Consumer Health Data Privacy Policy

Effective Date: June 30, 2024

Era Living, LLC (“Era Living,” “we,” “us”) has adopted this Consumer Health Data Privacy Policy (the “Policy”) to comply with the Washington My Health My Data Act (the “MHMDA”). This Policy describes how certain information, called “consumer health data,” may be used and disclosed; and how you can exercise your rights with respect to this information. This Policy pertains to consumer health data of Washington residents, and individuals whose consumer health data is collected in Washington. This Policy supplements our Privacy Policy, and in the event of a conflict between our Privacy Policy and this Policy, this Policy will prevail as to consumer health data under MHMDA.

Consumer health data includes personal information that is linked or reasonably linkable to a consumer, and that identifies the consumer’s past, present or future physical or mental health status. This includes information about your conditions, symptoms, treatments, diseases, surgeries, bodily functions, vital signs, and medication, among others. In our assisted living communities, recording this information may be required under state and federal laws. Consumer health data does not include publicly-available information, de-identified data, or information that is already protected under certain federal and state laws, such as Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) or the Uniform Health Care Information Act.

To the extent not excluded from MHMDA, we may now or in the future obtain data that falls into one the following categories of personal information:

To the extent necessary to provide a product or service that you have requested from us, we may collect your consumer health data without your explicit consent.

We obtain the categories of consumer health data listed above from the following categories of sources:

• Directly from you or your representative(s). For example, when you share your health history with us, or when we collect information about you during resident assessments and other health checkups.
• Indirectly from you. For example, when we obtain health-related information through automated measures, such as automated body temperature checks.
• Automatically as you navigate through our website. Information collected automatically may include IP addresses, device identifiers, and information collected through cookies, and other tracking technologies.
• From third parties, such as referral agencies and HIPAA-regulated health care providers that may share information about your health with us (e.g., your physician sharing your medical history with us after obtaining your consent).
• Government entities, such as Department of Social and Health Services and Veterans Health Administration, State Surveyors, and Washington State Long-Term Care Ombudsman Representatives.

We may use the consumer health data we collect in one or more of the following ways:

• To provide a product or service that you have requested from us.
• To further the purposes for which you provided consent, in connection with collecting or sharing your consumer health data.
• To provide you with support and to respond to your inquiries, including to investigate and address any health-related concerns with which you may need our assistance.
• To create, maintain, customize, and secure your profile information.
• To provide you with promotional materials, such as information about the services, programs, or events that may be relevant to you.
• To administer, provide, support, personalize, and develop our resident life enrichment programs; health and wellness services; and other services and products we offer.
• To prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any activity that is illegal under Washington state law or federal law; preserve the integrity or security of systems; or investigate, report, or prosecute those responsible for any such action that is illegal under Washington state law or federal law.
• To protect the confidentiality, integrity and accessibility of your consumer health data.
• To perform data analytics and quality control.
• For research and analysis, including to support resident safety programs and services, prepare incident reports, and develop and improve our website, products, and services.
• To conduct internal investigations and audits, investigate grievances and suspected violations of our internal policies.
• To comply with any applicable laws, regulations and statutory requirements (including any internal policy based on or reflecting legal or regulatory guidance, codes, or opinions; or law enforcement requests required by applicable law, court order, or governmental regulations).
• To exercise or defend our legal rights.
• To protect your safety or the safety of others.
• To evaluate or conduct a merger, acquisition, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as an ongoing concern or as part of bankruptcy, liquidation, or similar proceeding, in which information held by us is among the assets transferred.

We do not sell your consumer health data.

We may share the categories of the consumer health data listed above with select trusted parties in order to provide you with the products and services you requested from us, for any purpose for which you provided consent, or to comply with the law. We may share your consumer health data with the following categories of third parties:

• Our affiliates, if sharing between Era Living and Era Living-managed communities is needed for data processing or operational purposes. For example, we may share your data when making a referral to a related rehabilitation service provider; or where we share common data systems with our affiliates, subsidiaries or related companies;
• Healthcare providers, for treatment purposes;
• Other individuals, representatives and family members, as directed by you and your interactions with us;
• Other third parties, such as referral agencies, home health agencies, other long-term care providers, preferred pharmacy providers, state surveyors, Washington State Long-Term Care Ombudsman Representatives, Department of Social and Health Services and Veterans Health Administration, State Surveyors, mental health agencies, home health service providers, and other parties involved in providing care to our residents;
• Professional service providers (such as IT service providers, analytic service providers, advertising partners) where enabling access to data helps us provide our services and operate our business;
• Government, regulatory, and law enforcement agencies, if required by law;
• Parties to litigation.

