Consumer Health Data Privacy Policy
Effective and last updated: September 24, 2026
About This Policy
The Jada Bascom Foundation ("we," "our," or "us") is a 501(c)(3) nonprofit based in Deer Park, Washington. We explain bone marrow and blood stem cell donation and point people to official donor registries. We are not a registry, a laboratory or a health care provider, and we do not ask you for medical records.
This policy explains how we handle consumer health data on jadabascomfoundation.org, as required by Washington's My Health My Data Act (chapter 19.373 RCW) and Nevada's consumer health data law (NRS 603A.400 to 603A.550). It sits alongside our Privacy Policy, which covers the rest of our site.
We do not sell consumer health data.
What Consumer Health Data Means
Consumer health data is personal information that is linked, or could reasonably be linked, to you and that says something about your physical or mental health, past, present or future. It can be obvious, like a diagnosis you tell us about. It can also be indirect, like the fact that a browser read our guide to a particular disease, because that could suggest you or someone close to you has it.
Our disease library, our Why Matching Is Hard stories, and our pages about autologous transplants, donating with a medical condition, what can disqualify a donor, helping a loved one and sibling match odds are about health. We call them our health pages in this policy.
What We Collect and Why
Visits to our health pages
Google Analytics records visits to our health pages, but it is not told which condition a page is about. On a page about a particular condition, it receives a general address and title, such as "/diseases/(condition)" and "Health information", instead of the real ones. It also receives when you visited, your device and browser type, approximate location based on your IP address (such as city or country), the Google Analytics identifier stored in your browser, and what you do on the page, such as how far you scroll, links you follow to other sites, clicks on a donate button or an official registry link, and newsletter sign-ups. When you follow a link to another site, the address of that site is recorded, and it may relate to the topic of the page.
Why: to see how people use our health information and whether it helps them take a next step, so we can improve it and reach more potential donors. We also count registry-link clicks and newsletter sign-ups, including those made on health pages, as results in our Google Ads account, which helps Google decide when to show our ads. We look at this in grouped reports. We do not use it to identify you or to work out anyone's health.
What you choose to tell us
Our contact and volunteer forms and our email inbox have space to write freely. If you mention your own health or a loved one's, such as a diagnosis, a treatment or a search for a donor, we receive it along with your name, email address and any other details you give.
If you join our newsletter from the sign-up box on a disease library or transplant page, your subscription record notes that it came from one of those pages, not which one.
Why: to read your message, reply and help in the way you asked, and to know which parts of our site lead people to stay in touch. We do not ask for health details and you never need to share them.
The page you first arrived on, when you contact us or sign up
If you first reached our site through a link with campaign or ad-click tags, we keep a note of that first page, the tags (which can include the search or ad keyword), any ad-click ID and the site that sent you, for 30 days, unless you have turned marketing cookies off. Outside the European Economic Area, the United Kingdom and Switzerland, marketing cookies are on until you turn them off. If you then send a form or join our newsletter, we save that note with your submission. When the first page was a health page, we save only the section it belongs to, such as our disease library, not the condition.
Why: to understand which outreach brings people to us, so we can spend our awareness budget well.
What we do not collect
- We do not have health questionnaires or eligibility forms that store answers.
- We do not store the optional age choice shown before a registry link.
- We do not collect precise location, biometric data or genetic data, and we do not use location to tell whether someone is visiting a health care facility.
- Our registry-link counter keeps only a daily total by country. It does not record which page the click came from.
Where It Comes From
- Directly from you, through our forms, newsletter sign-up and email
- Automatically from your browser, through Google Analytics and the site itself when you visit and click
How We Process It
Form messages and newsletter sign-ups are stored in our website database, which is hosted by Cloudflare, and contact messages are also emailed to our organization inbox. Access is limited to the people who answer messages for the Foundation and the people who maintain our website. Health-page visits are kept in Google Analytics without the condition, and some actions are also counted in Google Ads; we view both in grouped reports. We keep data secure with encrypted connections and access controls.
Who We Share It With
We share consumer health data only with the service providers below, which handle it to run our site and inbox. We have no affiliates.
