Welltower U.S. and Canada Privacy Policy 

Last Updated: October 1, 2024 

This privacy policy (“Policy”) describes Welltower OP LLC (“Welltower”, “we,” “our,” or “us”) collects, uses, and discloses “personal information” about you (as that term is defined by applicable law). Note that this policy does not apply to protected health information subject to the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations, nor does it apply to consumer health data subject to Welltower’s Consumer Health Privacy Policy. In the event of a conflict between our residential properties’ HIPAA Notice of Privacy Practices and this Policy, the HIPAA Notice of Privacy Practices controls, where applicable, with respect to protected health information. This Policy does not apply with respect to personal information collected on websites operated by Welltower’s third-party property managers. 

Residents of certain U.S. states may have additional rights under applicable law. Please see Sections 11 and 12 for more information. 

Please see Section 13 for additional disclosures applicable to residents of Canada. 

1. Personal Information We Collect

We collect personal information about you from a variety of sources. We collect information in connection with certain of our products and services, such as when you visit our websites or engage and interact with our residential properties or services provided there (collectively, the “Services”) and from other sources, including commercially available sources (where permitted by law). 

The categories of information that we may collect about you include the following: 

• Identifiers, such as your name, postal address, telephone number, email address, account name, unique personal identifiers such as IP addresses and device identifiers, Social Security number, driver’s license number, passport number, national ID number, and other similar identifiers. 

• Demographics, such as your gender, age, race, ethnic background, religion, sex, gender expression, veteran status, marital status, citizenship status, and disability status. 

• Commercial information, such as purchasing or consumption histories or tendencies. 

• Geolocation data. 

• Health information. 

• Financial, medical, health insurance information, or other information, such as signatures, physical characteristics or descriptions, bank or credit card numbers, or insurance policy number. 

• Pictures, audio, and video, such as photographs for identification, voice recordings of calls, or any videos you provide. 

• Professional information, such as past or present employer, salary, job title, experience, skill, or expertise.  

• Education information, such as education level and history. 

• Inferences regarding preferences or other characteristics. 

• Internet or other electronic network activity information, such as information regarding your interaction with any websites associated with our business. 

We collect personal information directly from you and automatically as you interact with our Services, including:  

• Directly from you, such as when you use the Services, tour, apply to rent, or live at certain of our properties, or otherwise contact us. 

• Automatically as you interact with our online Services. 

• From the use of our CCTV cameras for certain premises where they are installed for security purposes. 

• From our affiliated operating companies, business partners, data brokers, companies we provide services for, or service providers and third-party property managers. 

• From authorized third-party sources such as your employer or an agent or third party acting on your behalf. 

The specific sources of personal information depend on the Service and your interaction with us. 

2. How and Why We Use Your Personal Information 

We may use your personal information for the following business purposes: 

• Providing you with the Services, such as verifying your identity, managing your account, allowing you to participate in interactive features on our website including those related to touring or leasing a residential property, providing you with residential or care services at our properties, and processing or fulfilling transactions. 

• Communicating with you and providing support, such as to provide you information about the Services, address your inquiries and feedback, requests, and other communications you send us, and provide you with resident support services. 

• Operating, evaluating, and improving our business, such as performing accounting, auditing, record keeping, and other internal functions; conducting research, property management and related tax initiatives; developing new products and services, analyzing and improving our Services. 

• Complying with law, such as to comply with legal obligations and process and contractual obligations, as well as our policies. 

• Identification and authentication, such as to verify your identity and to protect the security of your personal information. 

• Marketing, such as to understand your preferences better and to appropriately personalize our marketing. 

• Facilitating the transition of property management services. 

• Exercising our legal rights where it is necessary to do so, for example to detect, prevent and respond to fraud claims, intellectual property infringement claims, or violations of law or our terms and conditions. 

• Protecting against harm: we may use personal information as we deem necessary to protect the rights and safety of us, you, or others. 

