Atria Consumer Health Data Privacy Policy

Effective Date: April 23, 2024

This Consumer Health Data Privacy Policy supplements our Privacy Policy and applies to the Consumer Health Data that Atria Senior Living Inc., our subsidiaries, and our affiliates, which include Holiday by Atria and Coterie Luxury Senior Living (collectively, “Atria,” “we,” “our,” or “us”), processes when you visit or live in our senior living facilities, visit our websites, and otherwise interact with us offline (collectively, “Services”).

Washington
Other U.S. States
Policy Changes
Contact Us

Washington

This Washington Consumer Health Data Privacy Policy (“Washington Policy”) describes how Atria Processes the Consumer Health Data of Washington residents and individuals whose Consumer Health Data is Collected in Washington (“Washington Consumers”) pursuant to the Washington My Health My Data Act (“Washington Act”).

In the event of a conflict between any other policy, statement, or notice and this Washington Policy, this Washington Policy will prevail as to Consumer Health Data Collected under the Washington Act.

Capitalized terms that are not otherwise defined in this Washington Policy shall be defined as they are in the Washington Act.

Consumer Health Data We Collect, Use, and Disclose

“Consumer Health Data” means personal information that is linked or reasonably linkable to a Washington Consumer and that identifies the Washington Consumer’s past, present, or future physical or mental health status.

Atria Collects the following categories of Consumer Health Data about Washington Consumers:

• Individual health condition, treatment, disease, or diagnosis information;
• Social, psychological, behavioral, and medical intervention information;
• Health-related surgery or procedure information;
• Use or purchase of prescribed medication information;
• Bodily function, vital sign, symptoms, or measurement of physical or mental health status information;
• Diagnosis or diagnostic testing, treatment, or medication information;
• Gender-Affirming Care Information relating to seeking or obtaining Gender-Affirming Care Services;
• Reproductive or Sexual Health Information relating to seeking or obtaining Reproductive or Sexual Health Services;
• Biometric Data that is generated from the measurement or technological processing of an individual’s physiological, biological, or behavioral characteristics and that identifies a Consumer;
• Genetic Data that concerns a Washington Consumer’s characteristics;
• Precise Location Information that could reasonably indicate a Washington Consumer’s attempt to acquire or receive health services or supplies;
• Data that identifies a Washington Consumer seeking Health Care Services; and
• Information Processed to associate or identify a Washington Consumer with the data listed above that is derived or extrapolated from non-health information, such as proxy, derivative, inferred, or emergent data by any means, including algorithms or machine learning.

We may Collect the Washington Consumer Health Data described above online and offline in a few different ways:

• Washington Consumer Health Data that you provide. We may Collect Washington Consumer Health Data that you provide when you use our Services, engage with customer service on phone calls, provide us Washington Consumer Health Data from a connected device or profile, and any other way that you may be able to interact with us.
• Washington Consumer Health Data collected from devices you use to connect with us or use our Services. Atria Collects Washington Consumer Health Data through our websites and apps and automatically from devices you use to connect to our Services. For more information about this, please see our “Cookies and Tracking Technologies” section in our Privacy Policy linked here.
• Washington Consumer Health Data collected with business partners. We sometimes work with other organizations to provide you with our Services.
• Washington Consumer Health Data from third-party sources. We may Collect Washington Consumer Health Data from third-party sources including, but not limited to, third-party service providers, your family members, and healthcare professionals.
• Drawn from the other information we Collect. Depending on your use of the Services, we may make inferences related to Washington Consumer Health Data.

Consumer Health Data Collection and Use Purposes

Atria Collects and uses the Consumer Health Data described above to the extent necessary to provide Services requested by the Washington Consumer or with the Washington Consumer’s Consent, including:

• Provide the Services requested by Washington Consumers;
• Manage, operate, and improve the Services, such as providing care services, responding to inquiries, and offering educational information;
• Fulfill your requests, orders, or transactions related to the Services, such as providing customer support;
• For legal and regulatory purposes, including to manage legal responses and litigation; and
• Prevent, detect, protect against, and respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any activity that is illegal under Washington state or federal law; comply with law; and preserve the integrity and security of our systems; and investigate, report, or prosecute those responsible for any illegal action under Washington state or federal law.

