Consumer Health Data Privacy Policy

1.1.  “Consumer.” “Consumer” means a natural person who has requested a product or service from CareVoyage and who resides in Nevada or whose consumer health data is collected in Nevada. The term does not include a natural person acting in an employment context or as an agent of a governmental entity (NRS 603A.425).

1.2.  “Consumer health data.” “Consumer health data” means personally identifiable information that is linked or reasonably capable of being linked to a consumer and that CareVoyage uses to identify the past, present, or future health status of the consumer (NRS 603A.430). The term includes, but is not limited to:

• Information relating to any health condition or status, disease, or diagnosis (NRS 603A.430(1)(a)(1));
• Information relating to social, psychological, behavioral, or medical interventions (NRS 603A.430(1)(a)(2));
• Information relating to surgeries or other health-related procedures (NRS 603A.430(1)(a)(3));
• Information relating to the use or acquisition of medication (NRS 603A.430(1)(a)(4));
• Information relating to bodily functions, vital signs, or symptoms (NRS 603A.430(1)(a)(5));
• Information relating to reproductive or sexual health care (NRS 603A.430(1)(a)(6));
• Information relating to gender-affirming care (NRS 603A.430(1)(a)(7));
• Biometric data or genetic data related to the foregoing (NRS 603A.430(1)(b));
• Precise geolocation information that CareVoyage uses to indicate an attempt by a consumer to receive health care services or products (NRS 603A.430(1)(c));
• Any of the foregoing information that is derived or extrapolated from information that is not consumer health data, including proxy, derivative, inferred, or emergent data derived through an algorithm, machine learning, or any other means (NRS 603A.430(1)(d)).

Consumer health data does not include information used to provide access to or enable gameplay on a video game platform, or information that identifies shopping habits or interests of a consumer if that information is not used to identify the specific past, present, or future health status of the consumer (NRS 603A.430(2)).

1.3.  “Sell.” “Sell” means to exchange consumer health data for money or other valuable consideration, subject to statutory exceptions (NRS 603A.475).

1.4. “Processor.” “Processor” means a person who processes consumer health data on behalf of a regulated entity (NRS 603A.460).

Consumer health data is collected from the following sources (NRS 603A.495(1)(b)):

• Directly from you, when you make a service request, voluntarily share health-related information, or communicate with CareVoyage personnel by telephone, email, or other means.
• From your use of our website (e.g., IP-derived approximate location).
• From medical providers referred by CareVoyage, when they provide medical consultation summaries or coordination-related details in connection with your requested service.
• From Medjet Assist, LLC, when Medjet shares medical evacuation coordination details relating to Platinum Plan members at the member’s request or as required for transport services.
• From CareVoyage’s own operational activities, including audio recordings of communications between you and our personnel that contain health-related information.

4.1.  Categories of Consumer Health Data Shared (NRS 603A.495(1)(c)). We may share the following categories of consumer health data: provider referral data; voluntarily disclosed health information; medical consultation summaries; medical evacuation coordination data (Platinum Plan only); and recorded communications (only to the extent necessary for the specific purpose described below).

4.2.  Third-Party and Affiliate Recipients (NRS 603A.495(1)(d)). The following table identifies the categories of third parties and specific affiliates with whom we share consumer health data:

The purposes for which CareVoyage collects, uses, and shares consumer health data are (NRS 603A.495(1)(e)):

• Coordinating and fulfilling medical provider referrals requested by members.
• Delivering medical consultation summaries to members following Standard Medical Visits.
• Administering medical evacuation and transport services through Medjet under the Platinum Plan.
• Quality control, training, and dispute resolution in connection with recorded communications.
• Supporting our operational infrastructure (payment processing, data hosting, customer relationship management).
• Website functionality and service delivery (IP-derived approximate location).

‍
CareVoyage will not collect, use, or share consumer health data for purposes other than those disclosed in this Policy without first disclosing the additional purposes and obtaining your affirmative, voluntary consent (NRS 603A.495(3)(c)).

