1. Commitment to privacy
   International SOS Online, Inc. ("the Company") is committed to protecting the privacy of its customers. We provide this Online Privacy and Security Statement ("Statement") so that our clients are aware of the information we collect, how it is processed, and how we protect it. International SOS Online, Inc. complies with the EU Safe Harbor framework as set forth by the Department of Commerce regarding the collection, use, and retention of data from the European Union. (more about Safe Harbor)

2. To whom this statement applies
   This statement applies to the products and services offered by International SOS Online, Inc. and to the Company's affiliated corporations. The Company also uses the services of other entities or persons to perform services on behalf of the Company. These entities or persons together with the affiliated corporations are referred to in this Statement as "affiliated entities."

3. What information is collected and how it is collected
   International SOS Online, Inc. collects personally identifiable information about you when you provide such information to the Company to purchase, use or benefit from our products or when this information is given to us by affiliated entities or third parties, such as but not limited to travel agencies, that are permitted to share your Personal Information. "Personal Information" is information that would allow someone to identify or contact you, including, for example, your full name, address, telephone number, Social Security number, or email address. In addition, depending upon the service that we provide, we may collect information about your travel plans (Travel related services) or medical information to create an emergency medical record. Personal Information does not include aggregated or information that, by itself, does not permit the identification of individual persons (such as statistics on the number of persons visiting the International SOS website each month, or how many visitors are male or female).
   You provide certain Personal Information to us when you: (a) order products and services from International SOS websites (b) submit forms through the Customer Care Center, or (c) send other information to us through the "Tell us what you think" interface or through our Travel Care website. Your employer or an affiliated entity such as a travel agency may provide information about you to us to enable us to provide you and your employer services, such as travel related services. When you choose to pay for International SOS Online services by credit card, you will be required to provide us the name of your credit card issuer, credit card number and expiration date. You also provide information to us when you choose to Email information about our website from the "Email a friend" section. If you choose to use our referral service to tell a friend about our site, we will ask you for your and your friend's email address. We will automatically send your friend a one-time email inviting him or her to visit the site and tracking the success of our referral program. International SOS does not store this information and process it once for the sole purpose of sending this one-time email. It will not be collected or used by International SOS for any marketing purposes.

4. Acceptance and links to other websites
   This Privacy Policy is a part of our Terms and Conditions Agreement and by using the International SOS Online, Inc. websites and services, you agree to be bound by its terms and conditions. This website may contain links to other websites, which are provided solely as a convenience to you and not as an endorsement by International SOS Online of the contents of such other web sites. Those other sites may have their own policies, which International SOS Online does not control, and thus are not addressed or controlled by this policy.

5. Cookie specific explanation
   A cookie is a piece of data stored on your hard drive containing information about you. International SOS Online uses cookies in order to identify a user session, but usage of a cookie is in no way linked to any personally identifiable information while on our sites. Most browsers are initially set up to accept cookies. Though most cookies expire after a certain period of time, you can choose to delete a cookie file at any time. You can do so by resetting your browser to refuse all cookies or to indicate when a cookie is sent. However, some International SOS Online features or services may not function properly without cookies. Some of our business partners (e.g. our third-party partner monitoring our satisfaction survey) use cookies on our site. We have no access to or control over these cookies. This privacy statement covers the use of cookies by International SOS' site only and does not cover the use of cookies by any partner in business.

6. How the personal information is used
   International SOS Online, Inc. will use your Personal Information to provide you with services that you purchase, or services that are purchased by your employer. These services are designed to provide tools for risk management, medical and security assistance. Your Personal Information may be transferred to affiliated entities that are performing services for the Company or acting as its agent. We will require that any such entities or persons providing services on behalf of the Company agree to protect the privacy of your Personal Information and use it only for the purposes for which the information is transferred. Your Personal Information may also be used or disclosed for other purposes if required or permitted by applicable law. The Company will not use or disclose your Personal Information except as described in this Statement unless you give us your permission to use or disclose it for other purposes. International SOS Online will take reasonable steps to ensure that data is reliable and relevant for its intended use, accurate, complete, and current.

7. Privacy protections for children
   International SOS Online does not knowingly collect any information on persons who have not attained the age of 18 years.

