Jumio Washington State Consumer Health Privacy Notice

Legal Rights & Agreement Rules · Context

Notice applies only to people protected by Washington’s MHMD

This notice describes how Jumio Corporation handles data that may qualify as Consumer Health Data under Washington’s My Health, My Data Act (MHMD), and it says the policy applies only to individuals who are protected by MHMD. It is dated “Last Updated: March 31, 2024”. The notice does not describe practices for people outside MHMD’s protection, and “may qualify” leaves open which data actually counts as Consumer Health Data.

Supporting quotations

Washington State Consumer Health Privacy Notice

Last Updated: March 31, 2024

This Consumer Health Privacy Notice (“Notice”) describes the privacy practices of Jumio Corporation

This policy applies only to individuals who are protected by MHMD.

Qualifications & exceptions

• The scope sentence limits the whole notice to individuals protected by MHMD.
• The data description is hedged: data “may qualify” as Consumer Health Data.

Not stated here

• Whether a particular person is protected by MHMD depends on that statute; the notice does not define who is protected.

Data Access & Collection · Context

Three linked Jumio notices cover other collected information

For information beyond this notice, Jumio points readers to three separately linked notices: the Online Services Privacy Notice for Jumio Online Services, the Website Privacy Notice for Jumio’s websites and customer portals, and the Jumio Showcase Privacy Notice for the Showcase application. This source contains only that pointer: it does not reproduce the linked notices, and their terms are therefore not described here.

Supporting quotations

For further information about the additional information we collect, please see the the following notices (1) Online Services Privacy Notice for information collected in connection with Jumio Online Services, (2) Website Privacy Notice for information collected in connection with Jumio’s websites and customer portals, and (3) Jumio Showcase Privacy Notice for information collected in connection with the Jumio Showcase application.

Qualifications & exceptions

• The pointer separates online services, websites and customer portals, and the Showcase application, without saying what each notice adds.

Not stated here

• The Online Services, Website and Jumio Showcase privacy notices are separately linked; their text is not supplied in this source, so their additional collection practices cannot be described here.

Data Access & Collection · Company practice

Facial scans and ID photos may be collected as health data

Jumio may collect biometric data — which the notice says may be considered Consumer Health Data — using facial recognition or similar technology. The inputs it names are an image such as a selfie, video including audio, and an image of your face as it appears on an identification document you provide. Both “may” words belong to the notice: collection is possible rather than assured, and the data may or may not fall within Consumer Health Data.

Supporting quotations

Jumio may collect biometric data, which may be considered Consumer Health Data, via facial recognition or similar technology from an image (e.g., a selfie) or video (including audio) and from an image of your face as it appears on an identification document that you provide.

Qualifications & exceptions

• Collection is described as possible (“may collect”), not as something that happens in every verification.
• The biometric data “may be considered” Consumer Health Data; the notice does not assert that it always is.

Not stated here

• The notice does not say when facial recognition is used instead of another method, nor how long images or biometric data are kept.

Use & Processing · Company practice

Health data is collected to provide the verification you requested

Any Consumer Health Data Jumio collects is collected for the purpose of providing the verification and related online services the person requested, naming Authentication, Document Verification, ID Verification and Identity Verification as the “Services”. That list is introduced with “including but not limited to”, so it is not exhaustive. The notice states its security, fraud and illegal-activity uses separately from this purpose sentence.

Supporting quotations

Any Consumer Health Data collected by Jumio is collected for the purpose of providing the verification and related online services requested by you, including but not limited to Authentication, Document Verification, ID Verification, and Identity Verification (the “Services”). Providing the Services may entail:

Qualifications & exceptions

• “Including but not limited to” leaves the named services non-exhaustive.
• The purpose is tied to services the person requested.

Not stated here

• The notice does not define the named services or say which one applies to a particular verification request.

Use & Processing · Procedure

Verifying identity and blocking fraudulent documents are listed steps

Providing the Services may entail verifying identity, preventing the use of fraudulent identification documents, and identifying and monitoring fraudulent transactions. The list follows “may entail”, so these are possible steps rather than a description of every verification. A fourth listed step compares new scans with scans Jumio previously collected.

Supporting quotations

Providing the Services may entail:

Verifying identity;

Preventing the use of fraudulent identification documents; and

Identifying and monitoring fraudulent transactions.

Qualifications & exceptions

• “May entail” makes the steps possible, not mandatory in every verification.

