Consumer Health Data Privacy Policy

Updated: March 31, 2024

This Consumer Health Data Privacy Policy (“Consumer Health Data Privacy Policy”) supplements Brookdale’s Privacy Policy (“Privacy Policy”). For the purpose of this Consumer Health Data Privacy Policy, consumer health data is defined as, “personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status. For the purposes of this definition, physical or mental health status includes:

individual health conditions, treatment, diseases, or diagnoses;
social, psychological, behavioral, and medical interventions;
health-related surgeries or procedures, diagnostic testing, and treatment;
use or purchase of prescribed medication;
bodily functions, vital signs, symptoms, or related measurements;
gender-affirming care information;
reproductive or sexual health information;
biometric and genetic data;
precise location information that could reasonably indicate a consumer's attempt to acquire or receive health services or supplies;
data that identifies a consumer seeking health care services; and
any information that Brookdale may processes to associate or identify a consumer with the data that is derived or extrapolated from non-health information to infer or derive data related to the above health information.

Consumer health data does not include personal information that is used to engage in public or peer-reviewed scientific, historical, or statistical research that adheres to all other applicable ethics and privacy laws and is monitored or governed by an independent oversight entity.

If you are using our services in connection with our HIPAA covered services, please refer to our HIPAA Notice of Privacy Practices, which describes how we use and disclose your protected health information (“PHI”), your rights and our legal duties with respect to PHI, and how you may exercise your rights. This Consumer Health Data Privacy Policy only covers Consumer Health Data, which does not include PHI. Likewise, our HIPAA Notice of Privacy Practices only covers PHI and does not cover Consumer Health Data.

Please visit our Privacy Policy, which describes how we use and disclose your personal information, our legal duties with respect to your personal information, and your rights with respect to your personal information and how you may exercise them.

CONSUMER HEALTH DATA WE COLLECT

Brookdale may collect the below-mentioned pieces of consumer health data for the purpose of providing our services and products to our residents and potential residents. In our assisted living communities and skilled nursing communities much of this information is required by state and federal law to obtain and record.

Categories of Information	Categories of Sources	Business or Commercial Purposes for Collection
Individual health conditions or status, treatment, diseases, or diagnosis.	· Directly from consumer · Healthcare providers · Third party service providers · Referral agencies	· Provide our services · Provide information to you regarding our services · Comply with applicable laws, regulations or statutory requirements · Conduct internal investigations, audits and data analysis
Social, psychological, behavioral, or medical interventions.	· Directly from consumer · Healthcare providers · Third party service providers · Referral agencies	· Provide our services · Provide information to you regarding our services · Comply with applicable laws, regulations or statutory requirements · Conduct internal investigations, audits and data analysis
Health-related surgeries or procedures.	· Directly from consumer · Healthcare providers · Third party service providers · Referral agencies	· Provide our services · Provide information to you regarding our services · Comply with applicable laws, regulations or statutory requirements · Conduct internal investigations, audits and data analysis
Use or purchase of prescribed medication.	· Directly from consumer · Third party service providers · Healthcare providers · Referral agencies	· Provide our services · Provide information to you regarding our services · Comply with applicable laws, regulations or statutory requirements · Conduct internal investigations, audits and data analysis
Bodily functions, vital signs, symptoms, or measurements of the information described herein.	· Directly from consumer · Third party service providers · Healthcare providers · Referral agencies	· Provide our services · Provide information to you regarding our services · Comply with applicable laws, regulations or statutory requirements · Conduct internal investigations, audits and data analysis
Diagnoses or diagnostic testing, treatment, or medication.	· Directly from consumer, Third party service providers, Healthcare providers, Third party lead generators, and Referral agencies	· Provide our services · Provide information to you regarding our services · Comply with applicable laws, regulations or statutory requirements · Conduct internal investigations, audits and data analysis
Data that identifies a consumer seeking health care services.	Directly from consumer, Third party service providers, Healthcare providers, Third party lead generators, Referral agencies, and Social media platforms	· Provide our services · Provide customer service · Provide information to you regarding our services · Conduct internal investigations, audits and data analysis · Provide consumers with promotional materials regarding Brookdale programs and events
Any information that we, or our respective third party vendors, process to associate or identify a consumer with the data described above that is derived or extrapolated from nonhealth information (such as proxy, derivative, inferred, or emergent data by any means, including algorithms or machine learning).	Directly from consumer, Healthcare providers, Third party lead generators	· Provide our services · Provide customer service · Provide information to you regarding our services · Conduct internal investigations, audits and data analysis · Provide consumers with promotional materials regarding Brookdale programs and events