CareVoyage processes consumer health data in the following manner (NRS 603A.495(1)(f)):

• Collection: Consumer health data is collected through our website, telephone communications, email, and coordination with medical providers and Medjet. Telephone calls may be recorded.
• Storage: Consumer health data is stored in cloud-based systems maintained by our service processors under binding contractual instructions. Data is protected by administrative, technical, and physical security measures.
• Use: Consumer health data is accessed by authorized CareVoyage personnel and processors only as reasonably necessary to fulfill the purposes described in Section 5 or to provide a product or service you have requested.
• Sharing: Consumer health data is shared with the third parties and affiliates identified in Section 4, only for the purposes identified in this Policy and only to the extent necessary.
• Retention: Consumer health data is retained for the duration of your membership and for a reasonable period thereafter as necessary for legal compliance, dispute resolution, and record-keeping obligations. Upon expiration of any applicable retention period, consumer health data is deleted or de-identified.
• Deletion: Upon a verified deletion request, consumer health data is deleted from our active systems within thirty (30) days, and processors and third parties are notified to delete. Data on archived or backup systems will be deleted when the archived or backup system is next accessed or used (NRS 603A.515).

7.1. Separate Consent Required. CareVoyage will not collect consumer health data without first obtaining your consent, and will not share consumer health data without first obtaining separate consent for such sharing, unless such collection or sharing is necessary to provide a product or service you have requested from us (NRS 603A.500(1)–(2)).

7.2. Consent Disclosures. Each request for your consent—whether for collection or sharing—will clearly and conspicuously disclose (NRS 603A.500(3)):

• The categories of consumer health data to be collected or shared;
• The purpose for collecting or sharing the consumer health data, including the specific ways in which the data will be used;
• The categories of entities with whom the consumer health data may be shared; and
• The manner in which you may withdraw consent for the collection or sharing and request that CareVoyage cease such collection or sharing pursuant to NRS 603A.505.

‍
7.3.  Withdrawal of Consent. You may withdraw consent for collection and/or sharing at any time by contacting us at Privacy@carevoyage.com. Upon receipt of your withdrawal request, we will cease the applicable collection or sharing as soon as commercially practicable (NRS 603A.505(1)(c)).

CareVoyage does not sell consumer health data (NRS 603A.535).
If CareVoyage ever seeks to sell consumer health data, we will first obtain a signed, written authorization from you that is separate and distinct from any consent for collection or sharing. Such authorization will (NRS 603A.535):

• Expire one (1) year from the date of signature;
• Be revocable by the consumer at any time;
• Be provided to you (a copy of the signed authorization will be given to you); and
• Be retained by CareVoyage for at least six (6) years.

CareVoyage will not condition the provision of any goods or services upon your authorization of the sale of your consumer health data (NRS 603A.535).

Nevada consumers have the following rights regarding their consumer health data (NRS 603A.505):

9.1. Right to Confirm. You have the right to request that CareVoyage confirm whether we are collecting, sharing, or selling consumer health data relating to you (NRS 603A.505(1)(a)).

9.2. Right to Obtain List of Third Parties. You have the right to obtain a list of all third parties with whom CareVoyage has shared consumer health data relating to you or to whom CareVoyage has sold such data (NRS 603A.505(1)(b)).

9.3. Right to Withdraw Consent / Cease Collection and Sharing. You have the right to request that CareVoyage cease collecting, sharing, or selling consumer health data relating to you (NRS 603A.505(1)(c)). See Section 7.3 above.

9.4. Right to Deletion. You have the right to request deletion of your consumer health data. Not later than thirty (30) days after we authenticate your deletion request, we will delete all consumer health data described in the request from our records and network and will notify each affiliate, processor, contractor, or other third party with which we have shared your consumer health data of the deletion request (NRS 603A.515(1)). Data stored on archived or backup systems will be deleted when the archived or backup system is next accessed or used (NRS 603A.515(2)).