We also use the information in other ways for which we provide specific notice at the time of collection and obtain your consent to the extent required by applicable law. We may aggregate or de-identify any information collected about you so that it no longer allows to identify you directly or indirectly. We do this as to protect your privacy and the security of your information, and we may use and share that aggregated or de-identified information for any purpose, for example to conduct research and analytics, improve our products, services and the user experience, and develop new offerings. When we maintain and use de-identified data, we will not attempt to re-identify the data unless expressly permitted or required by law.  

3. Personal Information We Disclose to Other Parties

We may disclose certain categories of your personal information to other parties, including our third-party managers, service providers, business partners, or affiliates in order to achieve our business purposes as follows:  

• Third-party managers, service providers, and business partners: We engage third-party managers, service providers, and business partners to assist us with operating our businesses and providing you with our Services. These service providers or business partners may manage Welltower facilities, provide technology support, analyze information, and conduct other business activities.  

• Welltower companies: We may disclose your personal information to Welltower entities for marketing purposes, security, compliance, optimization of products and services, and internal reporting. Unless otherwise specified, Welltower entities will only use your information in the ways described in this Policy. 

• To comply with law or cooperate with reasonable legal requests: We may disclose your personal information to law enforcement agencies, courts, other government authorities or other third parties where we believe necessary to comply with a legal obligation. We may disclose personal information as we deem reasonably necessary to support lawful investigations or otherwise to protect our rights or the rights of you or any other party.   

• In the context of a transaction: We may disclose your personal information to potential transaction partners, service providers, advisors, and other third parties in connection with the consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with another company or we sell or transfer all or a portion of our assets or business. 

4. Retention of Personal Information

We will keep your personal information for as long as we have a relationship with you or until we no longer need it to fulfil the purposes for which it was collected. Once our relationship with you has come to an end or we no longer need the information to fulfil the purposes for which it was collected, we will retain your personal information for a period of time that enables us to: 

• Maintain business records for analysis and/or audit purposes. 

• Perform internal research to assess and improve our business. 

• Comply with record retention requirements under the law or other relevant legal requirements or our internal document retention policy. 

• Defend or bring any existing or potential legal claims. 

• Deal with any complaints regarding the services.  

5. Cookies and Similar Technologies

We may use cookies, web beacons (including pixels and tags), web server logs, and similar technologies on our Site that collect certain information about you by automated means.  

We use these automated technologies to collect information about your devices, browsing actions, and usage patterns. The information we obtain in this manner includes IP address, device ID, and other identifiers associated with your device, device type, device characteristics (such as operating system), the pages you visited on our websites, how you arrived at our websites, browser preferences and characteristics, clickstream data and other information about your online activities. When you use our Online Services, both we and certain third parties (such as analytics providers) collect information about your online activities, over time and across third-party websites, to analyze and improve our services. 

Your browser may tell you how to be notified when you receive certain types of cookies or how to restrict or disable certain types of cookies. Note, however, that without cookies, you may not be able to use all of the features of our website. For mobile devices, you can manage how your device and browser share certain device data by adjusting the privacy and security settings on your mobile device. 

6. How We Protect Your Personal Information

We maintain administrative, technical, and physical safeguards designed to protect the personal information you provide against accidental, unlawful, or unauthorized destruction, loss, alteration, access, disclosure, or use.   

7. Children’s Privacy

Welltower’s websites are designed for a general audience and are not directed to children under the age of 13. We do not knowingly collect or solicit personal information from children under the age of 13 through Welltower’s websites. If we become aware that we have collected personal information from a child under the age of 13 through Welltower’s websites, we will promptly delete the information from our records. If you believe that a child under the age of 13 may have provided us with personal information, contact us as specified in the Contact Us section of this Policy. 

8. Do Not Track Signals

The Site does not currently respond to web browser “do not track” signals or other mechanisms that provide a method to opt out of the collection of information across websites or other online services. If we do so in the future, we will describe how we do so in this Policy.  

