Consumer Health Data Privacy Policy

Last Modified: August 20, 2026

Introduction

This Consumer Health Data Privacy Policy ("Notice") describes how Copernican Admin, LLC ("we", "our" or "the Company") collects, uses, discloses and protects "Consumer Health Data" as that term is defined by applicable state law, including the Washington My Health My Data Act, the Nevada Consumer Health Data Privacy Law (SB 370), and comparable laws.

This Notice supplements, and should be read together with, our Privacy Policy. Where this Notice conflicts with the Privacy Policy with respect to Consumer Health Data, this Notice controls.

What We Do

We help travelers recover money for trips they could not take, by preparing and filing claims under the travel-protection benefits attached to their credit cards. Because eligibility for those benefits frequently depends on a medical reason — an illness or injury affecting the traveler or a family member — substantiating a claim ordinarily requires health information. We collect health information for that purpose and, as described below, we do not sell it or use it for advertising.

Scope

This Notice applies to Consumer Health Data we process about users of our websites, claim portal, SMS and email communications, and telephone support (collectively, the "Platform").

This Notice does not apply to information about our own employees, contractors, or job applicants. Some of the information we handle is also protected health information governed by the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and its implementing regulations. Where information is subject to HIPAA, we handle it in accordance with HIPAA, and our HIPAA obligations control to the extent they conflict with this Notice.

If you provide us Consumer Health Data about another person — for example, a travel companion, a family member whose illness caused the cancellation, or a minor for whom you are the parent or legal guardian — you must have that person's consent, or the legal authority to act on their behalf, before sharing it with us.

Sources of Consumer Health Data

We collect Consumer Health Data from the following sources:

• Directly from you, when you describe the reason you could not take your trip, complete a claim intake, upload documents, respond to our SMS or email messages, or speak with our staff.
• From licensed healthcare providers, when a provider you consult through our provider network documents a visit or issues a note in connection with your claim.
• From documents you supply, including physician notes, discharge paperwork, receipts, and itineraries, which may contain health information within them.
• From the travel operator or merchant with whom you booked, in connection with your booking and cancellation.

We do not purchase Consumer Health Data from data brokers, and we do not collect it from publicly available sources or social media.

Types of Consumer Health Data We Collect

Depending on your claim, we may collect:

• Health conditions, symptoms and diagnoses — the illness or injury that prevented travel, as described by you or documented by a provider.
• Health treatments and services — medical visits, procedures, and other care received in connection with the condition, including visits arranged through our provider network.
• Records of healthcare consultations, including notes, assessments, and documentation generated by providers in connection with your claim.
• Information identifying the person whose health is at issue, who may be you or another individual covered by your booking.

We do not collect precise geolocation data, biometric identifiers, or genetic data.

How We Use Consumer Health Data

We use Consumer Health Data only for the following purposes:

• To prepare and file your claim, including assessing eligibility under your card's benefit terms, assembling the documentation the benefit administrator requires, and submitting the claim on your behalf.
• To communicate with you about your claim, including telling you what documentation is still needed and answering your questions.
• To arrange care through our provider network, where you request or accept a consultation with a licensed provider.
• To respond on your behalf to questions, requests for additional information, and appeals raised by the benefit administrator or insurer.
• For security, legal and compliance purposes, including maintaining audit records of who accessed your information, preventing fraud, and complying with legal obligations or defending legal claims.

We do not use Consumer Health Data for targeted advertising, and we do not sell it. Our website and product analytics are configured to exclude health information and are disabled entirely on the portions of our Platform used for medical review.

How We Disclose Consumer Health Data

We disclose Consumer Health Data only as described here:

• Card benefit administrators and insurers. Filing your claim requires disclosing the medical basis for it to the administrator of your card's travel-protection benefit and to the insurer underwriting that benefit. This is the core purpose of our service, and we make this disclosure under the written authorization you sign when you submit your claim.
• Licensed healthcare providers in our provider network, where you request or accept a consultation.
• Service providers that process information on our behalf under contract and may use it only to perform services for us. These include cloud hosting and storage providers, communications providers that deliver our SMS and email messages, and artificial-intelligence providers whose models help us read submitted documents and assist with claim correspondence.
• Professional advisors, such as lawyers and auditors, where reasonably necessary.
• Law enforcement or government agencies, where required by law or valid legal process.
• An acquirer, in connection with a merger, acquisition, financing, or sale of assets, subject to the protections described in this Notice.
• Anyone else you direct us to, with your consent.

We do not disclose Consumer Health Data to advertisers, ad networks, social media platforms, or commercial data partners for their own purposes.

How We Protect Consumer Health Data

We encrypt sensitive health information at rest and in transit, restrict access to personnel whose role requires it, require multi-factor authentication for staff and clinical accounts, and log access to health information so that reads can be audited. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Retention

We retain Consumer Health Data for as long as needed to pursue your claim and to resolve any subsequent questions, appeals, or disputes about it, and thereafter for the period required to meet our legal, regulatory, and recordkeeping obligations. When it is no longer needed for those purposes, we delete or de-identify it.

Your Rights

Subject to applicable law, you have the right to:

• Confirm and access whether we are processing your Consumer Health Data, and obtain a copy of it, together with a list of the third parties with whom we have shared it.
• Withdraw your consent to our collection and sharing of your Consumer Health Data. Because we cannot pursue a medical-reason claim without the medical documentation that supports it, withdrawing consent will ordinarily end our ability to continue filing or defending your claim. Withdrawal is not retroactive and does not affect disclosures already made.
• Delete your Consumer Health Data. On receiving your request we will delete it from our systems and notify the service providers to whom we have disclosed it of your request, except where we are required by law to retain records.

To exercise any of these rights, contact us at info@getcopernican.com. We will verify your request against the information already associated with your claim, and respond within the time allowed by applicable law.

Appeals

If we decline your request, we will tell you why. You may appeal that decision by replying to our response or writing to info@getcopernican.com with the word "Appeal" in the subject line. We will inform you in writing of the outcome of the appeal and the reasons for it. If your appeal is denied, you may contact your state attorney general to submit a complaint.

Children

Our Platform is not directed to children under 13, and we do not knowingly collect Consumer Health Data directly from them. Where a claim involves a minor, we collect that minor's health information from a parent or legal guardian who attests to their authority to provide it.

Changes to This Notice

We may update this Notice from time to time. Any updated Notice is effective when posted, and the date above will reflect the last revision. Where required by law, we will notify you directly and, where required, obtain your consent before applying material changes to Consumer Health Data we already hold.

How to Contact Us

Questions about this Notice or about how we handle Consumer Health Data can be directed to info@getcopernican.com, or to Copernican Admin, LLC by mail at the address listed on our contact page.