This Consumer Health Data Privacy Policy (“Policy”) supplements the Cystic Fibrosis Foundation Privacy Policy and provides information regarding how Cystic Fibrosis Foundation collects, uses, and shares “consumer health data” subject to the Washington State My Health My Data Act (“MHMDA”) and Nevada’s Consumer Health Privacy Law (the “consumer health privacy laws”). In the event of a conflict between the Privacy Policy and this Consumer Health Data Privacy Policy, this Consumer Health Data Privacy Policy will control with respect to the processing of consumer health data subject to such laws.

Consumer Health Data We Collect

For purposes of this Policy, consumer health data means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status.

As described in the Information We Collect section of the Privacy Policy, the data we collect depends on the context of your interactions with the Cystic Fibrosis Foundation, what you choose to provide to us, your location, and applicable law. Because consumer health data is defined very broadly, some of the categories of personal information we collect could also be considered consumer health data.  

Examples of consumer health data may include:

• Health conditions, treatment, diseases, or diagnosis, such as diagnosis of CF;
• Social, psychological, behavioral, and medical interventions, such as genetic, nutritional, behavioral, and other therapies used to treat CF;
• Health-related surgeries or procedures, such as lung transplants or other surgical interventions used to treat CF;
• Use or purchase of prescribed medication, such as medications used to treat CF;
• Bodily functions, vital signs, symptoms, or measurements, such as FEV₁ percentage and other information required to help you find a clinical trial;
• Diagnoses or diagnostic testing, treatment, or medication, such as medications used to treat CF;
• Reproductive and sexual health information, such as reproductive health conditions associated with CF;
• Genetic Information, such as CF mutation type;
• Information that could identify your attempt to seek health care services, such as searches for information about accredited cystic fibrosis care centers;
• Any inferences of the above categories of health data derived or extrapolated from non-health information

This notice does not include data collected in the CF Foundation Patient Registry, pursuant to your consent. For more information about the Patient Registry, please contact your care center.

Sources of Consumer Health Data

As described further in the Information We Collect section of the Privacy Policy, we collect personal information (which may include consumer health data) directly from you or from your interactions with us, as well as from publicly and commercially available sources, as permitted by law. We may also receive consumer health data that you provide to our vendors or other third parties, such as patient-support case managers or social workers.

Why We Collect and Use Consumer Health Data

We collect and use consumer health data for the purposes described in the How We Use Personal Information section of our Privacy Policy. Primarily, we may use consumer health data to provide and manage our services, online or offline. This may include:

• Providing you with our Services, such as to provide people with CF and their families with insurance, financial, and legal assistance and other resources, to connect you with the CF community, help people with CF find accredited care centers and clinical trials, and
• Developing, improving, and maintain our Services, such as to conduct research and learn about the CF community in order to inform current and future programs and services;
• Communicating with you and providing support, such as to provide you with information about CF, our Services, and CF and CF Foundation events, to address your inquiries and feedback, requests, and other communications you send us, and to provide you with support services; and
• complying with law, such as to comply with legal obligations and process and contractual obligations, as well as our policies and terms and conditions.

We may use consumer health data for other purposes for which we give you choices and/or obtain your consent as required by law — for example, for advertising or marketing purposes. See the Tracking and Cookies section of our Privacy Statement and the How to Exercise Your Rights section below for more details on the choices you may have.

We may also use consumer health data and share it with a third party in the context of any reorganization, merger, transfer, or other disposition of all or any portion of our organization, operations, or assets (including in connection with any bankruptcy or similar proceedings).

Our Sharing of Consumer Health Data

We may share each of the categories of consumer health data described above for the purposes described in the Personal Information We May Share section of the Privacy Policy. In particular, we may share personal information, including consumer health data, with your consent or in order to provide services, as described in the Privacy Policy, or as required by law.

Third Parties With Which We Share Consumer Health Data

As necessary for the purposes described above, we share consumer health data with the following categories of third parties:

• Service providers. Vendors or agents working on our behalf may access consumer health data for the purposes described above. For example, companies we’ve hired to assist in protecting and securing our systems and services may need access to data to provide those functions.
• Business collaborators. We may share consumer health data with other companies, for example, where you use a service that is operated by another company, or where you use another company to interact with our Services.
• Financial institutions and payment processors. When you make a purchase or enter into a financial transaction, we will disclose payment and transactional data to banks and other entities as necessary for payment processing, fraud prevention, analytics, or other related financial services.
• Other third parties. In certain circumstances, it may be necessary to provide data to other third parties or law enforcement, for example, to comply with the law or to protect our rights or the rights of others.  

How to Exercise Your Rights

The consumer health privacy laws provides certain rights with respect to consumer health data, including rights to know, access, delete, withdraw consent, and amend relating to such data, subject to certain exceptions.  

You can request to exercise such rights using the various tools and mechanisms described in the Your Rights and Choices Regarding Your Information and the Exercising Your Rights and Choices sections of the Privacy Policy. For example, you can email privacy@cff.org to exercise any rights you may have.We will verify and respond to your request consistent with applicable law.  We may need to request additional information from you in order to verify your identity and protect against fraudulent requests. If you make a Request to Delete, we may also ask you to confirm your request before we delete your consumer health data.

If your request to exercise a right under the consumer health privacy laws is denied, you may appeal that decision by contacting our Privacy Officer at privacy@cff.org. If your appeal is unsuccessful, you can raise a concern or lodge a complaint with the Washington State Attorney General or the Nevada State Attorney General.  

Changes to this Policy

We may update this Policy at any time and, if so, we will post the new effective date below. If these changes would permit us to share your information more broadly than described above or use your information in a manner that is not described above, we will post an announcement on this Site and/or ask for your consent.

Your continued use of the Site after the effective date of the new Policy constitutes your consent to the new Policy.

Effective Date: September 18, 2026