8. Choices available to users regarding collection, use and distribution of the personal information
   You are given the opportunity to choose or 'opt-in' to have sensitive Personal Information (such as medical information) used or disclosed outside the Company for purposes of providing you services at the point where we ask you for the sensitive Personal Information. For example, the collection of Personal Information for the Emergency Medical Records will include an 'opt-in' mechanism for you to give us your consent to use and disclose your personal medical information to enable us to provide you with medical care and related services. For example, we may transfer your medical information to companies that provide emergency air travel or to local clinics or physicians who we arrange to treat you. We may also transfer Personal Information to local authorities if necessary or desirable to assist in arranging emergency medical care for you.
   You will also be given the choice to prohibit the Company from disclosing your Personal Information to a third party (i.e., one that is not an affiliated corporation or providing services on the Company's behalf) or for purposes other than to provide you with services. You may also 'opt-out' of our products directly from International SOS Online. On our email alerts for instance, if you no longer wish to receive this service for which you have opted in, you may opt-out by replying to the email or clicking the "unsubscribe" link.
   International SOS Online may offer its services to corporate clients who purchase the services on behalf of their employees. In that case, the corporate client will determine the method and means by which the individual will be provided opt-out and opt-in mechanisms.

9. How users can correct any inaccuracies in their personal information
   You can review the Personal Information that we have collected from you by using your password to access your record through our website. To update, delete or amend any Personal Information that we create and that we are able to change, simply contact us through privacy@internationalsos.com or through the contact us link on our website. Should you need assistance to access or make changes to your personal information, please submit a request to do so. We will strive to address your request as soon as possible and in any case no later than within 30 days.

10. What kind of security procedures are used to protect the loss, misuse, or alteration of your personal information under our control
    International SOS Online takes precautions to protect its users' information. When users submit sensitive information via our web site, that information is protected both online and off-line.
    International SOS Online, Inc. has implemented policies that forbid its employees from using or disclosing Personal Information in an inappropriate or unlawful manner and maintains security measures to safeguard the Personal Information that it maintains from unauthorized access, misuse, alteration, loss or destruction.
    When individual provide information (such as travel, health and activity information) through the online forms we offer, the information is protected using industry-standard SSL encryption. SSL is an acronym for Secure Sockets Layer, and is a protocol for transmitting private documents via the Internet. SSL works by using a private key to encrypt data that's transferred over the SSL connection.
    International SOS Online has also contracted a special agreement with Verisign, an independent third party in order to provide its customer with the most secure way to collect information. This assures International SOS Online's customers that:
    - International SOS site has a VeriSign Secure Server ID.
    - VeriSign has verified the organizational name and that International SOS Online has the proof of right to use it.
    - All information sent to this site, if in an SSL session, is encrypted, protecting against disclosure to third parties.

11. How do I resolve disputes with the company?
    Any questions or concerns regarding the use or disclosure of Personal Information should be directed to International SOS Online's Data Privacy officer at privacy@internationalsos.com. International SOS Online will investigate all complaints and strive to resolve any issues regarding use and disclosure of Personal Information.
    If an individual who receives services from the Company through his or her employer believes that his or her Personal Information has been improperly collected (i.e. the individual has not been properly provided with notification and choice), the individual will be directed by International SOS Online to his/her employer. International SOS Online will not be liable for dispute resolution occurring between and individual and his/her employer.
    International SOS Online reserves the right to change this policy at any time by notifying users through its website of the existence of a new privacy statement. This statement and the policies outlined herein are not intended to and do not create any contractual or other legal rights in or on behalf of any party.
    Should you have any questions or enquiries about the way information is handled by International SOS Online, or if you feel that International SOS Online is not complying with the standards quoted in this statement, you should contact our privacy staff by e-mail at: privacy@internationalsos.com.
    

SAFE HARBOR

This Statement specifically applies to organizations requiring compliance with the European Commission Data Privacy Policy.

What is the Safe Harbor and how is it related to the European data privacy directive?

The European Commission's Directive on Data Protection went into effect in October 1998, prohibiting the transfer of personal data to non-European Union nations that do not meet the European "adequacy" standard for privacy protection. While the United States and the European Union share the goal of enhancing privacy protection for their citizens, the United States and the European Union adopt different approaches to data privacy. In order to bridge these different privacy approaches and provide a streamlined means for U.S. organizations to comply with the Directive, the U.S. Department of Commerce in consultation with the European Commission developed a "Safe Harbor" framework. Complying with the Safe Harbor's set of principles - approved by the EU in July of 2000 - is a way for U.S. companies to certify that they provide "adequate" privacy protection, as defined by the Directive. Consistent with its commitment to protect personal privacy, International SOS Online adheres to the Safe Harbor Principles.

International SOS Online processes information from the European Union according to the Safe Harbor Framework and is so registered by the Department of Commerce. To find out more about Safe Harbor you can visit the Department of Commerce's website at http://www.export.gov/safeharbor/.

Last update: 03/02/2006