1. Introduction

This Privacy Policy explains how Vital Voyager LLC (“Vital Voyager,” “we,” “us,” or “our”) collects, uses, shares, and protects personal information when you access or use vitalvoyagertravel.com or any related service we operate (collectively, the “Platform”).

This Privacy Policy is incorporated into and forms part of our Terms of Service. Capitalized terms not defined here have the meanings given in the Terms of Service. By accessing or using the Platform, you agree to the practices described in this Privacy Policy.

This Privacy Policy is written to comply with the laws of the United States, including without limitation the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act (the “CCPA/CPRA”), the Maryland Online Data Privacy Act (“MODPA”), and the consumer privacy laws of every other U.S. state in which we may have users. Where any provision of a more restrictive applicable law conflicts with this policy, the more restrictive provision controls.

2. Information We Collect

We collect personal information in four ways: (a) directly from you when you provide it; (b) automatically when you use the Platform; (c) from our service providers and third-party platforms that help us operate the Platform; and (d) from third-party referral activity. The specific categories of personal information we collect are described below.

2.1 Information you provide directly.

You provide information to us when you create an account, complete a purchase, subscribe to our newsletter, contact us, apply for the Mission Scholarship Program, or use any Platform feature that requires input. This may include:

• Identifiers: your name, email address, postal address (for kit shipping), telephone number (optional).
• Account credentials: username and password (passwords are stored only as one-way cryptographic hashes; we cannot view your password).
• Commercial information: products purchased, memberships, transaction history, billing information (payment card details are processed by Shopify and we do not store full card numbers).
• Mission Scholarship application information: organization legal name, EIN or other tax-exempt identifier, description of the trip, name and authority of the requesting individual, number of kits requested.
• Newsletter preferences and content you submit through any contact form.
• Optional self-reported travel information you enter into the Elite tier’s annual health travel debrief (see Section 2.4).

2.2 Information we collect automatically.

When you use the Platform, we and our service providers automatically collect certain information about your device and your interaction with the Platform. This may include:

• Internet activity information: IP address, browser type and version, operating system, referring URLs, pages viewed, time spent on pages, clickstream data.
• Approximate geolocation derived from your IP address (city or region level, not precise GPS coordinates).
• Cookies and similar tracking technologies (see Section 7).
• Device identifiers.

We do not collect precise geolocation (GPS-level or smaller than 1,750-foot radius) without your explicit opt-in consent.

2.3 Information we receive from third parties.

We receive information from service providers and third-party platforms that help us operate the Platform. This may include:

• Authentication and account information from any third-party single-sign-on provider you use to access the Platform.
• Payment confirmation and transaction information from Shopify (our e-commerce processor).
• Newsletter delivery and engagement metrics from our email service provider.
• Analytics information from Google Analytics 4 and similar analytics providers.
• Referral information from independent third-party companies referenced on the Platform (such as Impact.com and from Global Rescue) regarding purchases you make through Vital Voyager links.

2.4 Sensitive personal information.

Certain information we may collect is treated as “sensitive personal information” under applicable law. This includes:

• Health-related information you voluntarily provide, such as travel-medicine considerations entered into the Elite tier’s annual health travel debrief or notes you supply when contacting us for Mission Scholarship verification.
• Precise geolocation, if you have explicitly enabled it for any Platform feature.
• Government identifier information, where applicable (for example, the EIN you provide for Mission Scholarship eligibility verification).

We do not process sensitive personal information except as necessary to provide the specific feature for which you provided it. We do not use sensitive personal information for targeted advertising, profiling, or sale, and we will not do so without your separate opt-in consent. You may withdraw any consent you have provided at any time as described in Section 8.

2.5 Information we do not collect.

We do not knowingly collect personal information from children under 13. If we learn that we have collected such information without verifiable parental consent, we will delete it promptly. We do not collect biometric information, racial or ethnic information, religious beliefs, philosophical beliefs, trade union membership, sexual orientation, or immigration status, except where you voluntarily provide such information in a contact submission and except as may be incidental to Mission Scholarship eligibility verification (where the qualifying organization may be a religious institution).

3. How We Use Personal Information

We use personal information for the following purposes:

• To provide the Platform: operating the website, serving country dossiers, fulfilling kit orders, administering memberships, processing the Mission Scholarship Program, sending transactional communications (order confirmations, shipping notices, account notifications).
• To communicate with you: responding to your inquiries, providing customer support, sending the newsletter you subscribed to.
• To improve the Platform: analyzing aggregate usage to understand how the Platform is used, fix bugs, and improve content.
• To protect the Platform: detecting and preventing fraud, abuse, and security incidents; enforcing our Terms of Service.
• To comply with law: responding to lawful requests by public authorities; defending against legal claims.
• With your consent: for any other purpose disclosed at the time you provide consent, including any purpose for which we use sensitive personal information beyond the immediate feature for which you provided it.

