The privacy program is guided by key privacy principles that inform how American handles and protects the personal information in our care, such as responsi - bility, transparency, security and choice. Our Privacy Office regularly conducts privacy impact assessments of business processes and supporting information technology (IT) systems that process personal data. The primary role of these assessments is to identify and remediate associated privacy risks. Information obtained from privacy impact assessments is used to populate our personal data inventory, which details what personal data our company stores, how it is used, where it is stored, with whom it is shared and for how long it is retained. We supplement these efforts by coordinating with our IT department to implement privacy design requirements into the architecture and operation of our systems that store and process personal data. We also use these processes to fulfill our legal requirements for handling data rights requests and data disclosures via our internal and external privacy policies and statements. Our team members take privacy training courses annually, and the Privacy Office conducts individual training sessions with different business units each year that address a variety of privacy issues. We also coordinate closely with our Vendor Management and Corporate Legal functions, which provide input on privacy terms and provisions in our agreements with our business partners and vendors to ensure that privacy issues are appropriately addressed. For operational performance data, see page 54 . Providing Travel Resources to Help Navigate the Persistent COVID-19 Pandemic As the pandemic extended into its second year — with travel requirements shifting frequently depending on destination and other factors — American provided our customers with the resources they needed. We expanded the use of Sherpa, an independent travel resource, to provide updates on international travel requirements due to COVID-19 variants. We also continued to partner with VeriFLY to help customers understand and verify their travel requirements. Its mobile health wallet makes it easy for passengers to upload negative COVID-19 test results, vacci- nation records and forms they need to get verified status for travel. Our customers can also use the app to get mobile boarding passes and take advantage of dedicated and expedited check-in lanes at several airports. Customers traveling internationally can now access our Ready to Fly checklist when viewing their eligible reservations on aa.com and the American Airlines mobile app. The checklist outlines everything our customers need, including test and vaccination requirements, along with options to submit digital documentation and contact tracing information. Ready to Fly also links to the VeriFLY app. Customers can now check-in online at aa.com, through the American Airlines mobile app or at the airport kiosk after receiving their green check mark from VeriFLY and head straight to the gate. These new digital options save customers time at the airport and give them peace of mind that they are ready to fly before arriving at the airport. American also partnered with trusted COVID-19 testing providers to allow customers to take a test at a clinic, at home before their trip or to order a test kit to pack for their return trip. Among our clinic partners, both GoHealth and CareNow each offer more than 150 locations in the United States. For at-home testing before a trip, customers can order a kit from LetsGetChecked. It offers a 48-hour turnaround time for results. Qured, eMed and Optum all provide packable test kit options for return trips. AMERICAN AIRLINES ESG REPORT 2021 50 \\ Indexes & Data \\ Team Members \\ Climate Change \\ Safety \\ ESG Strategy CEO Message SERVING OUR CUSTOMERS \\ Customers