Information about your health conditions, treatments, diseases, or diagnoses – this may include but is not limited to: physical characteristics or descriptions, health history, discharge summaries, health assessments or other medical information.
Social, psychological, behavioral, and medical interventions – this may include but is not limited to: physical characteristics or descriptions, health history, discharge summaries, health assessments or other medical information.
Health-related surgeries or procedures, diagnostic testing, and treatment – this may include but is not limited to: physical characteristics or descriptions, health history, discharge summaries, health assessments or other medical information.
Use or purchase of prescribed medication – this may include but not limited to medication orders, discharge summaries, health assessment, or health history.
Bodily functions, vital signs, symptoms, or related measurements – this may include but is not limited to: physical characteristics or descriptions, health history, discharge summaries, health assessments or other medical information.
Data that identifies a consumer seeking our services – This may include but is not limited to: physical characteristics or descriptions, health history, discharge summaries, health assessments or other medical information
Any information that we process to associate or identify a consumer with the data described above that is derived or extrapolated from non-health information (such as proxy, derivative, inferred, or emergent data by any means, including algorithms or machine learning) – This may include but is not limited to: inferences, such as information, data, assumptions, or conclusions derived from facts, evidence, or another source of information or data reflecting your preferences, characteristics, behavioral expressions, predispositions, attitudes, intelligence, abilities, or aptitudes, such as website experiences you might be interested in.

We do not consider Consumer Health Data to include information that can no longer be used to identify a specific natural person, whether in combination with other information or otherwise. For example, de-identified or aggregated consumer information.

Additionally, the following types of information are not considered Consumer Health Data:

publicly available information from government records; and
information excluded from the applicable data privacy law’s scope, including but not limited to PHI covered by HIPAA and information derived from PHI that is de-identified in accordance with HIPAA.

If we combine non-personally identifiable information with Consumer Health Data, we will treat such information appropriately, but not all rights may apply to the non-personally identifiable information portion.

HOW WE COLLECT INFORMATION

There are several different ways Brookdale collects consumer health data. The categories of sources in which may have collected your personal information includes the following:

Directly from you or your authorized/legal representatives, family members and caregivers via conversations, your interaction on our website, mail, e-mail, faxes, voicemails, and any documentation provided by you
Business transactions where we may buy, merge or partner with other companies or businesses, and in doing so, we would acquire consumer health data
Healthcare providers involved in your care such as your primary care physician, hospice or home health provider, or hospital
Third Parties who provide digital marketing and analytic services
Social media applications such as X (formerly known as Twitter), Facebook, or Pinterest
Referral agencies
Government agencies

HOW WE USE COLLECTED CONSUMER HEALTH DATA

The consumer health data collected by us may be used in several ways including for the following business and commercial purposes:

Providing our services;
·Fulfilling the purposes for which the information was provided (e.g., to perform on a contract), to identify you in order to respond to requests, provide services or products, personalize information we provide to you, or otherwise as described below;
Communicating with you about our services or our relationship;
Providing customer service;
Providing you with promotional materials such as notifying you regarding certain services we provide, programs we provide and events that we are having;
Marketing our services;
To comply with any applicable laws, regulations or statutory requirements with providing our services;
Improving our services, including understanding what information and services consumers want the most;
Performing analytics and quality control;
To conduct internal investigations and audits;
To detect security incidents or monitor for inappropriate activity;
Protecting our rights and to protect your safety or the safety of others;
Researching and testing features and improvements;
To investigate fraud or respond to government inquiries;
Business transfers; in the unlikely event that a portion or substantially all of Brookdale’s assets are sold or transferred to a third party, consumer health data would likely be transferred business assets;
To comply with laws, regulations or other legal process; and
For other purposes with your consent.

CONSUMER HEALTH DATA THAT WE SHARE

Brookdale does not sell consumer health data. We may share, as defined by the laws of the state of Washington, with the third parties and affiliates listed below, each of the categories of consumer health data described above to provide you with the products and services you request, for any purpose for which you provide consent, or as necessary to comply with applicable law. Third parties do not include vendors whom we contract with to help provide you with products and service you request.