Consumer Health Data We Share and Disclose

Atria Shares the categories of Consumer Health Data described above to the extent necessary to provide Services requested by the Washington Consumer, with the Washington Consumer’s Consent, or as legally required, including to:

• Individuals or entities to whom Washington Consumers instruct us to disclose their Consumer Health Data;
• Insurance institutions, including Atria insurance providers; and
• Federal or Washington state regulators, where required.

We may also disclose Consumer Health Data to:

• Our Processors to provide Services in a manner consistent with the purpose for which the Consumer Health Data was Collected and disclosed;
• Parties with whom the Washington Consumer has a direct relationship for the purpose of providing Services requested by the Washington Consumer, in circumstances where we maintain control and ownership of the data and the party only uses the Consumer Health Data at our direction for the purpose for which the Consumer Health Data was Collected or Consented to; and
• External parties as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the party may assume control of all or part of Atria’s assets.

We will not Sell Consumer Health Data without first obtaining valid authorization from the applicable Washington Consumer.

Your Washington Consumer Health Data Rights

If you are a resident of Washington, you have the right to submit certain requests relating to your Consumer Health Data as described below. To exercise any of these rights, please submit a request to CAprivacyrequest@atriaseniorliving.com with a subject line of “Washington Consumer Health Data Privacy Request” or call us at (866) 335-3561. Please note that, if you submit a request, you may be asked to log into your account or to verify your identity. If you would like to request us to reexamine requests we were unable to fulfill, please submit a request to CAprivacyrequest@atriaseniorliving.com.

Washington Consumers have the right to:

• Confirm whether we are Collecting, Sharing, or Selling your Consumer Health Data;
• Access their Consumer Health Data, including a list of all Third Parties and Affiliates with whom we have Shared or Sold the Consumer Health Data and an active email address or other online mechanism to contact these parties;
• Withdraw Consent from our Collection and Sharing of their Consumer Health Data; and
• Request that their Consumer Health Data be deleted.

If you choose to exercise any of your privacy rights under the Washington Act, you also have the right not to receive discriminatory treatment by us.

Washington Consumers that have been denied one of the above enumerated rights have the right to request an appeal.

Other U.S. States

Certain information may be considered “Consumer Health Data” under additional applicable U.S. privacy laws (collectively “Consumer Health Data Laws”), including, but not limited to, Nevada’s and Connecticut’s Consumer Health Data Laws.

Capitalized terms used in this section that are not otherwise defined in this section shall be defined as they are in Consumer Health Data Laws.

Consumer Health Data We Collect, Use, and Disclose

Atria may Collect the following categories of Consumer Health Data:

• Information relating to any health condition or status, disease, or diagnosis;
• Information relating to social, psychological, behavioral, or medical interventions;
• Information relating to surgeries or other health-related procedures;
• Information relating to the use or acquisition of medication;
• Information relating to bodily functions, vital signs, or symptoms;
• Information relating to Reproductive or Sexual Health Care;
• Information relating to Gender-Affirming Care;
• Biometric Data or Genetic Data related to any of the above;
• Information related to the Precise Geolocation Information of a Consumer that Atria uses to indicate an attempt by a Consumer to receive Health Care Services or Products; and
• Information listed above that is derived or extrapolated from information that is not Consumer Health Data, including, without limitation, proxy, derivative, inferred, or emergent data derived through an algorithm, machine learning, or any other means.