9. Contact Us

If you have questions about this Policy or our use of your personal information, please contact us at privacy@welltower.com, or:  

Welltower OP LLC 

Attn: Data Privacy Officer 

4500 Dorr Street 

Toledo, Ohio 43615-4040 

10. Changes to the Policy

We may modify or update this Policy from time to time. We encourage you to visit this Policy at least once per year to learn about any changes to the way we collect, use, or disclose your personal information. If we make a material change to this Policy, we will take reasonable steps to notify you, as required by applicable law.  

11. Additional Disclosures for California Residents

This section applies to the personal information of residents of California and supplements the other sections of this Policy. 

For information on the categories of personal information that we have collected in the past 12 months, the purposes for which we process that personal information, and how we disclose that personal information, please refer to Sections 1, 2, and 3 of this Policy. We use and disclose sensitive personal information only for purposes expressly permitted under California law. 

We may disclose your personal information to third parties for the business purposes outlined in Section 2 of this Policy. We also may “sell” or “share” your personal information, as defined by applicable law, with third parties for those business purposes. In the preceding twelve (12) months, we may have sold or shared your personal information, or disclosed it for a business purpose, to the following categories of third parties: 

We do not have actual knowledge that we sell or share personal information of minors under 16 years of age. 

We may receive from our third-party property managers identifiers and internet or other similar network activity information collected via tracking technologies on their websites. Such disclosures by the third-party property managers may be a “sale” or “sharing,” as defined by applicable law. 

Your California Privacy Rights 

You may have certain choices regarding your personal information, subject to certain exceptions, as described below. 

• Access. You have the right to request, twice in a 12-month period, that we disclose to you the categories of personal information we have collected about you, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, the categories of third parties to whom we disclose your personal information, and the specific pieces of personal information we have collected about you. 

• Data Portability. You have the right to request that we provide you with a copy of your personal information that we have collected about you in a structured and machine-readable format.  

• Correction. You have the right to request that we correct the personal information we maintain about you if that information is inaccurate.  

• Deletion. You have the right to request that we delete certain personal information we have collected from you.  

• Opt-Out of Sale or Sharing. You have the right to opt-out of the sale or sharing of your personal information. To opt out of the sale of your personal information or sharing of your personal information for cross-context behavioral advertising, click here or use the Global Privacy Control signal. Note that if you clear your cookies on a particular browser or device, you may need to re-submit your opt-out request. Requests sent using the Global Privacy Control will apply to the device and browser from which they are submitted.  For more information about the Global Privacy Control, please visit https://globalprivacycontrol.org/. 

To exercise these rights, including to submit a request as an authorized agent on behalf of another individual, you may email us at privacy@welltower.com or submit a request through our online webform.  

Verifying Requests.  To help protect your privacy and maintain security, we will take steps and may require you to provide certain information (such as your name, address, email address, and relationship to Welltower) to verify your identity before granting you access to your personal information or complying with your deletion or correction request. In addition, if you ask us to provide you with specific pieces of personal information, we will require you to sign a declaration under penalty of perjury that you are the consumer whose personal information is the subject of the request. If you designate an authorized agent to make an access, correction, deletion, or opt-out of sale request on your behalf, we may require you to provide the authorized agent written permission to do so and to verify your own identity directly with us (as described above). 

Additional Information.  If you choose to exercise any of your rights under the CCPA, you have the right to not receive discriminatory treatment by us. To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request.  

12. Additional Disclosures for Residents of Colorado, Connecticut, Montana, Oregon, Texas, Utah, and Virginia

This section applies to the personal information of residents of Colorado, Connecticut, Montana, Oregon, Texas, Utah, and Virginia and supplements the other sections of this Policy. 

For information on the categories of personal information that we collect, the purposes for which we process that personal information, and how we disclose that personal information, please refer to Sections 1, 2, and 3 of this Policy. For an explanation of the types of information we share with third parties, please refer to the table in Section 11 above. 