We do not use personal information for automated decision-making that produces legal or similarly significant effects on you. We do not use AI to make decisions about you as an individual; the AI-generated content disclosed in our Terms of Service refers to the generation of country dossiers and similar published content, not to the processing of your personal information.

4. How We Share Personal Information

We share personal information only as described in this section. We do not sell your personal information for monetary consideration, and we do not engage in cross-context behavioral advertising without your opt-out right described in Section 8.

4.1 Service providers and processors.

We share personal information with service providers and processors that perform functions on our behalf. We require each service provider to handle personal information consistently with this Privacy Policy and applicable law, and to use the information only for the limited purposes for which it was disclosed. The categories of service providers we use include:

• Hosting and content delivery: Webflow (website hosting and CMS), and the operators of any content delivery network we use.
• Data sync and database: Airtable and PowerImporter or Whalesync (used for content management; do not process user personal information beyond what is incidental to platform operations).
• E-commerce and payment processing: Shopify (processes kit purchases, including payment-card information; we do not store full card numbers).
• Email and communications: our email service provider for transactional and newsletter communications.
• Analytics: Google Analytics 4 (configured with IP anonymization and without cross-device personalization).
• Affiliate tracking: Impact.com (tracks IMG iTravelInsured Choice referrals).
• AI content generation: Anthropic (Claude) for the generation of country dossiers and similar published content. Anthropic processes content-generation prompts that include public-source data and our editorial inputs. Anthropic does not process personal information about individual Platform users in connection with dossier generation.

4.2 Independent third parties.

When you click on a link to a site for a third party product or service mentioned on the site (currently IMG iTravelInsured Choice and Global Rescue), you leave the Vital Voyager Platform and enter the third party’s own website or application. Once you do so, the applicable third party may collect information from you under its own privacy policy, which we do not control. We may receive information from the third party about whether you completed a purchase (for commission accounting), but we do not receive your detailed personal information from the third party unless you separately authorize that disclosure.

4.3 Legal and protective disclosures.

We may disclose personal information when we believe in good faith that disclosure is necessary to comply with law, respond to lawful requests by public authorities (including subpoenas, court orders, and government investigations), enforce our Terms of Service, protect the safety of users or the public, or defend against legal claims.

4.4 Business transfers.

If we are involved in a merger, acquisition, sale of assets, financing, or similar transaction, personal information may be transferred to the acquiring or successor entity. If such a transfer occurs, we will provide notice on the Platform and, where required by law, allow you to exercise applicable rights with respect to the transfer.

4.5 Aggregated and de-identified information; Artificial Intelligence.

We may share aggregated or de-identified information that does not identify any individual person for any lawful purpose, including for research, analytics, marketing, and partnerships. De-identified data is processed in a manner reasonably designed to prevent re-identification of any individual and is not used in a way that would re-associate such data with any identifiable person.

We may use transactional data collected in connection with your use of our services, as well as data that has been de-identified as described above, to develop, train, test, evaluate, and improve artificial intelligence and machine learning models ("AI Models").

Transactional data used for AI training purposes may include records of interactions, purchases, usage patterns, and similar operational data, but will not include payment card numbers, government-issued identification numbers, or other sensitive financial identifiers except in aggregated or de-identified form.

We may share de-identified or aggregated data with third-party AI development partners, service providers, and research collaborators for the purposes described above, subject to appropriate contractual protections prohibiting re-identification. No such sharing will constitute a "sale" of personal information under applicable privacy law to the extent such data has been de-identified consistent with the standards set forth under such law.

You may contact us at legal@vitalvoyagertravel.com to request additional information about our AI training data practices.

5. No Sale of Personal Information; CCPA/CPRA Disclosures

5.1 No sale.

Vital Voyager LLC does not sell personal information in the ordinary sense of receiving money in exchange for personal information. We also do not engage in “sale” or “sharing” of personal information as defined under the CCPA/CPRA for cross-context behavioral advertising purposes.

5.2 Cookies and analytics.

The CCPA/CPRA and analogous state laws may treat certain analytics or advertising-cookie configurations as “sharing” personal information even where no direct sale occurs. To the extent any cookies or tracking technologies we use are deemed to be “sharing” under applicable state law, you may opt out as described in Section 8. We honor the Global Privacy Control (“GPC”) browser signal and other Universal Opt-Out Mechanisms recognized by applicable state law as a valid opt-out request.

5.3 Categories of personal information disclosed in the preceding 12 months.

In the preceding twelve months, we have disclosed the following CCPA/CPRA categories of personal information to service providers as described in Section 4.1: identifiers; commercial information; internet or other electronic network activity information; and approximate geolocation information. We have disclosed sensitive personal information (Section 2.4) only to the extent necessary to provide the specific feature for which the user provided it.