Not stated here

• The notice does not say which checks apply to a given service or what happens when a check fails.

Retention & Deletion · Company practice

New ID scans are compared with scans Jumio already holds

Providing the Services may include comparing new scans of identification documents against scans of identification documents Jumio previously collected. The comparison refers to scans Jumio collected earlier; the notice states no retention period, storage location or deletion rule for those earlier scans.

Supporting quotations

Providing the Services may entail:

Comparing new scans of identification documents against scans of identification documents previously collected by Jumio;

Qualifications & exceptions

• The comparison is one of the things providing the Services “may entail”, not a step in every verification.

Not stated here

• The notice does not state how long previously collected scans are kept, where they are stored, or when they are deleted.

Use & Processing · Permission or license

Security, fraud and illegal-activity uses apply “under certain circumstances”

Under certain circumstances Jumio may also use the data to prevent, detect, protect against or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or activity that is illegal under Washington state law or federal law, and to investigate, report or prosecute those responsible. The notice presents these as further permitted uses and does not describe what the circumstances are.

Supporting quotations

Under certain circumstances Jumio may also use this data to prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or activity that is illegal under Washington state law or federal law; or to investigate, report, or prosecute those responsible for any action that is illegal under Washington state law or federal law .

Qualifications & exceptions

• The additional uses are permissions (“may also use”) available “under certain circumstances” that the notice does not enumerate.
• The illegal-activity branch is tied to Washington state law or federal law.

Not stated here

• The notice does not say what the “certain circumstances” are, whether the person is told before this use, or which authorities may receive reports.

Cross-references

• referred to by (model-proposed): Legal advisers, auditors, courts and authorities may receive health data — Disclosures to legal advisers, auditors, courts and public authorities are tied to the circumstances Section 2 describes for security, fraud and illegal-activity uses.

Sharing & Disclosure · Company commitment

Jumio states it does not “sell” Consumer Health Data

Jumio says it does not “sell” any Consumer Health Data. The word appears in quotation marks but is not defined in this notice, so the sentence does not describe every disclosure by itself; the same section goes on to permit disclosures to the business customer and to processors.

Supporting quotations

Jumio does not “sell” any Consumer Health Data. Jumio may disclose Consumer Health Data to the following types of third parties:

Qualifications & exceptions

• The no-sale statement puts “sell” in quotation marks and the notice does not define the term here.

Not stated here

• Whether “sell” carries MHMD’s statutory meaning is not stated in this notice.

Sharing & Disclosure · Permission or license

The business customer behind your verification may receive the data

Jumio may disclose Consumer Health Data to the Jumio business customer(s) with which the person has a relationship and through which they accessed the Services. The notice does not name any customer or say whether that customer’s own privacy terms also govern the data it receives.

Supporting quotations

Jumio does not “sell” any Consumer Health Data. Jumio may disclose Consumer Health Data to the following types of third parties:

The Jumio business customer(s) with which you have a relationship and through which you accessed the Services; and

Qualifications & exceptions

• The recipient is the customer the person has a relationship with and through which the person accessed the Services.

Not stated here

• The notice does not name the business customers or describe the terms under which they handle data they receive.

Sharing & Disclosure · Permission or license

Processors, including cloud providers, help run the Services

Jumio may disclose Consumer Health Data to service providers — also called processors under MHMD — that help it deliver, manage, develop and improve the Services, including third-party cloud service providers. The provider list is non-exhaustive (“including but not limited to”).

Supporting quotations

Jumio does not “sell” any Consumer Health Data. Jumio may disclose Consumer Health Data to the following types of third parties:

Service providers (also known as “processors” under MHMD) that help us deliver, manage, develop, and improve the Services including but not limited to third-party cloud service providers.

Qualifications & exceptions

• “Including but not limited to” leaves the provider categories open.

Not stated here

• The notice does not name the processors, state where they process the data, or say what terms govern them.

Sharing & Disclosure · Permission or license

Legal advisers, auditors, courts and authorities may receive health data

When the circumstances set out in Section 2 apply — security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or activity illegal under Washington or federal law, and related investigation or prosecution — Jumio may disclose Consumer Health Data to legal advisors, to auditors performing audits, and to courts and public authorities. The disclosure rests on that Section 2 trigger, not on a separate standard stated here.

Supporting quotations

Moreover, under certain circumstances as set out in Section 2 (“How we use your Consumer Health Data”) we may disclose your Consumer Health Data with the following categories of recipients:

Legal advisors;

Auditors for the performance of audits; and

Courts and public authorities.

