My Body, My Data Act of 2025

Data Minimization: Regulated entities are prohibited from collecting, retaining, using, or disclosing health information unless it is strictly necessary for the product or service requested by the individual (Section 2(a)). This limits the unnecessary spread of sensitive data.

Employee Access Control: Entities must restrict employee access to this information to only those who need it to provide the requested service (Section 2(b)).

Individual Control over Information: The bill provides individuals with the specific rights to access, correct, and delete their personal reproductive or sexual health information (Section 3). This includes information collected from third parties or even information that was inferred (Section 3(a-c)).

Transparent Privacy Policies: Companies must maintain and prominently publish a clear privacy policy that describes their data practices, the categories of information collected, and the third parties involved (Section 4).

Protection Against Retaliation: The Act prevents regulated entities from retaliating against people for exercising their rights, such as by denying goods or services or charging different prices (Section 5).

Legal Recourse: Individuals have the right to bring civil actions for violations, which can include compensation for damages and attorney's fees (Section 6(b)).

Restrictions on Information Retention: The bill states that a regulated entity is not required to collect or retain personal information it would otherwise not collect or retain (Section 3(d)(2)). While this is a minimization rule, it establishes a limit on the data an entity must hold.

Regulatory Burden on Entities: Regulated entities are required to establish "reasonable mechanisms" to handle access, correction, and deletion requests within a 15-day timeline (Section 3(d)(2)).