CA AB2935

Prohibits operators of commercial health monitoring programs from sharing, selling, or disclosing individually identifiable health monitoring information to third parties without clear notice and affirmative consumer consent.

Requires consent requests to be separate from other agreements, identify the third party and purpose, and allow consumers to refuse without losing access to core program features.

Mandates that operators delete or provide consumers access to their individually identifiable health monitoring information upon request, with reasonable administrative charges permitted.

Requires operators to maintain, store, and delete health monitoring information in a manner that preserves security and confidentiality.

Exempts entities subject to federal HIPAA or California's Confidentiality of Medical Information Act from these requirements.