9.5. How to Exercise Your Rights (NRS 603A.495(1)(g)). To exercise any of the rights described above, submit a request through the following secure mechanism:

‍
Email: Privacy@carevoyage.com

‍
In your request, please identify the specific right(s) you wish to exercise and provide sufficient information for us to verify your identity. We may request additional information reasonably necessary to authenticate your request (NRS 603A.510(2)).

‍
9.6. Response Timeframe.
CareVoyage will respond to your request without undue delay and not later than forty-five (45) days after authenticating the request. If reasonably necessary based on the complexity and number of requests, we may extend this period by not more than an additional forty-five (45) days, provided we notify you of the extension and the reasons therefor within the initial forty-five (45) day period (NRS 603A.510(1)).

‍
If we are unable to authenticate your request after making commercially reasonable efforts, we are not required to comply with the request but may request additional information from you (NRS 603A.510(2)).

‍
9.7. Right to Appeal.
If CareVoyage refuses to take action on your request, you may appeal that decision. To submit an appeal, email Privacy@carevoyage.com with the subject line “Nevada Appeal.” CareVoyage will inform you in writing after receipt of your appeal of any action taken or not taken and the reasons for our decision (NRS 603A.520).

At this time, CareVoyage does not maintain a self-service process for consumers to independently review and request changes to consumer health data collected by CareVoyage. If you believe any consumer health data we hold about you is inaccurate, you may contact us at Privacy@carevoyage.com to request a review and correction. We will evaluate your request and respond in a reasonable timeframe (NRS 603A.495(1)(h)).

CareVoyage will not discriminate against any consumer for exercising any right provided under NRS 603A.400 to 603A.550, inclusive. We will not deny you goods or services, charge you different prices, or provide you a different level or quality of goods or services solely because you exercised your rights under this statute (NRS 603A.545).

CareVoyage does not implement geofences around any facility, person, or entity that provides in-person health care services or products. Specifically, we do not use geofencing technology to identify or track consumers seeking health care services or products, collect consumer health data from consumers, or send notifications, messages, or advertisements to consumers related to their consumer health data or health care services or products near such facilities (NRS 603A.540).

13.1. Access Restrictions. CareVoyage only authorizes employees and processors to access consumer health data where reasonably necessary to: (a) further the purpose for which you consented to the collection or sharing of the consumer health data pursuant to NRS 603A.500; or (b) provide a product or service that you have requested from CareVoyage (NRS 603A.525(1)).

‍
13.2. Security Practices. CareVoyage establishes, implements, and maintains policies and practices for the administrative, technical, and physical security of consumer health data. These policies (NRS 603A.525(2)):

• Satisfy the standard of care in the industry in which CareVoyage operates to protect the confidentiality, integrity, and accessibility of consumer health data (NRS 603A.525(2)(a));
• Comply with the provisions of NRS 603A.010 to 603A.290, inclusive, where applicable (NRS 603A.525(2)(b)); and
• Are reasonable, taking into account the volume and nature of the consumer health data at issue (NRS 603A.525(2)(c)).

14.1. Binding Contracts. CareVoyage requires processors to process consumer health data only pursuant to a contract that sets forth applicable processing instructions and the specific actions the processor is authorized to take with regard to the consumer health data it possesses on our behalf (NRS 603A.530(1)).

14.2. Processor Assistance. To the extent practicable, each processor shall assist CareVoyage in complying with the provisions of NRS 603A.400 to 603A.550, inclusive (NRS 603A.530(2)).

14.3. Processor Exceeding Scope. If a processor processes consumer health data outside the scope of its contract with CareVoyage or in a manner inconsistent with any provision of the contract, the processor shall be deemed a regulated entity for purposes of NRS 603A.400 to 603A.550, inclusive, for actions and omissions with regard to such consumer health data (NRS 603A.530(3)(b)). The processor is not guilty of a deceptive trade practice solely because it violated the processor contract requirements (NRS 603A.530(3)(a)).

CareVoyage may not enter into a processor contract that is inconsistent with this Policy (NRS 603A.495(3)(d)).

