# Washington Consumer Health Data Privacy Policy

_Last updated December 5, 2026_

Source: https://www.rovetravel.com/s/washington-health-data-privacy

*Last updated: October 27, 2026 · Effective: October 27, 2026*

Andora and Rove Travel are brands of Rove Ventures Inc. (“we”, “us” or “our”). This policy explains how we collect, use and share consumer health data, as Washington’s My Health My Data Act defines it, and how you can use your rights under that law. It adds to the Andora Privacy Policy and the Rove Travel Privacy Policy, which cover the rest of the personal information we handle.

## 1. What we collect and why

- **Biometric information.** When Booking Pass verifies a guest’s identity, we and our identity verification provider compare a selfie with the photo on the guest’s ID using facial geometry. We collect it only with the guest’s consent, and use it only to verify their identity.
- **Health information you choose to share.** Information about a health condition or disability that you tell us or your host, for example when you ask about accessibility or a service animal, or report an injury during a stay. We use it only to respond to you, arrange and support your stay, handle claims and keep people safe.

We don’t use consumer health data for advertising, and we don’t sell it.

## 2. Where we get it

From you, and from our identity verification provider, which makes the facial comparison.

## 3. Who we share it with

- **Service providers** who process it for us, such as our identity verification provider, Persona, and our customer support and hosting providers. They may use it only for us.
- **Your host**, when you ask us to tell them, or when you send it to them in a message.
- **Legal and safety recipients**, where the law requires it, or to prevent fraud or protect someone’s safety where the law allows.
- **A buyer or successor**, as part of a merger, acquisition or sale of all or part of our business.

## 4. How long we keep it

We and our identity verification provider destroy biometric information within 30 days after the verification attempt ends, whether it succeeds, fails or is abandoned. We keep other consumer health data as our privacy policies explain.

## 5. Your rights

If this law applies to you, you can:

- confirm whether we collect, share or sell your consumer health data, and get access to it;
- get a list of the third parties we’ve shared it with or sold it to, and how to contact them;
- withdraw your consent to our collecting or sharing it; and
- ask us to delete it.

To make a request, email support@rovetravel.com or support@andora.ai, or call us toll-free at +1 (877) 510-7683. We’ll verify your identity before we act on a request. If we decline it, you can appeal by replying to our decision; if we still decline, you can contact the Washington State Attorney General. We won’t treat you differently for using your rights.

If you don’t want to consent to the selfie check, contact us, and our team can verify your identity another way, such as a short video call.

## 6. Changes and contact

We may change this policy. We’ll post each version here with its effective date. Email support@rovetravel.com or support@andora.ai with questions. Our postal address is Rove Ventures Inc., 169 Madison Ave, #2028, New York, NY 10016.

## Change history
- **December 5, 2026** (material change): Initial version