Consumer Health Data Privacy Policy

Effective March 31, 2024

Scope of this Consumer Health Data Privacy Policy

This is the Consumer Health Data Privacy Policy (“CHD Privacy Policy”) of Xanterra Leisure Holding, LLC, along with its subsidiary companies listed in our primary Privacy Policy (collectively “Xanterra,” “us,” “our,” or “we”). This CHD Privacy Policy supplements our primary Privacy Policy, and describes our practices with regard to Consumer Health Data, which is defined by applicable laws as personal information linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status. Any capitalized terms not defined in this CHD Privacy Policy have the meanings defined in our Privacy Policy.

Categories of Consumer Health Data We Collect

Depending on the ways in which you interact with us, we may collect the following categories of Consumer Health Data:

• Individual health conditions, treatment, diseases or diagnoses (such as information you may provide regarding allergies, physical conditions or limitations, injuries, etc.);
• Social, psychological, behavioral, and medical interventions (such as treatments or accommodations you may need to receive while staying at or visiting our properties, or you have received in the past);
• Health-related surgeries or procedures (such as your vaccinations previously received, or surgeries which may impact your activities while visiting us);
• Use or purchase of medication;
• Bodily functions, vital signs, symptoms, or related measurements (such as your temperature or signs of illness);
• Diagnoses or diagnostic testing, treatment, or medication (such as COVID-19 testing or first-aid administration);
• Precise location information that could reasonably indicate a consumer’s attempt to acquire or receive health services or supplies;
• Data that identifies a consumer seeking “health care services” as defined under applicable law; and
• Any inferences of the above categories of health data derived or extrapolated from non-health information.

How We Use Consumer Health Data

We may use the above categories of Consumer Health Data for any of the following purposes, which are described in greater detail within our Privacy Policy:

• To fulfill your requests and provide services to you when you visit our properties, travel with us, sign up for activities with us or third party providers with whom we collaborate, or otherwise;
• As required (by us or by various laws, regulations, or local authorities) in order to book or embark on some of our offerings, visit certain properties we manage, or visit certain locations at which our cruise ships or tours may stop;
• To respond to your inquiries about our ability to meet your needs, including as related to various health conditions or treatment during your booking or activities;
• In connection with customer support matters or to establish, exercise, or defend legal claims;
• As part of a consumer account you may create with us, which may be added to your customer profile for the Xanterra companies;
• As needed to protect the health, safety, and vital interests of our personnel, guests, and the public, including as related to public interest grounds;
• In connection with our response to health-related incidents that may have taken place at properties or while traveling with companies operated by Xanterra;
• In connection with our legal obligations and as may be related to the establishment and defense of legal claims; and
• As otherwise necessary for our Business Purposes or Commercial Purposes as described in our Privacy Policy.

Sources of Consumer Health Data We Collect

We collect Consumer Health Data from various sources, which include the following (please see our Privacy Policy for further details):

Data you provide us (e.g. if you notify us that you have allergies, a specific health condition, or require specific accommodations due to a physical or mental health diagnosis);

Data we collect automatically (e.g. certain data relating to your location while participating in a health-related activity may be automatically collected by one of our mobile apps or otherwise);

Service Providers & Agents (e.g. travel agents and others may provide us with Consumer Health Data regarding you);

Data we create or infer (e.g. we may make inferences based on certain information you provide to us, and we may add this to your booking record or profile).

Sharing of Consumer Health Data

Categories of Consumer Health Data We Share

Depending on the nature of your interactions with us, we may share any of the above categories of Consumer Health Data with third parties (such as service providers, partners, successor entities, and lawful recipients) and our affiliates, as further described below.

Categories of Third Parties with Whom We Share

We may share Consumer Health Data with the following categories of third-party recipients: Service Providers; Partners & Excursions; Successors; Lawful Recipients. For a thorough description of the circumstances in which we share with each of these third parties, please review our Privacy Policy. In addition, we use third party service providers to store and otherwise process all CHD collected when we provide healthcare services at clinics on our ships, and those third parties manage and have direct access to such data.

Specific Affiliates with Whom We Share

Although we do not typically share Consumer Health Data outside of the Xanterra entity to which it was provided, in certain circumstances, we may share Consumer Health Data with the following Xanterra Affiliates: Xanterra Holding Corporation; Xanterra Leisure Resort Holding, LLC; Xanterra Parks & Resorts, Inc.; Xanterra South Rim, L.L.C.; GCR Acquisitions, LLC; Grand Canyon Railway, LLC; Grand Canyon Railway Hotel, LLC; Xanterra Tusayan, LLC; Xanterra Cedar Creek, LLC; Xanterra Adventure Companies, LLC; Holiday Vacations, LLC; Xanterra Cruise, LLC; Otago France; Windstar Cruises Marshall Islands, LLC; and Windstar Cruises, LLC.

Consumer Health Data Rights

Your Rights

Under various state health privacy laws, residents of certain states, or natural persons whose Consumer Health Data is collected in certain states, may have certain data rights, subject to verification, exceptions, and limitations:

Right to Confirm/Access/Know including the right to: (a) confirm whether we are collecting, sharing, or selling your Consumer Health Data, and (b) access such data, including a list of all third parties and affiliates with whom we have shared or sold the Consumer Health Data and an active email address or other online mechanism that you may use to contact these third parties.

Right to Delete the Consumer Health Data held by us and our affiliates, processors, contractors, and other third parties.

Right to Withdraw Your Consent/Opt-Out including the right to withdraw any consent you have provided regarding our collection and sharing of Consumer Health Data.

Right to Non-Discrimination as a result of your exercise of these data rights.

How to Exercise Your Rights

You may exercise your rights under Washington My Health My Data Act by emailing datarequests@xanterra.com. If you have any questions or wish to appeal any refusal to take action in response to a rights request, contact us at datarequests@xanterra.com. We will respond to any request to appeal within the period required by law