CareVoyage does not authorize third parties to collect consumer health data about you over time and across different Internet websites or online services when you use CareVoyage’s website or online services (NRS 603A.495(1)(j)). CareVoyage does not use third-party tracking technologies on its website that would result in the cross-site collection of consumer health data.

If CareVoyage makes material changes to this Policy, we will update the Effective Date above and post the revised Policy with a conspicuous hyperlink on our main website. In addition, we will notify consumers whose consumer health data is collected by CareVoyage of material changes by email to the address on file, or if no email address is on file, by conspicuous notice on our website. If any material changes involve the collection, use, or sharing of additional categories of consumer health data, additional purposes, or additional third-party recipients not previously disclosed, we will obtain your affirmative, voluntary consent before implementing those changes (NRS 603A.495(1)(i), (3)(a)–(c)).

A violation of NRS 603A.400 to 603A.550, inclusive, constitutes a deceptive trade practice for the purposes of NRS 598.0903 to 598.0999, inclusive (NRS 603A.550(1)). The Nevada Attorney General may bring an action to address violations.

NRS 603A.550 does not establish a private right of action against a regulated entity (NRS 603A.550(2)). However, the provisions of NRS 603A.400 to 603A.550 are not exclusive and are in addition to any other remedies provided by law (NRS 603A.550(3)).

A hyperlink to this Consumer Health Data Privacy Policy is posted conspicuously on the main Internet website maintained by CareVoyage, in compliance with NRS 603A.495(2).

CareVoyage Co.
590 Madison Ave, New York, NY, 10022, United States
Privacy@carevoyage.com

© 2026 CareVoyage Co. All rights reserved.

1.1.  “Consumer” means (a) a natural person who is a Washington resident, or (b) a natural person whose consumer health data is collected in Washington (RCW 19.373.010(7)).

1.2.  “Consumer health data” means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status (RCW 19.373.010(8)). This includes, but is not limited to:

• Individual health conditions, status, diseases, or diagnoses;
• Social, psychological, behavioral, and medical interventions;
• Health-related surgeries or procedures;
• Use or purchase of prescribed medication;
• Bodily functions, vital signs, symptoms, or measurements of the foregoing;
• Information about services provided to a consumer by a health care professional, including diagnoses, diagnostic testing, treatment, medications prescribed, and related information;
• Gender-affirming care information;
• Reproductive or sexual health information;
• Biometric data;
• Genetic data;
• Precise location data that could reasonably indicate a consumer’s attempt to acquire or receive health care services;
• Data that identifies a consumer seeking health care services;
• Any information that a regulated entity or its processor processes to associate or identify a consumer with the data described above, including information derived or extrapolated from non-health information (such as proxy, derivative, inferred, emergent, or algorithmic data) (RCW 19.373.010(8)(b)(xiii)).
  

1.3.  “Consent” means a clear affirmative act that signifies a consumer’s freely given, specific, informed, opt-in, voluntary, and unambiguous agreement (RCW 19.373.010(6)(a)). Consent obtained through the use of deceptive designs does not constitute valid consent.

1.4.  “Sale” means the exchange of consumer health data for monetary or other valuable consideration (RCW 19.373.010(25)).

1.5.   “Processor” means a person that processes consumer health data on behalf of a regulated entity or small business (RCW 19.373.010(21)).

Consumer health data is collected from the following sources (RCW 19.373.020(1)(a)(ii)):

• Directly from you, when you make a service request, voluntarily share health-related information, or communicate with CareVoyage personnel by telephone, email, or other means.
• From your use of our website (e.g., IP-derived approximate location).
• From medical providers referred by CareVoyage, when they provide medical consultation summaries or coordination-related details in connection with your requested service.
• From Medjet Assist, LLC, when Medjet shares medical evacuation coordination details relating to Platinum Plan members at the member’s request or as required for transport services.
• From CareVoyage’s own operational activities, including audio recordings of communications between you and our personnel that contain health-related information.

