California Privacy Rights Act Statement

Effective Date: January 1, 2023

This California Privacy Rights Act Statement supplements the Sunrise Senior Living Privacy Policy. It applies solely to California consumers, such as our residents, website visitors, business partners and job applicants, and addresses personal information we collect online and offline. This statement does not apply to Sunrise personnel.

This California Privacy Rights Act Statement uses certain terms that have the meaning given to them in the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act of 2020) and its implementing regulations (collectively, the “CPRA”).

1. Notice of Collection and Use of Personal Information

We may collect (and may have collected during the 12-month period prior to the effective date of this Statement) the following categories of personal information about you:

• Identifiers: identifiers such as a real name, alias, postal address, unique personal identifier (such as a device identifier; cookies, beacons, pixel tags, mobile ad identifiers and similar technology; customer number, unique pseudonym, or user alias; telephone number and other forms of persistent or probabilistic identifiers), online identifier, internet protocol address, email address, Social Security number, driver’s license number, passport number and other similar identifiers
• Additional Data Subject to Cal. Civ. Code § 1798.80: signature, physical characteristics or description, insurance policy number, education, bank account number, credit card number, debit card number, and other financial information, medical information, and health insurance information
• Protected Classifications: characteristics of protected classifications under California or federal law, such as race, color, national origin, religion, age, sex, gender, gender identity, gender expression, sexual orientation, marital status, medical condition, medical history, which could include ancestry, genetic information, disability, citizenship status, and military and veteran status
• Commercial Information: commercial information, including records of account and payment history with Sunrise
• Online Activity: Internet and other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding your interaction with websites, applications or advertisements
• Geolocation Data
• Sensory Information: audio, electronic, visual, and similar information
• Employment Information: professional or employment-related information such as résumé information, occupation details, education details, certifications and professional associations, previous employment details, emergency contact information, and pre-employment screening and background check information, including criminal records information
• Educational Information: education information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99)
• Inferences: inferences drawn from any of the information identified above to create a profile about you reflecting your preferences, characteristics, behavior, or abilities.

We may use (and may have used during the 12-month period prior to the effective date of this Statement) the categories of personal information listed above for the purposes described in our Privacy Policy and for the following business purposes:

• Performing services, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytics services, providing storage, or providing similar services;
• advertising and marketing services to you, except for cross-context behavioral advertising (which is addressed in section 6 of this Statement);
• Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards;
• Short-term, transient use, including, but not limited to, nonpersonalized advertising shown as part of your current interaction with us;
• Helping to ensure security and integrity to the extent the use of your personal information is reasonably necessary and proportionate for these purposes;
• Debugging to identify and repair errors that impair existing intended functionality
• Undertaking internal research for technological development and demonstration
• Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by us, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by us;
• Managing career opportunities with us; and
• Managing our relationships with current or prospective partners, corporate customers and vendors and other business partner personnel.

We do not collect or process sensitive personal information for purposes of inferring characteristics about consumers.

To the extent we process deidentified information, we will maintain and use the information in deidentified form and will not attempt to reidentify the information unless permitted by applicable law.

2. Retention of Personal Information

We will retain your personal information for the time period reasonably necessary to achieve the purposes described in our Privacy Policy and this California Privacy Rights Act Statement, or any other notice provided at the time of collection, taking into account relevant statutes of limitation and Sunrise’s records retention requirements and policies.

3. Sources of Personal Information

During the 12-month period prior to the effective date of this Statement, we may have obtained personal information about you from the following categories of sources:

• Directly from you or your device, such as through your use of our website, when you send us an email, visit or stay in our Communities, or otherwise communicate or interact with us
• Individuals, such as your family members or friends who may inquire about our services or other individuals who may refer you to us
• Your medical or care providers
• Vendors to whom you have provided your information
• Monitoring tools, such as cookies that track your use of our websites
• Advertising and social networks
• Recruiting or talent agencies
Job references, such as your employers or teachers
• Data brokers, such as public databases and background check services

4. Disclosure of Personal Information

During the 12-month period prior to the effective date of this Statement, we may have disclosed the following categories of personal information about you for a business purpose to the following categories of third parties:

In addition to the categories of third parties identified above, during the 12-month period prior to the effective date of this Statement, we may have disclosed personal information about you to the following additional categories of third parties:

• Government entities, including licensing enforcement agencies, and;
• Third parties in connection with corporate transactions, such as mergers, acquisitions or divestitures.

5. Sale of Personal Information

We do not sell your personal information in exchange for monetary compensation. We may share your personal information by allowing certain third parties (such as online advertising services and social networks) to collect your personal information via cookies and other automated technologies placed on our website in exchange for cross-context behavioral advertising purposes (such as an enhanced ability to serve you content and advertisements that may be of interest to you). This kind of sharing may be considered a “sale” under California law when the personal information is exchanged for non-monetary consideration or “sharing” when the personal information is disclosed for cross-context behavioral advertising purposes. You have the right to opt out of these types of disclosures of your information, as further described below in the “California Consumer Privacy Rights” Section.

We may sell or share (and may have sold or shared during the 12-month period prior to the effective date of this Statement) the following categories of personal information about you to online advertising services and social networks for cross-context behavioral advertising:

• Identifiers;
• Online activity, and;
• Inferences

We do not have actual knowledge that we sell or share the personal information of minors under 16 years of age.

6. California Consumer Privacy Rights

You have certain choices regarding our use and disclosure of your personal information, as described below:

• Access: You have the right to request, twice in a 12-month period, that we disclose to you the personal information we have collected, used, disclosed sold or shared about you.
• Correction: You have the right to request that we correct the personal information we maintain about you, if that information is inaccurate.
• Deletion: You have the right to request that we delete certain personal information we have collected from you.
• Opt-Out of Sale or Sharing: You have the right to opt-out of the sale or sharing of your personal information for cross-context behavioral advertising purposes.
• Shine the Light Request: You also may have the right to request that we provide you with (1) a list of certain categories of personal information we have disclosed to third parties for their direct marketing purposes during the immediately preceding calendar year and (2) the identity of those third parties.

How to Submit a Request: To submit an access, correction, deletion or Shine the Light request, email us at [email protected] or call us at 1-888-411-2877. To opt-out of the sale or sharing of your personal information for cross-context behavioral advertising, click Do Not Sell Or Share My Personal Information. To submit a request as an authorized agent on behalf of a consumer, please email us at [email protected]. For questions or concerns about our privacy policies and practices, please contact us at [email protected].

Verifying Requests: To help protect your privacy and maintain security, we will take steps to verify your identity before granting you access to your personal information or complying with your request. If you request access to or correction or deletion of your personal information, we may require you to provide information to help us identify you, depending on the nature of your relationship with Sunrise, including: name, date of birth, resident ID, name of your residential community. In addition, if you ask us to provide you with specific pieces of personal information, we will require you to sign a declaration under penalty of perjury that you are the consumer whose personal information is the subject of the request. If you designate an authorized agent to make an access, correction, deletion, or opt-out of sale or sharing request on your behalf (1) we may require you to provide the authorized agent written permission to do so, and (2) for access, correction and deletion requests, we may require you to verify your own identity directly with us (as described above).

Additional Information: The CPRA prohibits discrimination against a consumer because the consumer exercised any of the consumer’s rights under the CPRA. To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request. This Statement is available in alternative formats upon request. Please contact [email protected] to request this Statement in an alternative format.