- Google (Google Analytics): receives health-page visits, without the condition, and the actions described above
- Google (Google Ads): receives registry-link clicks and newsletter sign-ups recorded by Google Analytics, including those made on health pages, to measure our ads
- Cloudflare: hosts our site and database and protects our forms from bots, so everything sent through the site passes through it, including form messages
- Resend: delivers contact-form messages, including their text, to our inbox
- Google (Google Workspace): hosts our organization email, so it holds form messages and any email you send us
- NerdBrainz: our website and advertising contractor, which maintains the site and its database and manages our Google Analytics and Google Ads accounts
We may also disclose information when the law requires it.
Other Companies on Our Pages
Google Analytics uses an identifier in your browser, and Google may collect information about your activity over time and across other websites and online services that use Google's tools.
The Meta (Facebook) Pixel may run on other parts of our site, as described in our Cookie & Analytics Notice. It never runs on our health pages.
Our donation partner Givebutter provides the code behind our donate buttons, and that code loads on every page, including health pages, so a donation form can open. If you donate, Givebutter handles your donation under its own privacy policy. When its code loads, Givebutter receives your IP address, your browser details and our web address.
Consent and Your Choices
On our health pages:
- The Meta Pixel does not run.
- Google ad personalization is switched off and we do not send Google ad user data.
- If you send a form or join our newsletter from a health page, we do not pass your email address to Google.
- When you follow a link away from a health page, your browser tells the next site only our web address, not the page you were reading.
Google Analytics follows your cookie choices. In the European Economic Area, the United Kingdom and Switzerland, analytics cookies stay off until you allow them. Everywhere else, including Washington and Nevada, they are on unless you turn them off; on health pages, Google Analytics is not told which condition a page is about. When analytics cookies are off, Google's tag still loads and can send limited signals without cookies, such as the general page address and title, your browser type and screen size, and how far you scroll. Registry-link clicks are sent to Google Analytics only after you have made an analytics choice that allows it.
You can change your choices at any time:
Before we collect or share a new category of consumer health data, share it with a new kind of recipient, or use it for a new purpose, we will update this policy and ask for your consent first.
Your Rights
If you live in Washington or Nevada, or your consumer health data was collected there, you have the right to:
- Know and access: confirm whether we collect, share or sell consumer health data about you, get a copy of it, and get a list of every third party we have shared it with, with a way to contact each one
- Withdraw consent and stop: withdraw your consent and ask us to stop collecting or sharing consumer health data about you
- Delete: have consumer health data about you deleted. We will also tell the service providers we shared it with to delete it
- Correct: ask us to review and correct information you gave us
Requests are free, including at least two a year. If requests are clearly unfounded, excessive or repetitive, we may charge a reasonable fee or decline them. You do not need an account.
How to Make a Request
Contact us in any of these ways:
- Email contact@jadabascomfoundation.org with the subject "Consumer health data request"
- Use our contact form (please leave out web addresses)
- Write to Jada Bascom Foundation, PO Box 1027, Deer Park, WA 99006
Tell us what you would like us to do, the email address you used with us, and your state. To protect you, we confirm requests by replying to the email address linked to the information or, if you write to us by mail, by writing back to the address you give. If we cannot confirm who you are, we may ask for a little more information.
We respond without undue delay and within 45 days. If we need more time because a request is complex, we may extend that once by up to 45 more days, and we will tell you why within the first 45 days. If you live in Nevada, we delete the data within 30 days of confirming your request. If a copy of your data is held in a backup system, deleting that copy may take longer, but no more than six months.
Information collected by Google Analytics is not tied to your name or email address, so we may need details from your browser, such as your Google Analytics identifier, to find it. You can stop it at any time with Cookie Preferences. Clearing this site's cookies only gives your browser a new Google Analytics identifier; it does not turn Google Analytics off.
How to Appeal
If we decline all or part of your request, you can appeal. Reply to our decision, or email contact@jadabascomfoundation.org with the subject "Consumer health data appeal". Within 45 days of receiving your appeal, we will tell you in writing what we did and why.
If we deny your appeal, you can contact your Attorney General:
Changes to This Policy
When we change this policy, we will post the new version here and update the date at the top. If a change is material, we will also post a notice on our homepage, and we will ask for your consent before any change that needs it.
Contact Us
Questions about this policy or your consumer health data can go to contact@jadabascomfoundation.org.