Affiliates – Brookdale Senior Living Inc. subsidiaries and affiliates who provide services throughout the make-up of the company. A list of the affiliates can be found by clicking here.
Government, regulatory, law enforcement agencies and officials, and parties to litigation – to comply with applicable law, regulation, legal process or confirmed governmental requests and to investigate and defend against any third-party claims.
Third Parties – third party healthcare providers for treatment purposes, third party service providers such as IT service providers, marketing and analytic service providers, third party advertising partners, or other third parties with your consent.
Business Partners – With business partners to when implementing a potential merger, acquisition, reorganization or other business transaction.

Additional Rights of Individuals in Washington and Nevada

If you live or receive services in Washington or Nevada, you may have certain rights with respect to Consumer Health Data that we have collected and used under certain circumstances, which may include the following:

Right to Know About Consumer Health Data Collected, Shared, or Sold. Residents and consumers in the states of Washington and Nevada have the right to request that Brookdale confirm whether it collects, uses, shares, or sells your Consumer Health Data. This is called the “Right to Know”.
Right to Access. The right to confirm whether Brookdale is collecting, sharing or selling consumer health data and right to access and obtain a copy of the consumer health data collected in a portable and, to the extent technically feasible, readily usable format. Additionally consumers may receive a list of all third parties and affiliates with whom Brookdale has shared their consumer health data. A list of Brookdale affiliates can be found by clicking here and view our 10-K.
Right to Withdraw Consent. The right to withdraw any previous consent received by Brookdale regarding the collection and sharing of consumer health data. For more information about your right to withdraw consent, please see your state’s section below.
Right to Request Deletion. The right to request deletion of your consumer health data provided by you or obtained by Brookdale.
Right to Appeal. The right to appeal if your privacy rights-related request is denied in whole or in part.
The Right to Non-Discrimination for the Exercise of a Consumer’s Privacy Rights. You have a right not to receive discriminatory treatment by Brookdale for exercising any of your privacy rights conferred by your state’s consumer privacy laws. Brookdale will not discriminate against any consumer because such person exercised any of the consumer’s rights under these privacy laws, including, but not limited to:
- denying goods or services;
- charging different prices or rates for goods and services, including through the use of discounts or other benefits or imposing penalties;
- providing a different level or quality of goods or services; or
- suggesting that the consumer will receive a different price or rate for goods or services or a different level or quality of goods or services. Brookdale may, however, charge a different price or rate, or provide a different level or quality of goods or services, if that difference is related to the value provided to you by your data.

Please note that these specific rights awarded to Washington and Nevada residents, or consumers seeking our services in those states, will not apply if the consumer health data Brookdale collects from you or if all of the information we collect is exempt from the statute (for example, the MHMDA does not protect information that is already protected by certain other privacy laws, and does not protect information that is already publicly available). Additionally, these specific privacy rights do not apply to Brookdale employees, applicants or sub-contractors.

To make a request regarding one of the aforementioned Consumer Health Data Rights, please follow the instructions below under the section titled “Exercising Your Rights”.

When you exercise your right to know, you can expect the following:

We will verify your identity. You will need to provide us with certain information such as your name, email address, physical address, or other information, as relevant, so that we can verify that you are who you say you are. Which information may depend on the type and sensitivity of information requested. If we are unable to authenticate your request, e.g., confirm that you are who you say you are, we are not required to comply with your request and we may request additional information to authenticate you and your request.
We will confirm our receipt of your request within 10 days. If you have not received a response within a few days after that, please let us know by contacting us at the webpage or phone number listed below.
Brookdale will respond to your request without undue delay, but in all cases within 45 days of receipt of the request submitted as described in the “Exercise Your Rights” section below. The response period may be extended by an additional 45 days if reasonably necessary, but we will inform you of any such extension within the initial 45-day period.
If Brookdale declines to take action regarding your request, we will let you know within 45 days of receipt of the request the reasons for declining to take the action requested and provide you with instructions for how to appeal the decision.
You will not be charged for submitting up to two consumer requests per year unless your request is clearly unfounded, excessive, or repetitive. In those events, we may charge you a reasonable fee to cover our administrative costs or decline to act on the request.
If we refuse to take action on your request, you can appeal our determination. You can submit an appeal by contacting us as provided in the Exercising Your Rights section. We will respond to your appeal within 45 days of receipt and provide a written explanation of the reasons for the decision. If your appeal is denied, we will provide you with information on how to contact the relevant Attorney General to submit a complaint. For more information about your right to appeal, please see your state’s section below. You may make an appeal as described in the Exercise Your Rights section below.

