Consumer health data privacy policy

Health information can be inside a document you fax. This explains how we handle it, as Washington’s My Health My Data Act and similar laws ask us to.

Last updated 17 October 2026. Published by Sellframe Ltd (company number SC472357), trading as Fax Anything.

What this covers

Fax Anything does not ask you for health information. But people fax prescriptions, referrals, test results and insurance forms, so a document you send may contain some. The Washington My Health My Data Act applies to businesses that serve people in Washington, and Nevada and Connecticut have similar rules. We follow the same protections for everyone.

What we collect, and why

  • The document you send, which may contain health information. We collect it only because you asked us to fax it, and use it only to send that fax: to build the pages, show you a preview, deliver it, and answer questions about it.
  • The number and name you send it to. If that is a clinic or a pharmacy, it can say something about your health. We treat it as part of the same fax.
  • The record that the fax was sent (number, pages, status and time), which we keep for 12 months for billing and disputes.

We never use health information for advertising, for profiling, for training any system, or for anything other than your fax.

Where it comes from

From you. You choose the document, or an AI assistant passes on text you asked it to write. We do not collect health information from anyone else.

Who it is shared with

These are the categories of recipients. We share health information with no one else.

  • The fax carrier. It receives the document and the number, because it cannot deliver the fax without them.
  • Our hosting provider. It stores your document for us, encrypted, until it is deleted.
  • Stripe, our payment processor. It does not receive the document. It receives the amount and a description that can include the number faxed.
  • Our email provider. It does not receive the document. The delivery email names the number, the pages and the time.

We do not share it with any other business, including other products run by the company that operates Fax Anything. We do not sell consumer health data. To get the specific list of providers, with an email address for each, ask at privacy@faxanything.com.

Your consent

Before every fax, you tick a box that says the fax may contain health information, that we share it with the fax carrier, that we use it only to send the fax, and that we delete it within 24 hours of the final status. That is your consent. You can take it back by asking us to delete your data.

How long we keep it

We delete your document within 24 hours of the fax’s final status, delivered or not. It is stored encrypted until then. Server backups are kept for up to four weeks and are then overwritten, so a copy can remain in a backup for that long. We do not restore from a backup except after a failure, and we delete from it again if we do.

Your rights

You have the right to:

  • ask whether we collect, share or sell your consumer health data, and get a copy of it;
  • get a list of the third parties and affiliates we have shared it with, and an email address for each;
  • take back your consent;
  • ask us to delete it, including from backups, and to tell the providers who hold it to delete it too.

How to ask: use delete my data, or write to privacy@faxanything.com. We answer within 45 days of receiving your request. If we reasonably need more time, we may extend that once, by up to 45 more days, and we will tell you why within the first 45.

If you disagree with our answer

You can appeal. Reply to our answer, or write to privacy@faxanything.com with the word “appeal” in the subject. We reply in writing within 45 days of receiving your appeal and explain our reasons. If we turn down your appeal, you can complain to the Washington State Attorney General. The Attorney General explains how at atg.wa.gov.

No sale, no location tracking

We do not sell consumer health data. We do not use geofencing (a virtual boundary of 2,000 feet or less around a place that provides in-person health care) to identify or track you, to collect health information, or to send you messages or adverts.

Not for HIPAA-covered organizations (yet)

Organizations covered by the US HIPAA rules, and their business associates, should not send protected health information with Fax Anything until we offer the agreement they would need. See the acceptable use policy. This policy sits alongside our privacy policy.