behalf of minor patients as permitted by law.
Links to Other Websites
Our website may contain links to third-party websites not operated by ICM. We strongly advise you to review the privacy policy of any site you visit. We have no control over and assume no responsibility for the content or practices of any third-party sites or services.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Material changes will be communicated via email or a prominent notice on our website. We encourage you to review this policy periodically. Continued use of our website after any update constitutes acceptance of the revised policy.
Contact Us
If you have questions or concerns about this Privacy Policy, your personal data, or your rights under applicable law, please contact us:
Privacy Officer — Institute of Complementary Medicine
1600 E. Jefferson St., Suite 603, Seattle, WA 98122
Phone: (206) 726-0034
Email: privacy@icmedicine.com
Website: www.icmedicine.com
For questions specifically related to your PHI or your rights as a patient under HIPAA, please request a copy of our Notice of Privacy Practices at the contact information above.