SAGE Dining Services, Inc. Consumer Health Data Privacy Notice

SAGE Dining Services, Inc. Consumer Health Data Privacy Notice Last Updated: March 20, 2025 Introduction This Consumer Health Data Privacy Notice (“Notice”) supplements SAGE Dining Services, Inc.’s (“SAGE”) Privacy Statement regarding our processing of health-related data as required under certain state health data privacy laws. How We May Collect Consumer Health Data SAGE provides culinary catering services for corporate, academic, and other types of institutions. We do not collect health-related data (“health data”) in the ordinary course of providing our services but from time to time, we may collect health data from you or other individuals who submit a customer service request or complaint related to your health in conjunction with dining in or at facilities that we service. Such health data may include:

• Health conditions, treatment, diseases, or diagnoses;
• Data pertaining to physical abilities or needs;
• Information about allergies, medical conditions, or clinical sensitivities, for example, in conjunction with indicated menu preferences or a dietary profile;
• Information about unexpected or negative physical experiences or adverse reactions related to consuming food from, or visiting, one of our client’s facilities; or
• Any other health-related data provided to us or of which we become aware.

How We Process Consumer Health Data

• We collect and use health data to respond to requests for customer support, to address complaints, to accommodate individual consumer needs, preferences, and requests.
• We will also process health data to investigate and respond to potential health and safety issues, client investigations, consumer claims, to administer insurance claims and other matters, comply with our regulatory obligations, to establish, exercise or defend a legal claim, and for any other purpose required or allowed under applicable law.

How We Disclose Consumer Health Data

• We may disclose health data to health authorities to support incident reporting, investigations or to follow up on health-related complaints, with our insurers or the insurers of consumers or clients in relation to a claim where health data is directly relevant, with regulatory agencies that regulate our operations, and with other third parties where relevant or required to meet our legal obligations or adhere to other compliance requirements.
• We may also disclose health data to our clients if a complaint is submitted to us with health data specific to a consumer or incident at a client’s facility or location, or to enable them to respond to the request or complaint.
• We may use service providers to process health data on our behalf. Our agreements with our service providers include detailed data protection requirements and limit their processing of health data on our behalf to what is strictly required to provide services to us.
• We may also disclose health data if it has been called into question in conjunction with exercising or defending a legal claim and for any other purpose required or allowed under applicable law.
• We do not “sell,” “share,” or otherwise offer to make health data available to third parties nor do we use or allow health data to be used in marketing contexts.

Retention Consistent with the disclosures in our Privacy Statement, we will retain and use your health data for the length of time needed to carry out the purposes outlined in this Notice and in accordance with our record retention policies. Consumer Rights Related to Consumer Health Data If you are a consumer in a state with laws specifically offering you privacy rights over your health data, subject to certain exceptions, you may have certain rights related to your health data, including:

• Right to Access. You have the right to confirm whether we are processing your health data and to access your health data. As noted above, we do not share, sell, or offer to sell, health data.
• Right to Withdraw Consent. If we collect, use, or share your health data based on your consent, you have the right to withdraw such consent.
• Right to Delete. You have the right to request that we delete health data that we maintain about you.

Please note, we will verify your identity as permitted or required under applicable law before we process your request. If we believe we need further information to verify your request, we may ask you to provide additional information to us. In some cases, we may be unable to fulfill your request. If your rights request is denied, applicable law may give you a right to lodge an appeal with us. The response to your rights request will inform you of any appeal rights you may have and tell you how you can exercise them. You may request to exercise these rights by contacting us as set forth below. SAGE Dining Services, Inc. Attn: Legal Department 1402 York Road Lutherville, Maryland 21093 Telephone: 410-339-3950 E-mail: privacyrequest@sagedining.com Changes to this Notice We may revise this Notice from time to time. If we change this Notice, we will provide notice to you, as required by law, by posting those changes here, as indicated by the Last Updated Date above, and/or by contacting you, such as, by sending you an e-mail. You should check here regularly for the most up-to-date version of this Notice.