6. Retention of Personal Information

We retain personal information only as long as necessary for the purposes for which it was collected, plus a reasonable period to comply with legal obligations, defend against claims, and audit our compliance. Specific retention periods:

• Account information: while your account is active, plus three (3) years after account closure.
• Transaction and purchase records: seven (7) years from the date of the transaction, in line with applicable tax and consumer-protection record-keeping requirements.
• Mission Scholarship application records: three (3) years from the date of the application or the date of last verified purchase under the program, whichever is later.
• Newsletter subscription records: while you are subscribed, plus one (1) year after unsubscription to allow re-subscription verification.
• Modal acceptance and consent records: seven (7) years from the date of acceptance, to cover the longest applicable statute of limitations.
• Analytics and aggregate usage data: twenty-six (26) months in identifiable form, then aggregated or deleted (consistent with Google Analytics 4 default retention).
• Customer support correspondence: three (3) years from the date of last interaction.
• Sensitive personal information you provide for a specific feature: the minimum duration necessary to provide the feature, plus any period required by law.

We may retain certain personal information for longer when required to comply with legal obligations, resolve disputes, enforce agreements, or for other purposes permitted or required by law.

7. Cookies and Similar Tracking Technologies

7.1 What cookies are.

Cookies are small text files placed on your device when you visit a website. Similar tracking technologies include pixels, tags, local storage, and device fingerprints. We use these technologies for the purposes described below.

7.2 Categories of cookies we use.

We use the following categories of cookies and similar technologies:

• Strictly necessary: required for the Platform to function, including authentication, security, and basic site operation. These cannot be disabled.
• Functional: remember your preferences (e.g., region, content preferences) to improve your experience. Can be disabled through the cookie banner.
• Analytics: used by Google Analytics 4 and similar providers to understand aggregate usage. Configured with IP anonymization. Can be disabled through the cookie banner.
• Affiliate tracking: used by Impact.com to attribute third-party referrals to Vital Voyager when you click through to IMG iTravelInsured Choice. Can be disabled through the cookie banner.

We do not use cookies or similar technologies for cross-site behavioral advertising. We do not place advertising on the Platform.

7.3 Managing cookies.

When you first access the Platform, a cookie banner allows you to accept or reject non-essential cookies. You may change your cookie preferences at any time through the “Cookie Preferences” link in our footer. You may also manage cookies through your browser settings; instructions for the major browsers are available through their support sites.

8. Your Privacy Rights

Subject to applicable law, you have the following rights with respect to your personal information:

• Right to know / right to access: you may request information about the categories and specific pieces of personal information we have collected about you, the sources, the purposes of collection, and the categories of third parties with whom we have disclosed the information.
• Right to delete: you may request that we delete personal information we have collected from you, subject to legal exceptions (such as records we must retain for tax, accounting, or legal-defense purposes).
• Right to correct: you may request that we correct inaccurate personal information we maintain about you.
• Right to data portability: you may request a copy of your personal information in a structured, commonly used, machine-readable format.
• Right to opt out of sale or sharing: you may opt out of any sale or sharing of personal information for cross-context behavioral advertising, even if we do not currently engage in such sale or sharing. We honor Global Privacy Control and other Universal Opt-Out Mechanisms recognized by applicable state law.
• Right to limit use of sensitive personal information: you may limit our use of sensitive personal information to the use necessary to provide the specific feature for which it was provided.
• Right to opt out of profiling and automated decision-making: we do not engage in profiling or automated decision-making that produces legal or similarly significant effects, but you have the right to opt out should we begin to do so.
• Right to non-discrimination: we will not discriminate against you for exercising any of these rights. We will not deny services, charge different prices, or provide a different level or quality of services because you exercised your rights.
• Right to appeal: if we decline a request, you may appeal that decision by responding to our denial within thirty (30) days. We will respond to the appeal within sixty (60) days.

8.1 How to exercise your rights.

You may exercise your rights by emailing legal@vitalvoyagertravel.com, by submitting our privacy request form at vitalvoyagertravel.com/privacy/request, or by mail to Vital Voyager LLC, c/o United States Corporation Agents, Inc., 5865 Ridgeway Center Parkway, Suite 384, Memphis, TN 38120, Tennessee. We will verify your identity before responding to a request involving personal information. We will respond to verifiable requests within forty-five (45) days, with one possible forty-five-day extension where reasonably necessary, in accordance with applicable law.

8.2 Authorized agents.

You may designate an authorized agent to make a request on your behalf. We will require the agent to provide proof of authorization signed by you. We will also require you to verify your identity directly with us before honoring the request.

