Consumer Health Data Privacy Policy

Effective Date: September 18, 2026

1 · Introduction

FamScapes helps families plan travel together. In doing so, you or another authorized person may choose to provide information about health-related needs that can help make a trip more workable, such as mobility, accessibility, allergy, dietary, disability-related, or similar information.

This Consumer Health Data Privacy Policy ("Policy") explains how FamScapes handles information that qualifies as consumer health data under applicable U.S. state consumer-health-data laws. It supplements our general Privacy Notice. Where this Policy and the Privacy Notice address the same processing of consumer health data, this Policy controls to the extent required by applicable law.

Winston is FamScapes' AI travel planner, an AI-assisted tool within the Service. When you choose to use health-related information in trip planning, Winston may use relevant information to help tailor a plan, subject to the limits described in this Policy.

This Policy is written for FamScapes' Initial Release (Release 1.0). Future booking integrations, returned booking data, Concierge services, or other materially different features are not described here and must receive a separate privacy review before launch.

2 · When this Policy applies

This Policy applies when FamScapes processes information that qualifies as consumer health data under a law that applies to FamScapes, including Washington's My Health My Data Act and Nevada's consumer-health-data law where their requirements are applicable.

Some protections described in this Policy may be applied more broadly as a FamScapes privacy practice even when a particular state law does not apply. The specific legal rights available to you can depend on where you live, where information is collected, and the law that governs the processing.

This Policy does not replace the Privacy Notice. Ordinary account, family, trip, and planning information that does not reveal or identify a health status is generally handled under the Privacy Notice.

3 · Consumer health data at a glance

This summary is provided for convenience. The sections that follow provide the fuller explanation.

4 · What we mean by consumer health data

Consumer health data generally means personal information that identifies or can be linked to a person's physical or mental health status and, under some laws, information that is derived or inferred from other information.

For FamScapes, consumer health data may include the following broad categories when they identify or reveal a health-related status:

• mobility, accessibility, or disability-related needs;
• allergies or dietary information that identifies a health condition or health-related restriction;
• health-related information a person chooses to include in trip-planning fields, notes, or conversations with Winston;
• assistance-animal information when it reveals or can reasonably be associated with an identifiable person's health or disability status; and
• health-related information that is derived or inferred from information provided to FamScapes.

Ordinary travel logistics - such as a name, age range, room preference, crib request, or other planning detail that does not identify a health status - are generally not treated as consumer health data under this Policy.

5 · Categories we collect and why

The consumer health data FamScapes processes depends on the features used and the information that a user or other authorized person chooses to provide. We do not require every Traveler to provide health-related information.

FamScapes does not use consumer health data for targeted advertising or to build unrelated commercial profiles about Travelers.

6 · Sources of consumer health data

FamScapes may receive consumer health data from the following categories of sources:

Release 1.0 is not designed to purchase consumer health data from data brokers or to import health records from medical providers.

7 · How we use and process consumer health data

FamScapes processes consumer health data only for disclosed and permitted purposes. At a high level, processing may include receiving, organizing, storing, analyzing, using, displaying to authorized users, transmitting to service providers where needed, securing, restricting, and deleting information.

We primarily use consumer health data to provide or personalize travel-planning features a user has chosen to use, operate the Service, respond to privacy or support requests, protect the Service and its users, and comply with applicable law. We do not use consumer health data for a materially different purpose without providing any notice and obtaining any consent required by applicable law.

8 · How we disclose or share consumer health data

FamScapes limits disclosure of consumer health data to the recipient categories and purposes described below. The categories of consumer health data disclosed depend on what is reasonably necessary for the applicable purpose.

Corporate affiliates. FamScapes does not currently share consumer health data with a corporate affiliate as part of Release 1.0. If that changes, this Policy will be updated as required before the new sharing occurs.

Public Shares. FamScapes is designed to exclude consumer health data and sensitive health-related inferences from Public Shares. Users should nevertheless avoid placing sensitive health information in free-text content they intend to make public.

9 · Winston and service providers

Winston may process consumer health data when that information is relevant to a travel-planning request. FamScapes follows a minimum-necessary approach: consumer health data should be used only to the extent reasonably needed for the planning purpose or another disclosed and permitted purpose.

FamScapes may use service providers, including technology providers that support Winston, to process consumer health data on our behalf. Where required, those providers are subject to contractual restrictions governing the purposes and manner in which they may process the information.

FamScapes does not permit consumer health data to be used by a service provider for independent targeted advertising or independent AI-model training unrelated to providing services to FamScapes.

10 · Planning for another Traveler, including minors

Family travel often involves one person helping plan for someone else. Providing ordinary trip information about another Traveler does not necessarily give a Planner authority to provide or authorize processing of that person's consumer health data.

