Consumer Health Data Privacy Policy

Who This Policy Covers: Boards by Erica, LLC (“Company,” “we,” “our,” or “us”) operates under the brands Boards by Erica and Dining by Erica. This policy describes our handling of consumer health data under Washington’s My Health My Data Act in connection with food-accommodation requests for our products, catering, private dining, and private classes and workshops.

Categories We Collect & Why: We collect allergies, food sensitivities, health-related dietary restrictions, and related accommodation instructions that you or an authorized person provide to us. This may include a health condition voluntarily identified to explain a food requirement. When linked or reasonably linkable to you, this information and its associated contact, booking, and meal-service identifiers may be consumer health data. We use it to evaluate an accommodation, plan menus, prepare and serve food, coordinate the requested accommodation, and communicate with you about what we can provide. Please provide only information needed for that purpose, not medical records or unrelated medical history. We do not use this information for targeted advertising or sell it. Where possible, describe the accommodation and meal count without identifying a guest. Information may still be consumer health data if the booking or other details make the individual reasonably identifiable.

Sources of Consumer Health Data: We receive information directly from clients, guests, and participants through inquiries, booking forms, emails, texts, calls, and event communications. We may also receive it from an authorized parent, guardian, representative, or event organizer coordinating an accommodation. Our inquiry, booking, communication, and record-storage providers may receive and transmit that information on our behalf. When individual identification is necessary, we may request confirmation directly from the affected person or their legally authorized representative.

Collection & Sharing Choices: We collect or share consumer health data with the consent required by law or to the extent necessary to provide a product or service requested by the individual to whom the information relates. Where consent is required, we obtain it before collection or sharing and obtain separate consent for sharing. A request for consent identifies the information, purpose, recipient categories, and withdrawal method. Accepting general terms, signing an event contract, or acknowledging this policy does not replace required consent. We will obtain the required affirmative consent before collecting, using, or sharing additional categories of consumer health data or using it for additional purposes not disclosed here.

Categories Shared & Recipients: The information disclosed is limited to relevant allergies, sensitivities, health-related dietary requirements, accommodation instructions, and identifiers needed to connect those requirements to the requested service. People working on the booking may access it as needed to plan, prepare, deliver, or serve the food. Categories of third-party recipients may include independent culinary or event-service contractors and delivery providers involved in fulfilling the requested accommodation. Any sharing with these recipients follows the consent or necessary-service rules described above. We may disclose information to public authorities or other recipients only where a specific legal requirement or an applicable exception permits it.

Providers & Affiliates: Providers supporting website hosting, inquiry and booking management, email and communications, document and record storage, and workflow automation may process consumer health data on our behalf under required contractual instructions and safeguards. Qualifying processor disclosures are treated differently from third-party sharing under the Act. We do not share consumer health data with separate affiliated companies. Boards by Erica and Dining by Erica are brands of the same LLC, not separate recipients.

Retention & Safeguards: We limit access to consumer health data to people who need it for the disclosed purposes and maintain reasonable administrative, technical, and physical safeguards appropriate to the information. We retain it only as reasonably necessary for those purposes or as specifically permitted or required by law, and delete or de-identify it when no longer needed. Any retention exception is limited by applicable law and does not override the deletion rights described below. We do not authorize allergy details, health-related accommodation information, or identifiers linked to that information to be included in advertising or advertising-measurement data.

Your Rights & How to Submit a Request: You may ask whether we collect, share, or sell your consumer health data; request access to it, including a list of third parties and affiliates with whom we have shared it and their contact methods; withdraw consent to collection or sharing; or request deletion. Email info@boardsbyerica.com or info@diningbyerica.com, describe your request, and provide enough contact or booking information for us to locate the relevant records. Please do not send unnecessary medical information. We may request information reasonably necessary to verify your identity or a representative’s authority. You do not need to create a new account. Cancellation of a booking does not waive these rights. We will not unlawfully discriminate against you for exercising them.

Response & Deletion Process: We respond without undue delay and within 45 days after receiving a request. When reasonably necessary, we may extend that period once by up to 45 additional days and will explain the reason within the initial period. We provide information in response to requests free of charge up to twice annually; any fee or refusal for manifestly unfounded, excessive, or repetitive requests will comply with the Act. If we cannot authenticate a request, we will explain what additional verification is needed. For authenticated deletion requests, we delete covered information from our records and notify relevant affiliates, processors, contractors, and other recipients so they can honor the request. Deletion from archived or backup systems may be delayed only as allowed by law and for no more than six months after authentication. Any exception will be limited to what applicable law permits.

Appealing a Decision: If we decline to act on your request, you may appeal by replying to our decision or emailing either address above with “Privacy Appeal” in the subject line. Explain the decision you are appealing. We will provide a written decision and explanation within 45 days after receiving the appeal. If we deny the appeal, we will also provide a way to submit a complaint to the Washington Attorney General: https://www.atg.wa.gov/file-complaint.

Last Updated: November 7, 2026