8.3 Universal Opt-Out Mechanism (GPC).

If you have configured Global Privacy Control or another Universal Opt-Out Mechanism in your browser, our servers will honor that signal as a valid opt-out request for the purposes of any sale or sharing of personal information by Vital Voyager LLC.

9. State-Specific Disclosures

9.1 California residents.

California residents are entitled to additional disclosures under the CCPA/CPRA, including (a) the categories of personal information collected, sold, shared, and disclosed for a business purpose in the preceding twelve months; (b) the categories of sources from which personal information is collected; (c) the categories of recipients of personal information; (d) the business or commercial purposes for collecting, selling, or sharing; (e) the right to access, delete, correct, port, opt out of sale or sharing, limit use of sensitive personal information, and non-discrimination. The substantive disclosures appear in Sections 2, 3, 4, 5, 6, 7, and 8 above. California residents may also designate an authorized agent (Section 8.2). Under the Shine the Light law (Cal. Civ. Code § 1798.83), California residents may request information about disclosures of personal information to third parties for direct marketing purposes; we do not share personal information with third parties for their direct marketing purposes.

9.2 Virginia, Colorado, Connecticut, Utah, Iowa, Tennessee, Indiana, Texas, Oregon, Montana, New Jersey, Delaware, New Hampshire, Minnesota, Maryland, Kentucky, Nebraska, Rhode Island, and other state residents. If you are a resident of a state with a comprehensive consumer privacy law, you have the same general rights described in Section 8 to the extent provided under your state’s law. We respond to verifiable requests from residents of every state, including states that have not enacted comprehensive privacy laws.

9.3 Maryland Online Data Privacy Act (MODPA).

We adhere to MODPA’s heightened data-minimization requirements for Maryland residents. We collect, process, and share personal information only as reasonably necessary for the specific purposes for which it was provided, as required by MODPA (Md. Code Ann., Com. Law § 14-4602).

9.4 Washington My Health My Data Act.

If you are a Washington resident, the Washington My Health My Data Act (“MHMDA”) provides specific rights with respect to consumer health data. To the extent any personal information we collect from Washington residents qualifies as “consumer health data” under MHMDA, we treat it as sensitive personal information under Section 2.4 of this Privacy Policy, we do not sell it, and we honor MHMDA opt-out and authorization requirements. The MHMDA-specific section of this Privacy Policy is available at vitalvoyagertravel.com/privacy/washington.

9.5 Children under 13.

We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at legal@vitalvoyagertravel.com and we will delete the information promptly.

10. Data Security

We implement reasonable administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, use, alteration, or disclosure. These safeguards include encryption in transit (TLS), encrypted storage where feasible, access controls limiting personal information access to authorized personnel, secure software development practices, and periodic security reviews of our service providers.

No security measure is perfect. We cannot guarantee absolute security of personal information. If we become aware of a security incident affecting your personal information, we will notify you and applicable regulators in accordance with applicable law, including any data breach notification statutes of your state of residence.

11. International Users

The Platform is operated from the United States and is intended for users located in the United States. If you access the Platform from outside the United States, you understand and agree that your personal information may be transferred to, processed, and stored in the United States. United States privacy laws may differ from the laws of your country of residence.

If you are a resident of the European Union or the United Kingdom, you may have additional rights under the EU General Data Protection Regulation (“GDPR”) or the UK GDPR, including the right to object to processing, the right to data portability, and the right to lodge a complaint with your national supervisory authority. Vital Voyager LLC is not established in the EU or the UK and does not directly target residents of the EU or UK. However, where we process personal information from EU or UK residents, we will respond to verifiable rights requests in accordance with applicable law. If you are an EU or UK resident, you may contact us at legal@vitalvoyagertravel.com for further information.

Canadian residents have rights under the federal Personal Information Protection and Electronic Documents Act (“PIPEDA”) and applicable provincial laws (including Quebec Law 25). We respond to verifiable rights requests from Canadian residents in accordance with applicable law.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make any material change, we will (a) post the updated Privacy Policy on the Platform with a new effective date; (b) update the version number at the top of the policy; and (c) notify existing account holders by email and re-prompt for acknowledgment of the updated policy at next login. Non-material changes (typographical corrections, broken-link updates) take effect upon posting. Material and non-material changes are described in our public Changelog at vitalvoyagertravel.com/changelog.

13. Contact Us

For questions about this Privacy Policy or about our handling of your personal information, you may contact us:

• Email: legal@vitalvoyagertravel.com
• Privacy request form: vitalvoyagertravel.com/privacy/request
• Mail: Vital Voyager LLC, c/o United States Corporation Agents, Inc., 5865 Ridgeway Center Parkway, Suite 384, Memphis, TN 38120, Tennessee.

If you have a concern that we have not resolved, you may contact your state attorney general, the California Privacy Protection Agency (if you are a California resident), or another applicable regulator.

‍