When consumer health data relates to another Traveler, additional authorization may be required from the person the information concerns or, for a minor, from a parent, legal guardian, or other person legally authorized to act for the minor. FamScapes may restrict sensitive-data features until the required authorization is recorded.

11 · Consent and withdrawal

Where applicable law requires consent, FamScapes will request consent for the specified purpose before the covered collection or sharing occurs. Where the law requires separate consent for sharing, that consent will be separate from any consent relied on for collection.

Consent should be clear, purpose-specific, and capable of being withdrawn as required by applicable law. Withdrawing consent generally stops future processing that depends on that consent. Withdrawal does not necessarily delete information already held; deletion is a separate privacy request unless applicable law provides otherwise.

Acceptance of the Terms of Service is not intended to substitute for a separate consumer-health-data consent where applicable law requires one.

12 · No sale, targeted advertising, or cross-site health-data collection

FamScapes does not sell consumer health data. FamScapes does not use consumer health data for targeted advertising.

For Release 1.0, FamScapes does not permit third parties to collect consumer health data through FamScapes over time and across unaffiliated websites or online services for advertising or profiling purposes.

If a future business model or technology would materially change these practices, FamScapes will conduct a privacy review and provide any notice, authorization, or consent required before the change is implemented.

13 · How long we keep consumer health data

FamScapes keeps consumer health data only for as long as reasonably necessary for the purposes described in this Policy, subject to applicable legal, security, dispute-resolution, or recordkeeping requirements. Retention can vary depending on the type of information, the feature used, whether an account or trip remains active, and whether a valid deletion request has been made.

When deletion is required, FamScapes will take steps to delete the covered consumer health data from systems and instruct applicable service providers or other recipients to do the same as required by law. Backup or archival deletion may take additional time where permitted by applicable law.

14 · How we protect consumer health data

FamScapes uses reasonable administrative, technical, and organizational safeguards designed to protect consumer health data against unauthorized access, loss, misuse, alteration, or disclosure. We limit access to people and service providers who need the information for authorized purposes and apply safeguards appropriate to the sensitivity of the information.

No method of transmission or storage can be guaranteed to be completely secure. You are also responsible for protecting your account credentials and for using care when entering sensitive information into shared or free-text areas.

15 · Your consumer health data rights

Depending on applicable law and subject to permitted exceptions, you may have one or more of the following rights regarding consumer health data about you:

• confirm whether FamScapes is collecting, sharing, or selling consumer health data about you;
• access consumer health data about you, including information about third parties or affiliates with whom it has been shared where applicable;
• withdraw consent for future collection or sharing that depends on your consent;
• request deletion of consumer health data;
• review or request changes to consumer health data where applicable law provides that right or where FamScapes offers a correction process; and
• appeal certain decisions about a privacy-rights request where applicable law provides an appeal right.

To submit a request, contact privacy@famscapes.com. FamScapes will respond within the time required by applicable law and will explain any material reason for denying or limiting a request where required.

Exercising an applicable consumer-health-data right will not result in unlawful discrimination or retaliation.

16 · Verification and authorized agents

To protect consumer health data, FamScapes may need to verify your identity before completing a request. We will request only information reasonably necessary for verification and the request involved.

Where applicable law permits, an authorized agent or legally recognized representative may submit a request on your behalf. We may require reasonable evidence of the agent's authority and may also need to verify the identity of the person whose consumer health data is involved.

17 · Appealing a privacy-rights decision

If FamScapes declines to take action on a consumer-health-data request and applicable law gives you a right to appeal, you may appeal the decision by contacting privacy@famscapes.com and identifying the request as a privacy appeal. We will review and respond within the period required by applicable law.

If an appeal is denied, FamScapes will provide information about any further complaint right required by applicable law, which may include the right to contact the applicable state attorney general.

18 · Changes to this Policy

FamScapes may update this Policy as the Service, our practices, or applicable law changes. The Effective date and Last updated fields at the beginning of this Policy identify the applicable version.

For a material change, we may provide notice by email, through the Service, by a prominent website notice, or by another method appropriate to the change. Where applicable law requires affirmative consent before FamScapes collects, uses, or shares an additional category of consumer health data or uses existing data for an additional purpose, we will obtain that consent before the covered processing begins.

19 · Contact us

Questions, consumer-health-data requests, and privacy appeals may be directed to:

• Email: privacy@famscapes.com
• Mail: FamScapes, LLC, 10 Glenlake Parkway, Suite 130, Atlanta, GA 30328, USA

For personal information that is not consumer health data, please see the FamScapes Privacy Notice.