Qualifications & exceptions

• The recipients are introduced as categories tied to the circumstances Section 2 describes.

Not stated here

• The notice does not say what evidence is required before a disclosure to these recipients or whether the person is told about it.

Cross-references

• refers to (model-proposed): Security, fraud and illegal-activity uses apply “under certain circumstances” — Disclosures to legal advisers, auditors, courts and public authorities are tied to the circumstances Section 2 describes for security, fraud and illegal-activity uses.

Legal Rights & Agreement Rules · User right or choice

MHMD rights are exercised by email, with possible identity checks

A person covered by MHMD can exercise any rights described in MHMD, consistent with applicable law and Jumio’s role with respect to their Consumer Health Data, by emailing Jumio; Jumio may ask the person to verify identity before taking further action on a request. The notice gives no response deadline and no review route for a refusal.

Supporting quotations

If you are covered by MHMD, then you can exercise any of the rights described in MHMD consistent with applicable law and our role with respect to your Consumer Health Data by emailing

Please note that we may ask you to verify your identity before taking further action on your request.

Qualifications & exceptions

• The rights are those described in MHMD, exercised consistent with applicable law and Jumio’s role with respect to the data.

Not stated here

• The stored copy masks the email address behind a link-protection wrapper, so the address itself is not readable here.
• The notice does not say how quickly requests are answered or how a refusal can be reviewed.

Legal Rights & Agreement Rules · User right or choice

You can ask whether your health data is collected, shared or sold

Among the rights the notice lists is requesting confirmation of whether Jumio is collecting, sharing or selling the person’s Consumer Health Data. The sentence introducing the list says the rights “may include”, so the list is presented as examples rather than as the complete set of MHMD rights.

Supporting quotations

These rights may include:

Requesting confirmation of whether we are collecting, sharing, or selling your Consumer Health Data; and

Qualifications & exceptions

• “These rights may include” presents the list as non-exhaustive.

Not stated here

• The notice does not say what form the confirmation takes or how the answer distinguishes collecting, sharing and selling.

Legal Rights & Agreement Rules · User right or choice

Deletion can be requested, subject to exceptions the notice leaves open

Subject to certain exceptions prescribed by law, a covered person can request deletion of their Consumer Health Data. The notice does not identify those exceptions or state what data Jumio may keep after a deletion request.

Supporting quotations

Subject to certain exceptions prescribed by law, requesting deletion of your Consumer Health Data.

Qualifications & exceptions

• The deletion right is expressly subject to exceptions prescribed by law.

Not stated here

• The notice does not identify the exceptions prescribed by law or say what data Jumio may retain after a deletion request.

Legal Rights & Agreement Rules · Procedure

Jumio may revise the notice and posts updates on its site

Jumio says technology and the Internet are changing, that it is likely to make changes to the Services, and that it will therefore need to revise this Notice to reflect those changes. Revisions are posted on the MHMD notice page, which readers are advised to review periodically. If a change is material, the notice says users “will be notified appropriately” without naming a channel or timing.

Supporting quotations

Technology and the Internet are rapidly changing.

Jumio therefore is likely to make changes to the Services in the future and as a consequence will need to revise this Notice to reflect those changes.

so we recommend reviewing that page periodically.

If we make a material change to the Notice, you will be notified appropriately.

Qualifications & exceptions

• Notification of material changes is described only as “appropriately”; no channel, timing or acceptance step is stated.

Not stated here

• The notice does not define a material change, name the notification channel, or say whether continued use accepts a revision.

Legal Rights & Agreement Rules · Procedure

Questions about the notice go to Jumio by email or post

Questions or comments about this Notice can be sent by email to Jumio; the stored copy masks that address behind a link-protection wrapper. By post, the notice gives Jumio Corporation, ATTN: Privacy, 100 Mathilda Place, Suite 100, Sunnyvale, CA, 94086, U.S.A.

Supporting quotations

If you have any questions or comments regarding this Notice, please send an email to

If you prefer to contact us by mail, please write to Jumio Corporation, ATTN: Privacy, 100 Mathilda Place, Suite 100, Sunnyvale, CA, 94086, U.S.A.

Qualifications & exceptions

• Two contact routes are given: email and a postal address.

Not stated here

• The email address is obscured in the stored copy, so only the postal address is readable here.