We may Collect the Consumer Health Data described above online and offline in a few different ways:

• Consumer Health Data that you provide. We may Collect Consumer Health Data that you provide when you use our Services, engage with customer service on phone calls, provide us Consumer Health Data from a connected device or profile, and any other way that you may be able to interact with us.
• Consumer Health Data collected from devices you use to connect with us or use our Services. Atria Collects Consumer Health Data through our websites and apps and automatically from devices you use to connect to our Services. For more information about this, please see our “Cookies and Tracking Technologies” section in our Privacy Policy linked here.
• Consumer Health Data collected with business partners. We sometimes work with other organizations to provide you with our Services.
• Consumer Health Data from third-party sources. We may Collect Consumer Health Data from third-party sources including, but not limited to, third-party service providers, your family members, and healthcare professionals.
• Drawn from the other information we Collect. Depending on your use of the Services, we may make inferences related to Consumer Health Data.

Consumer Health Data Collection and Use Purposes

Atria may Collect, use, Share, and disclose the Consumer Health Data of Consumers described above to the extent necessary to provide Services requested by the Consumer, with the Consumer’s Consent, or as legally required, including:

• To provide the Services requested by Consumers;
• To manage, operate, and improve the Services, such as providing care services, responding to inquiries, and offering educational information;
• To fulfill your requests, orders, or transactions related to the Services, such as providing customer support;
• For legal and regulatory purposes, including to manage legal responses and litigation; and
• To comply with law enforcement activities or as expressly authorized by federal or state law.

We may also Collect and use Consumer Health Data for our internal business purposes, such as data analysis, audits, developing new products, enhancing our Services, identifying usage trends, and determining the effectiveness of our promotional campaigns. We may also use inferences drawn from Consumer Health Data to create a profile reflecting your preferences.

Third Parties do not Collect Consumer Health Data over time and across different Internet websites or online services.

Consumer Health Data We Share

Atria Shares the categories of Consumer Health Data described above to the extent necessary to provide Services requested by the Consumer, with the Consumer’s Consent, or as legally required, including to:

• Our Processors to provide Services in a manner consistent with the purpose for which the Consumer Health Data was Collected and disclosed;
• Parties as directed by the Consumer or where the Consumer intentionally uses Atria to interact with the third party to whom the Consumer Health Data is provided or disclosed;
• Insurance institutions, including Atria insurance providers;
• Where the Consumer has intentionally made the Consumer Health Data available to the general public through mass media that was not restricted to a specific audience; and
• External parties as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the party may assume control of all or part of Atria’ assets.

We will not Sell Consumer Health Data without first obtaining valid authorization from the applicable Consumer.

Your Consumer Health Data Rights

Consumers have the right to submit certain requests relating to your Consumer Health Data as described below. To exercise any of these rights, please submit a request to CAprivacyrequest@atriaseniorliving.com with a subject line of “Consumer Health Data Privacy Request” or call us at (866) 335-3561. Please note that, if you submit a request, you may be asked to log into your account or to verify your identity. If you would like to request us to reexamine requests we were unable to fulfill, please submit a request to CAprivacyrequest@atriaseniorliving.com.

Depending on whether you are a Consumer of an applicable Consumer Health Data Law, you may have the right to:

• Confirm whether we are Collecting, Selling, or Sharing Consumer Health Data concerning the Consumer;
• Access or review such Consumer Health Data, including a list of all Third Parties with whom we have Sold or Shared the Consumer Health Data;
• Make changes to or correct such Consumer Health Data;
• Where Consent is required, withdraw Consent from our Collection, Selling and Sharing (including use for targeted advertising) of Consumer Health Data concerning the Consumer;
• Request that the Consumer’s Consumer Health Data be deleted; and
• Obtain your Consumer Health Data in a transportable format.

If you choose to exercise any of your privacy rights under the Consumer Health Data Laws, you also have the right not to receive discriminatory treatment by us.

Policy Changes

By using our Services, you consent to the terms of this Consumer Health Data Privacy Policy, our Privacy Policy, and our Terms of Use. We may change our Consumer Health Data Privacy Policy from time to time.

Contact Us

If you have a question about this Consumer Health Data Privacy Policy or about Atria’s information practices, you may email us at CAprivacyrequest@atriaseniorliving.com. You also may contact us at:

Atria Senior Living
Attention: Privacy Inquiry
300 East Market Street
Suite 100
Louisville, KY 40202