Washington My Health My Data Act

Consumer Health Data Privacy Policy

Draft 1 · October 11, 2026

Every direct booking includes a quick ID check: a photo of your ID and a live selfie that Stripe compares to it. Washington law treats that face comparison as consumer health data. Here's what happens, who handles it, how long it's kept and what you can ask of us.

1. Who this covers

This policy is from Virtually LLC, which operates The Junction Retreat in West Seattle (Seattle short-term rental operator license STR-OPLI-26-005482). "We" and "the hosts" mean Virtually LLC and the two hosts who run the house.

It covers consumer health data as Washington's My Health My Data Act defines it, and it is also our notice under Washington's law on biometric identifiers. Our Privacy Policy covers everything else.

2. What we collect

The ID check's face comparison

• When you book direct, Stripe Identity asks you to photograph your government ID (a driver's license, passport or ID card) and take a live selfie. Stripe compares your face in the selfie with the photo on your ID. That comparison uses measurements of your face, which Washington law treats as biometric data.
• Stripe does this for us. We never receive the photos, the face measurements, or the details printed on your ID.
• From Stripe we receive only: whether the check passed, whether the name on the ID matches the name on the booking, Stripe's reference for the check, the times, and how many tries it took. The name on the ID is compared and then dropped; we don't keep it.
• If Stripe reports that a selfie or ID was altered, we also note that against the booking's email and phone number for 30 days.
• The hosts can open a check in Stripe's dashboard when they need to resolve a problem with a booking, such as a name that differs. They don't download or copy it.

CHD-1, for legal review: does the hosts' ability to view a check in Stripe count as us collecting or accessing biometric data? Should the hosts commit never to open the photos?

Health-related things you choose to tell us

• Sometimes a guest tells us something that relates to health, such as that a service animal is coming, or an accessibility or allergy need.
• We ask no questions about it. We note only what we need to set up your stay, in a message for the hosts (for a service animal, just "service animal"). It goes only to the hosts.
• The booking form on this website doesn't ask about service animals or health at all.

CHD-2, for legal review: is a note like "service animal", or a guest's own mention of an accessibility or allergy need, consumer health data under the Act? If not, this part can go.

What we don't collect

We don't collect health records, data from health apps or devices, your precise location, or guesses about your health. We don't use location fences of any kind.

3. Why we collect it, and how it's used

• The ID check: to confirm that the person booking is who they say they are and is one of the adults staying, to prevent fraud such as bookings with stolen cards, and to protect the house and our neighbors.
• It's part of every direct booking, so we can't take a direct booking without it.
• Things you tell us: only to set up your stay the way you asked.
• We never use consumer health data for marketing, advertising, profiling or pricing, and we never sell it.

4. Where it comes from

• From you: the photos you take on Stripe's pages, and anything you tell us by phone, email or our forms.
• From Stripe: the result of the comparison.

5. Who it's shared with

• We have no affiliates that receive this data. We don't sell it, or share it for any purpose of the companies above.
• We would share it otherwise only if the law requires it.
• Stripe explains how it handles ID-check data in its own privacy policy, at stripe.com/privacy.

CHD-3, for legal review: confirm Stripe acts only as our processor for the ID check under its terms (and whether Stripe's own uses, if any, need separate consent); whether the phone service, the database host and email count as processors here; and the exact list and contact details the Act requires.

CHD-4, placeholder: the hosts to confirm Virtually LLC has no affiliates that receive guest data.

6. Your consent

We ask before the ID check, separately from anything else, and only for the check itself.

• On the phone, your yes is recorded on the call. Stripe then shows its own consent screen before you take any photos.
• You can say no. We'll gladly take a message for the hosts instead, but a direct booking needs the ID check.
• You can stop at any point before the check is finished. The booking then doesn't go ahead, and nothing is charged.
• After the check, you can withdraw your consent and ask us to delete the data (section 8).

CHD-5, for legal review: is the website box the right form of consent, and is a recorded spoken yes valid? Is the check "necessary to provide" a booking the guest asked for, and does sharing it with Stripe need a separate consent?

7. How long it's kept

• We never store biometric data ourselves.
• Stripe keeps the ID photos, the selfie and the comparison for the period set in our Stripe account, and no longer than it needs to. CHD-6: the period to add, once the hosts choose the shortest one Stripe allows.
• Our record of the result (passed or not, name match, Stripe's reference, times, tries) stays with the booking record. The name, email and phone on that record are removed 180 days after checkout, or 30 days after a booking that never went ahead.
• A note that a selfie or ID was altered lasts 30 days.
• A message for the hosts that notes a service animal is kept only as long as our phone service keeps call recordings and messages (our Privacy Policy, section 5).

8. Your rights

If you're a Washington consumer, or your data was collected in Washington, you can:

• ask whether we collect, share or sell your consumer health data, and get a copy of it;
• get a list of every company we've shared it with, and how to contact them;
• withdraw your consent;
• ask us to delete it. We delete our records and tell Stripe, and anyone else we shared it with, to delete theirs;
• appeal if we turn down your request.

How to ask

• Email stay@junctionretreat.com with "Health data request" in the subject.
• We check it's you by replying to the email on your booking. We never ask for ID photos to do this.
• There's no charge. We answer within 45 days. If we need more time, we tell you why, and the extra time is never more than another 45 days.
• If we turn down your request, reply with "Appeal". We answer your appeal in writing within 45 days and explain our decision. If we deny it, you can contact the Washington State Attorney General's Office (atg.wa.gov).
• We won't treat you differently for using these rights.

CHD-7, for legal review: when a deletion request arrives while a payment dispute is possible, may we keep the pass or fail result? And how should we handle a request to delete the Stripe data before Stripe's own retention ends?

9. Washington biometric notice

• We don't put biometric identifiers into any database of our own. Stripe performs the face comparison for us.
• It's used only to verify identity and prevent fraud, never for marketing.
• We don't sell, lease or disclose it, other than to Stripe to run the check.
• We tell you about it and ask your consent before the check (section 6).
• It's kept no longer than needed to prevent fraud, meet the law and provide your booking (section 7).

CHD-8, for legal review: does the biometric law apply to us at all (is this "enrolling" a biometric identifier for a commercial purpose, or a security purpose)? Does it limit how long Stripe may keep the data on our account?

10. Contact and changes

Virtually LLC, The Junction Retreat, Seattle, Washington. Email stay@junctionretreat.com.

When we change this policy, we post the new version here with its date. We'll ask for your consent again before using consumer health data in any new way.

CHD-9, placeholder: the effective date, and confirmation of the contact email.