Washington Consumer Health Data Privacy Policy

Version 1.0 · November 9, 2026

This policy is for Washington residents, and for anyone whose information is collected in Washington. It is the consumer health data privacy policy that Washington’s My Health My Data Act (RCW 19.373) requires of Osher Mevin, Inc., doing business as Message Domains (“we”). Our Privacy Notice and Biometric Information Policy also apply.

1. The consumer health data we collect

The Act treats biometric data as consumer health data. We collect one kind:

• Biometric data from the own-name check. When you ask to lease a label that is your own legal name (Terms of Service, section 5.3(b)), Stripe Identity, our processor, photographs your government ID, takes a live selfie and measures the geometry of the two faces to compare them.

We collect no other consumer health data. We do not collect information about your physical or mental health, health care, conditions, medications, reproductive or sexual health, or precise location.

2. Why we collect it

Only to confirm that the person taking the selfie is the person on the ID, so that only the person whose legal name a label is can lease it. We collect it only after you give your consent by ticking a box before the check starts.

3. Where it comes from

From you, through the camera of your device, during the check. Stripe collects it for us.

4. Who it is shared with

We do not share or sell consumer health data. The only party that handles it is Stripe, Inc., as our processor, under a contract that limits its use to performing the check for us. We have no affiliates that receive it.

Stripe deletes the data at our request as soon as the check is done (within 7 days of our request; see section 6 of the Biometric Information Policy). We never receive or keep it ourselves.

5. Your rights

You have the right to:

• confirm whether we collect, share or sell your consumer health data;
• get a copy of it, and a list of every third party and affiliate it was shared with, with their contact information;
• withdraw your consent to its collection and sharing; and
• have it deleted, including by our processor.

To use these rights, write to privacy@messagedomains.us with the subject “Washington health data”, from the email address on your account if you have one. We will verify your request through that email address. You can also have an authorized agent act for you with your written permission. We respond within 45 days, and if we need up to 45 more days we tell you why within the first 45. We do not charge for responses, unless requests from the same person are manifestly unfounded or excessive, or more than two in a year.

If you withdraw consent, we will not start a new own-name check for you, and we ask Stripe to delete any data from earlier checks that remains.

6. Appeals

If we decline to act on your request, you can appeal by replying to our answer with the subject “Appeal”. We decide within 45 days and tell you in writing what we did and why. If we deny your appeal, you can complain to the Washington State Attorney General at atg.wa.gov/file-complaint.

7. No discrimination

We will not treat you differently for using these rights. The own-name lease needs the check, so without it we cannot offer that lease; everything else on the service stays available to you.

8. Changes

We post changes here with a new version and date. A change that would let us collect, use or share consumer health data in a new way would take effect only after you give a new consent.

9. Contact

privacy@messagedomains.us · Osher Mevin, Inc., 16192 Coastal Highway, Lewes, Delaware 19958