WASHINGTON MY HEALTH MY DATA ACT PRIVACY NOTICE
Last Modified March 13, 2026
OVERVIEW
RLI Insurance Company, and its subsidiaries and affiliates (together, “RLI”) value your privacy. This Washington My Health My Data Act Privacy Notice (“MHMDA Notice”) explains how RLI collects, uses, and shares Consumer Health Data under the Washington MyHealth My Data Act (“MHMDA”).
WHO DOES THIS MHMDA NOTICE APPLY TO?
This MHMDA Notice applies to “Consumers”, meaning: 1) a natural person acting in an individual or household context who is a Washington resident; or 2) a natural person acting in an individual or household context whose consumer health data was collected in Washington.
WHAT IS CONSUMER HEALTH DATA?
Under the MHMDA, “Consumer Health Data” is any information that is or can reasonably be linked to a Consumer and that identifies the Consumer’s past, present, or future physical or mental health status.
Consumer Health Data may also be protected by other laws such as the Gramm-Leach-Bliley Act (“GLBA”), the Health Insurance Portability and Accountability Act (“HIPAA”), and the Fair Credit Reporting Act (“FCRA”). The MHMDA does not apply to Consumer Health Data that is protected by these and other privacy laws. To learn more about RLI’s privacy practices under these and other laws, visit https://www.rlicorp.com/rli-privacy-policy.
WHAT CONSUMER HEALTH DATA DOES RLI COLLECT?
RLI may collect Consumer Health Data in connection with claims related to RLI insurance products. RLI may collect Consumer Health Data such as:
HOW DOES RLI USE CONSMER HEALTH DATA?
RLI may use Consumer Health Data to:
HOW DOES RLI SHARE CONSUMER HEALTH DATA?
RLI may disclose Consumer Health Data to its affiliates and subsidiaries, which are: RLI Corp., Mt. Hawley Insurance Company, Contractors Bonding and Insurance Company, RLI Underwriting Services, Inc., SafeFleet Insurance Services, Inc., and Data and Staff Service Co. RLI may also disclose Consumer Health Data to third party service providers, or as otherwise required or permitted by law.
DOES RLI SELL CONSUMER HEALTH DATA?
RLI does not sell Consumer Health Data.
WHATRIGHTS DO CONSUMERS HAVE UNDER THE MHMDA?
Consumers covered by the MHMDA have the following privacy rights, subject to certain limitations. Information covered by other privacy laws such as GLBA, HIPAA, and FCRA is exempted from the following MHMDA privacy rights.
I. Right to Know
Under the MHMDA, you have the right to know what Consumer Health Data RLI has collected from you, and whether RLI has shared or sold that Consumer Health Data to unaffiliated third parties or affiliates. To the extent RLI has shared or sold Consumer Health Data to unaffiliated third parties or affiliates, you have the right to receive contact information for these third parties or affiliates, such as an active email address or other means of contacting them online.
II. Right to Delete
Under the MHMDA, you have the right to request deletion of your Consumer Health Data that RLI has collected and is maintaining. Please note that there may be instances in which RLI is required by other laws, such as GLBA, to retain your Consumer Health Data.
HOW CAN I EXERCISE MY RIGHTS?
You may submit a request under the MHMDA by one of the following methods:
Upon receipt, RLI will acknowledge your request, and may ask for additional information from you in order to verify your identity and authenticate your request. RLI will respond to your request in writing within 45 days of receiving your request. Where reasonably necessary, RLI may extend the response period by an additional 45 days. If RLI refuses to take action on an MHMDA request, you may submit an appeal by contacting us via the phone or email listed above. RLI will respond to any appeal in writing within 45 days of receipt and will explain the reason(s) forits decision.