When you exercise your right to access your information, you can expect the following:

We will verify your identity. You will need to provide us with certain information such as your name, email address, physical address, or other information, as relevant, so that we can verify that you are who you say you are. Which information may depend on the type and sensitivity of information to be accessed. If we are unable to authenticate your request, e.g., confirm that you are who you say you are, we are not required to comply with your request and we may request additional information to authenticate you and your request.
We will confirm our receipt of your request within 10 days. If you have not received a response within a few days after that, please let us know by contacting us at the webpage or phone number listed below.
Brookdale will respond to your request without undue delay, but in all cases within 45 days of receipt of the request submitted as described in the “Exercise Your Rights” section below. The response period may be extended by an additional 45 days if reasonably necessary, but we will inform you of any such extension within the initial 45-day period.
If Brookdale declines to take action regarding your request, we will let you know within 45 days of receipt of the request the reasons for declining to take the action requested and provide you with instructions for how to appeal the decision.
You will not be charged for submitting up to two consumer requests per year unless your request is clearly unfounded, excessive, or repetitive. In those events, we may charge you a reasonable fee to cover our administrative costs or decline to act on the request.
If we refuse to take action on your request, you can appeal our determination. You can submit an appeal by contacting us as provided in the Exercising Your Rights section. We will respond to your appeal within 45 days of receipt and provide a written explanation of the reasons for the decision. If your appeal is denied, we will provide you with information on how to contact the relevant Attorney General to submit a complaint. For more information about your right to appeal, please see your state’s section below. You may make an appeal as described in the Exercise Your Rights section below.

When you exercise your right to request deletion, you can expect the following:

We will verify your identity. You will need to provide us with certain information such as your name, email address, physical address, or other information, as relevant, so that we can verify that you are who you say you are. Which information may depend on the type and sensitivity of information to be deleted. If we are unable to authenticate your request, e.g., confirm that you are who you say you are, we are not required to comply with your request and we may request additional information to authenticate you and your request.
We will confirm our receipt of your request within 10 days. If you have not received a response within a few days after that, please let us know by contacting us at the webpage or phone number listed below.
Brookdale will respond to your request without undue delay, but in all cases within 30 days. Deletion requests may be delayed for information stored or archived on our backup systems. In certain cases, a request for deletion may be denied, for example, if we cannot verify your identity; the law requires that we maintain the information (e.g., to comply with federal and state medical record retention requirements); or if we need the information for internal purposes such as to continue to provide you services. If we deny your request, we will explain why we denied it, and delete any other information that is not protected from deletion.
If Brookdale declines to take action regarding your request, we will let you know within 30 days of receipt of the request the reasons for declining to take the action requested and provide you with instructions for how to appeal the decision.
You will not be charged for submitting up to two consumer requests per year unless your request is clearly unfounded, excessive, or repetitive. In those events, we may charge you a reasonable fee to cover our administrative costs or decline to act on the request.
If we refuse to take action on your request, you can appeal our determination. You can submit an appeal by contacting us as provided in the Exercising Your Rights section. We will respond to your appeal within 45 days of receipt and provide a written explanation of the reasons for the decision. If your appeal is denied, we will provide you with information on how to contact the relevant Attorney General to submit a complaint. For more information about your right to appeal, please see your state’s section below. You may make an appeal as described in the Exercise Your Rights section below.
Residents and consumers in the states of Washington and Nevada have a right to appeal if the consumer’s privacy rights-related request is denied in whole or in part. For more information about your right to appeal, please see your state’s section below. You may make an appeal as described in the Exercise Your Rights section below.

WASHINGTON CONSUMER HEALTH DATA RIGHTS

The Washington My Health My Data Act (“MHMDA”) is a law that is intended to provide consumers in the state of Washington privacy rights and protection regarding their consumer health data. For further details on the types of Consumer Health Data we have collected about you, the sources of that information, how we use the information (e.g., our business or commercial purposes for collecting, sharing or selling Consumer Health Data), other individuals and business with whom we share Consumer Health Data, and the categories of Consumer Health Data that we have collected or shared about you, please visit the “Consumer Health Data We Collect” And “Disclosing Your Consumer Health Data” sections above.