4.1.  Categories of Consumer Health Data Shared (RCW 19.373.020(1)(a)(iii)): We may share the following categories of consumer health data: provider referral data; voluntarily disclosed health information; medical consultation summaries; medical evacuation coordination data; and recorded communications (only to the extent necessary for the specific purpose described below).

4.2.  Third-Party and Affiliate Recipients (RCW 19.373.020(1)(a)(iv)): The following table identifies the categories of third parties and specific affiliates with whom we share consumer health data, the data shared, and the purpose:

4.3.  Sale of Consumer Health Data: We do not sell consumer health data. If we ever seek to sell consumer health data, we will first obtain a valid authorization from you that is separate and distinct from any consent for collection or sharing. That authorization will be a written document in plain language consistent with the requirements of RCW 19.373.070, and a copy of the signed authorization will be provided to you (RCW 19.373.070(5)).

5.1.  Separate Consent for Collection and Sharing. We will obtain your affirmative, opt-in consent before collecting consumer health data, and we will obtain separate and distinct consent before sharing consumer health data, except to the extent that collection or sharing is necessary to provide a product or service you have requested from us (RCW 19.373.030(1)(a)–(b)).

5.2.  Contents of Consent Requests. Each request for your consent—whether for collection or sharing—will clearly and conspicuously disclose (RCW 19.373.030(1)(c)):
(i)     The categories of consumer health data to be collected or shared;
(ii)   The purpose of the collection or sharing, including the specific ways in which the data will be used;
(iii)   The categories of entities with whom the consumer health data will be shared; and
(iv)   How you can withdraw consent from future collection or sharing of your consumer health data.

‍
5.3.   Withdrawal of Consent. You may withdraw consent for collection and/or sharing at any time. To withdraw consent, contact us at Privacy@carevoyage.com. Upon receipt of your withdrawal request, we will cease the applicable collection or sharing as soon as commercially practicable. Withdrawal of consent does not affect the lawfulness of any collection or sharing that occurred prior to withdrawal.

5.4.  Additional Categories or Purposes. We will not collect, use, or share additional categories of consumer health data not disclosed in this Policy, or for additional purposes not disclosed in this Policy, without first updating this Policy, disclosing the new categories or purposes, and obtaining your affirmative consent prior to such collection, use, or sharing (RCW 19.373.020(1)(c)–(d)).

CareVoyage will not unlawfully discriminate against any consumer for exercising any right provided under the MHMDA, including but not limited to the rights of access, consent withdrawal, deletion, or appeal described in this Policy. We will not deny you services, charge you different prices, or provide you a different level or quality of service solely because you exercised your MHMDA rights (RCW 19.373.030(1)(d)).

Washington consumers have the following rights regarding their consumer health data (RCW 19.373.040):

7.1.  Right to Confirm and Access. You have the right to confirm whether CareVoyage is collecting, sharing, or selling your consumer health data and to access that data. Upon a verified request, we will provide you with:

• The consumer health data we hold about you;
• A list of all third parties and affiliates with whom we have shared or sold your consumer health data; and
• An active email address or other online mechanism that you may use to contact each such third party or affiliate directly (RCW 19.373.040(1)(a)).
  

7.2.  Right to Withdraw Consent. You have the right to withdraw consent from CareVoyage’s collection and sharing of your consumer health data at any time (RCW 19.373.040(1)(b)). See Section 5.3 above.

7.3.  Right to Deletion. You have the right to request deletion of your consumer health data. Upon receiving a verified deletion request, we will delete the consumer health data we hold about you and will direct each of our processors to delete your consumer health data as well (RCW 19.373.040(1)(c)).

7.4.  How to Exercise Your Rights. To exercise any of the rights described above, submit a request to:

Email: Privacy@carevoyage.com

In your request, please identify the specific right(s) you wish to exercise and provide sufficient information for us to verify your identity. We may request additional information reasonably necessary to authenticate your request before acting on it.

7.5.  Response to Requests. We will acknowledge receipt of your request and respond substantively within a reasonable timeframe, consistent with the nature and complexity of the request.