In some cases we may share your information with third parties who may use your information for their own purposes, including for purposes of marketing and advertising. These disclosures may be considered “sales” or “targeted advertising” under applicable privacy laws. For more information about the categories of personal information that we may sell to or share with third parties, and the categories of such third parties, see the table in Section 11 above. 

Depending on where you reside, and subject to certain exceptions, you may have the following rights with respect to your personal information: 

• Access: You may have the right to request that we confirm whether we process your personal information and that we provide you access to such personal information.  

• Data Portability: You may have the right to request that we provide a copy of your personal information in a portable and, to the extent technically feasible, readily usable format. 

• Correction: You may have the right to request that we correct inaccuracies in the personal information that we process. 

• Deletion: You may have the right to request deletion of your personal information. 

• Opt-Out of Sales and Targeted Advertising: You may have the right to request that we not process your personal information for the purposes of targeted advertising and sales as those terms are defined by applicable state law. You may opt out of sales and/or targeted advertising by clicking here and following the instructions. Where required by law, we also honor requests to opt-out submitted via privacy preference signals recognized under applicable local law, such as the Global Privacy Control.  

• Opt-Out of Profiling: You may have the right to request that we not process your personal information for the purpose of profiling in furtherance of decisions that produce legal or similarly significant effects. 

You may submit requests to exercise your other rights by emailing us at privacy@welltower.com or submit a request through our online webform. 

You may also have the right to appeal a refusal to take action on your request by emailing us at privacy@welltower.com with the subject line “Appeal of Rights Request Decision.” 

13. Additional Disclosures for Residents of Canada

This section applies to the personal information of residents of Canada and supplements the other sections of this Policy. 

Your Privacy Rights. You have the following rights with respect to your personal information, subject to limited exceptions set out in such laws: 

• Right to information. You have the right to ask us about our processing of your personal information, including about the categories of persons who have access to your personal information within our organization and the applicable retention period. 

• Right to access. You can ask us if we hold any personal information about you, and if so, you can request access to that personal information. Depending on the laws applicable in the region in which you reside, you also have the right to ask us to communicate to you the personal information you have provided us in a structured, commonly used technological format, as well as to a third party upon your request. 

• Right to correction. You have the right to ask us to rectify any personal information that you demonstrate to be incorrect or outdated and to complete any information that you demonstrate to be incomplete. 

• Right to withdraw consent. You may withdraw your consent to our processing of your personal information to the extent permitted by law and our contractual obligations. However, you understand that in such a case, you may no longer be able to benefit from our Services.  

To exercise any of your privacy rights, please contact us as specified in the Contact Us section of this Policy. 

Cross-border Transfers. Some of our affiliates and external third-party service providers are based outside of Quebec and/or Canada, including in the United States. Their processing of your personal information will therefore involve a transfer of information outside of Quebec and/or Canada. Organizations based outside of Canada may not be subject to privacy laws that provide you with the same rights and protections as in Canada. As a result, when your personal information is used or stored in a jurisdiction other than where you are residing, it may be subject to the law of this foreign jurisdiction, including any law permitting or requiring disclosure of the information to the government, government agencies, courts and law enforcement in that jurisdiction. 

How We Protect Your Personal Information. We implement the following measures to protect your personal information, including: 

• Internal policies and procedures that define the roles and responsibilities of our employees, representatives, and service providers throughout the life cycle of personal information and limit their access to that information on a “need-to-know” basis; 

• Physical, electronic and procedural safeguards that comply with relevant standards to protect personal information; 

• If the information is collected or stored electronically, technical safeguards such as encryption, firewalls, passwords, anti-virus software and similar measures; 

• A designated privacy officer to monitor our compliance with applicable privacy laws; 

• Procedures for receiving, investigating, and responding to complaints or inquiries about our information handling practices; and 

• Contractual protections to ensure that service providers with whom we share personal information maintain adequate protections and security standards.