Disclosures of the consumer health data to the vendors we contract with to help us provide you with products and services do not constitute sharing, as that term is defined in MHMDA.

Subject to limited exceptions, the MHMDA provides Washington residents and individuals whose consumer health data is collected in Washington with the following rights regarding your consumer health data:

• Right to Confirm and Access. You have the right to confirm whether we are collecting, sharing or selling your consumer health data; and to access such data.
• Right to Withdraw Consent. You have the right to withdraw consent for consumer health data collection and sharing. Please note that we may not be able to honor requests to withdraw consent to collect and share consumer health data that pertains to information that the state or federal laws or regulations require us to collect and share.
• Right to Request Deletion. You have the right to have your consumer health data deleted from our records. Please note that we may not be able to honor deletion requests pertaining to information that the state or federal laws or regulations require us to maintain. This may include, among others, residents’ records, administrative records, social work records, and billing records pertaining to the assisted living and/or memory care residents; and social work records for all residents. We also may not be able to honor deletion requests pertaining to information we require to continue providing services you have requested from us.

We will not discriminate against you for exercising any of the above rights. We will not attempt to re-identify any data that was previously de-identified.

Please note that these specific rights will not apply to any data that is exempt from MHMDA. For example, the MHMDA does not apply to publicly-available information or information that is protected by certain other privacy laws, such as HIPAA.

Making a Request. To exercise your rights under MHMDA, please submit a request by emailing us at privacy@eraliving.com. Please do not send any sensitive information such as your Social Security number, unless we specifically request it in our follow-up communication with you. If we do require sensitive information as part of the authentication process, we will advise you on what the information is, and recommend a more secure method of providing that information to us. Only you, or a person that you authorize to act on your behalf, may submit a request to exercise your MHMDA rights.

Responding to Requests. The law requires us to authenticate your identity. Once you have submitted a request, we will verify your identity and may need sensitive information from you as part of the authentication process. We will advise you on what the information is, and recommend a secure method for you to provide this information to us. Once your identity is authenticated, we will respond to your request within forty-five (45) days of its receipt. If we require more time (up to a total of ninety (90) days), we will inform you of the reason and the extension period in writing. If we are unable to authenticate your request to exercise consumer rights using commercially reasonable efforts, while we are not required to comply, we may request additional information from you.

We may need to decline deletion requests if the law requires that we maintain the particular kind of information you requested us to delete, or if we need the information to continue providing the services you requested from us.

You are entitled to receive information in response to your request free of charge, up to twice per year. In case of requests that are manifestly unfounded, excessive, or repetitive, we may charge a reasonable fee to cover the administrative costs of complying with the request, or decline to act on the request.

Authorized Agent.  You may authorize an agent to exercise your rights on your behalf. When a request is submitted by an authorized agent, we will require the requestor to: (i) provide the authorized agent’s written permission to do so; and (ii) verify their own identity directly with us. If we are unable to verify the identity of the requestor, or if we do not receive proof from the authorized agent that the requestor authorized the agent to act on the requestor’s behalf, we will refuse to take action on the request.

Appeals Process. If you wish to appeal our refusal to take action on a request, please email us at privacy@eraliving.com; or use the privacy web form in your existing online account. Within forty-five (45) days of receipt of the appeal, we will inform you in writing of any action taken or not taken in response to the appeal, along with a written explanation of the reasons for our decisions. If the appeal is denied, we will provide you with an online mechanism, or another method, through which you may contact the Attorney General to submit a complaint.

If you have any questions or concerns regarding the policies and practices described in this Policy, please contact us at privacy@eraliving.com.

Last modified: February 27, 2025