7.6.  Right to Appeal. If we refuse to take action on your request, we will inform you of our reasons. You may appeal that decision by submitting an appeal to Privacy@carevoyage.com  with the subject line “MHMDA Appeal.” The appeal process uses the same email mechanism as the original request submission process (RCW 19.373.040(1)(h)).

Within forty-five (45) days of our receipt of your appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for our decision (RCW 19.373.040(1)(h)).
If your appeal is denied, we will provide you with a mechanism through which you may contact the Washington State Attorney General to submit a complaint. You may contact the Attorney General’s office at:

Washington State Attorney General’s Office
Consumer Protection Division
800 Fifth Avenue, Suite 2000
Seattle, WA 98104
https://www.atg.wa.gov/file-complaint
1-800-551-4636

CareVoyage does not implement geofences around any entity that provides in-person health care services (RCW 19.373.080). Specifically, we do not use geofencing technology—including technology that uses global positioning coordinates, cell tower connectivity, cellular data, radio frequency identification, Wi-Fi data, or any other form of spatial or location detection to establish a virtual boundary of 2,000 feet or less around a healthcare facility—to: (1) identify or track consumers seeking health care services; (2) collect consumer health data from consumers; or (3) send notifications, messages, or advertisements to consumers related to their consumer health data or health care services.

9.1.  Access Restrictions. We restrict access to consumer health data by our employees, processors, and contractors to only those individuals for whom access is necessary to further the purposes for which you provided consent or where necessary to provide a product or service that you have requested from us (RCW 19.373.050(1)(a)).
‍

9.2.  Security Practices. We establish, implement, and maintain administrative, technical, and physical data security practices that, at a minimum, satisfy a reasonable standard of care within our industry to protect the confidentiality, integrity, and accessibility of consumer health data, appropriate to the volume and nature of the consumer health data at issue (RCW 19.373.050(1)(b)).

10.1. Binding Contracts. We contract with processors only pursuant to binding contracts that set forth processing instructions and limit the actions the processor may take with respect to consumer health data it processes on our behalf. Processors may process consumer health data only in a manner consistent with our binding instructions (RCW 19.373.060(1)(a)(i)–(ii)).

10.2. Processor Assistance with Consumer Rights. Our processor contracts require that each processor assist us, by appropriate technical and organizational measures and insofar as reasonably possible, in fulfilling our obligation to respond to consumer rights requests under Section 7 of this Policy (RCW 19.373.060(1)(b)).

10.3. Processor Exceeding Scope. If a processor fails to adhere to our instructions or processes consumer health data outside the scope of its contract with us, that processor is considered a regulated entity with regard to such data and is independently subject to all requirements of the MHMDA with regard to such data (RCW 19.373.060(1)(a)(iii)).

It is a violation of the MHMDA for CareVoyage to contract with a processor to process consumer health data in a manner that is inconsistent with this Policy (RCW 19.373.020(1)(e)).

A violation of the MHMDA is a per se violation of the Washington Consumer Protection Act, RCW Chapter 19.86 (RCW 19.373.090). The Washington Attorney General may enforce the MHMDA. Consumers may bring private actions under the Consumer Protection Act, which may provide for the recovery of actual damages, attorneys’ fees, and treble damages up to $25,000.

If we make material changes to this Policy, we will update the Effective Date above and post the revised Policy with a prominent link on our homepage. If any changes involve the collection, use, or sharing of additional categories of consumer health data or additional purposes not previously disclosed, we will obtain your affirmative consent before implementing those changes (RCW 19.373.020(1)(c)–(d)).

A link to this Consumer Health Data Privacy Policy is prominently published on CareVoyage’s homepage as a separate, distinct link, in compliance with RCW 19.373.020(1)(b) and guidance issued by the Washington State Attorney General’s Office.

CareVoyage Co.
590 Madison Ave, New York, NY, 10022, United States
Privacy@carevoyage.com

© 2026 CareVoyage Co. All rights reserved.