For more information about your rights in Washington, see the “Additional Rights of Individuals in Washington and Nevada” section above. These rights will not apply, however, if Brookdale does not collect any Consumer Health Data about you or if all of the information we collect is exempt from the statute (for example, the MHMDA does not protect information that is already protected by certain other privacy laws like HIPAA and does not protect information that is already publicly available).

To make a request regarding one of the aforementioned MHMDA data rights, please follow the instructions below under the section titled “Exercising Your Rights”. In addition, in lieu of appealing a determination, you can go to the Washington Attorney General’s website by clicking the following link to submit a complaint online: Washington Attorney General Online Complaint.

NEVADA CONSUMER HEALTH DATA RIGHTS

Nevada’s Consumer Health Data Privacy Law is a law that is intended to provide consumers in the state of Nevada privacy rights and protection regarding their consumer health data. For further details on the types of Consumer Health Data we have collected about you, the sources of that information, how we use the information (e.g., our business or commercial purposes for collecting, sharing or selling Consumer Health Data), other individuals and business with whom we share Consumer Health Data, and the categories of Consumer Health Data that we have collected or shared about you, please visit the “Consumer Health Data We Collect” And “Disclosing Your Consumer Health Data” sections above.

For more information about your rights in Nevada, see the “Additional Rights of Individuals in Washington and Nevada” section above.

Please note that these specific rights awarded to Nevada residents will not apply if the consumer health data Brookdale collects from you, or if all of the information we collect, is exempt from the statute (for example, Nevada’s Consumer Health Data Privacy Law does not protect information that is already protected by certain other privacy laws, and does not protect information that is already publicly available). Additionally, these Nevada specific privacy rights do not apply to Brookdale employees, applicants or sub-contractors.

To make a request regarding one of the aforementioned Nevada Consumer Health Data Rights, please follow the instructions below under the section titled “Exercising Your Rights”. If you appeal a determination by Brookdale and your appeal is denied, we will provide you with information on how to contact the Nevada Attorney General to submit a complaint or you can go to the Nevada Attorney General’s website by clicking the following link to submit a complaint online: Nevada Attorney General Online Complaint.

EXERCISING YOUR RIGHTS

You can exercise the rights mentioned in this Policy by submitting a verifiable consumer request by filling out a request form by clicking here, calling toll-free at 1-800-236-3454 or emailing us at partner@brookdale.com. To help protect your privacy and maintain security, we will take steps to verify your identity before granting you access to your personal information or complying with your request. If you request access to, correction of and/or deletion of your personal information, we may require you to provide additional information to help us identify you.

Consumers may designate an authorized agent to make a request on their behalf. We will deny requests from agents that do not submit proof of authorization from you. To verify that an authorized agent has authority to act for you, we may require a copy of a power of attorney or require that you provide the authorized agent with written permission and verify your own identity with us.

MODIFICATIONS TO OUR CONSUMER HEALTH DATA PRIVACY POLICY

We may change, modify, add and/or delete all or portions of this Consumer Health Data Privacy Policy at any time, at our discretion, and modifications are effective upon being posted on Brookdale’ Resources. If we decide to change this Consumer Health Data Privacy Policy, we will post those changes on the home page of Brookdale’s website and any other places we deem appropriate so that you are aware of what information we collect, how we use it, and under what circumstances, if any, we disclose it. You are responsible for reviewing this Consumer Health Data Privacy Policy periodically to ensure that you are aware of any changes to it. If we make material changes to this Consumer Health Data Privacy Policy, we will notify you by means of a notice on our website’s home page.

CONTACT US

We welcome your questions, comments and feedback pertaining to your privacy. In the event you have any questions and need to contact us regarding your privacy, please contact us by calling us at 1-800-236-3454, emailing us at partner@brookdale.com, visiting our website at https://www.brookdale.com/en/privacy-policy.html, or mailing us your concerns to:

Brookdale Senior Living Inc.

Attn: Privacy Officer

105 Westwood Place, Suite 400

Brentwood, TN 37027

privacyofficer@brookdale.com