Privacy Policy

This Privacy Policy explains what personal information we collect through the Site and in connection with your interactions with us, how we use and protect it, and the rights and choices you have. It applies to all information collected through the Site and any related online or offline interactions, unless a separate privacy notice applies (such as our HIPAA Notice of Privacy Practices governing resident health records).

Scope: This Policy governs United Legacy’s public-facing website. It does not govern the separate HIPAA-compliant documentation that covers the medical records and health information of admitted residents.

All-States Coverage: United Legacy operates in all U.S. states. Where your state grants you specific privacy rights, those are addressed in the All-States Privacy Disclosures section below.

A. Information You Provide Directly

• Contact details: name, phone number, email address, mailing address
• Inquiry details: information about yourself or a loved one when requesting a tour, pricing, or availability
• Health and care-need information voluntarily shared during inquiry (e.g., level of care required, mobility needs, cognitive status, medical conditions)
• Financial information: general financial range or payer source (private pay, long-term care insurance, Medicaid/Medicare) when voluntarily provided
• Account credentials if you create a resident portal or family portal account
• Communications: emails, chat transcripts, survey responses, testimonials, and feedback
• Event registrations, virtual tour sign-ups, and webinar attendance

B. Information Collected Automatically

• Device and browser information: IP address, browser type and version, operating system, device identifiers
• Usage data: pages viewed, time on page, referring URL, click-stream data, search terms used on Site
• Approximate geographic location inferred from IP address
• Cookies, pixels, and similar tracking technologies

C. Information From Third Parties

• Senior living referral agencies and placement advisors
• Lead-generation and marketing partners
• Social media platforms when you interact with our content or use social login features
• Family members or authorised representatives acting on behalf of a prospective resident
• Analytics, advertising, and data enrichment partners

We collect information through the following channels:

• Online inquiry forms, contact forms, and tour-scheduling tools on the Site
• Live chat and AI-assisted chat features — chat transcripts may be retained
• Phone calls, which may be recorded for quality assurance — you will be notified at the start of any recorded call
• In-person community visits, open-house events, and tours
• Cookies, web beacons, pixels, and tracking technologies
• Third-party referral networks and senior living placement advisors
• Social media interactions and social login

Providing Services & Responding to Inquiries

• Responding to your inquiries, scheduling tours, and providing pricing and availability information
• Communicating with family members or authorized representatives on behalf of a prospective resident
• Processing applications and move-in documentation
• Matching prospective residents to appropriate care levels and communities

Marketing & Communications

• Sending information about our communities, services, events, and promotions (with your consent where required by law)
• Personalizing content and recommendations based on expressed preferences and Site behavior
• Re-marketing via third-party advertising platforms

Operations & Continuous Improvement

• Analyzing usage trends to improve the Site and our inquiry-handling processes
• Conducting satisfaction surveys and quality assurance reviews
• Training staff and improving service delivery

Legal & Compliance

• Complying with applicable federal and state laws across all U.S. jurisdictions in which we operate
• Detecting, preventing, and responding to fraud, security incidents, or illegal activity
• Establishing, exercising, or defending legal claims

We do not sell your personal information to third parties for their own direct marketing purposes. We may share your information in the following limited circumstances:

Service Providers

We share information with trusted vendors performing services on our behalf, including: CRM and customer relationship platforms, email and SMS marketing providers, website analytics providers (e.g., Google Analytics), payment processors, call-center and chat technology providers, and IT/cybersecurity vendors. All service providers are contractually required to protect your information and use it only for the services they provide to us.

Referral & Placement Partners

If you were referred to us through a senior living placement agency or referral partner, we may share information with that partner consistent with their role in your placement process.

Legal Requirements

We may disclose personal information when required by applicable federal or state law, court order, subpoena, or governmental authority, or when we believe disclosure is necessary to protect the rights, property, or safety of United Legacy, our residents, staff, or the public.

Business Transfers

In the event of a merger, acquisition, sale of assets, or corporate restructuring, your personal information may be transferred to the successor entity. We will provide notice of any such transfer and any material changes to this Policy.

With Your Consent

We may share your information for any other purpose with your explicit prior consent.

We use cookies, web beacons, pixels, and similar technologies to operate the Site, understand how it is used, and deliver relevant content and advertising.

Types of Cookies We Use

• Strictly Necessary — Required for the Site to function (security, form submissions, session management). Cannot be disabled.
• Functional — Remember your preferences and settings to personalize your experience.
• Analytics — Collect aggregated data on how visitors use the Site (e.g., Google Analytics, Hotjar).
• Marketing / Advertising — Deliver targeted ads and measure campaign effectiveness (e.g., Meta Pixel, Google Ads, LinkedIn Insight Tag).

You may manage your cookie preferences at any time by configuring your browser to block or delete cookies. Please note that disabling certain cookies may affect Site functionality.

Email

We send marketing emails only with your consent. Every marketing email includes a clear unsubscribe link. You may also opt out at any time by emailing corporate@unitedlegacyrc.com or calling 972-731-6700. Transactional emails related to your inquiry or residency are not subject to marketing opt-out.

SMS / Text Messages

By providing your mobile number and opting in to SMS communications, you consent to receive text messages about our communities, events, promotions, and services. Message and data rates may apply. Message frequency varies. Reply STOP to opt out at any time. Reply HELP for assistance. Carriers are not liable for delayed or undelivered messages. SMS opt-in consent is never shared with third parties for their own marketing purposes.

Phone Calls

We may contact you by phone in response to an inquiry or as part of our care-matching process. Calls may be recorded for quality assurance, and you will be notified at the start of any recorded call. We honor the National Do Not Call Registry; to be removed from our call list, contact us at corporate@unitedlegacyrc.com.

When you inquire about our communities, you may voluntarily share sensitive information about a prospective resident, including health status, cognitive function, mobility limitations, level-of-care needs, or financial situation. We treat this information with the highest standard of confidentiality.

• This information is collected solely to help match prospective residents to the most appropriate community and care level.
• It is never shared with advertising networks, data brokers, or third parties for marketing purposes.
• Access is restricted to United Legacy staff directly involved in the care placement or admissions process.
• It is retained only for the duration necessary for the inquiry or residency process.

Note on HIPAA: Once a resident is admitted, their medical and health records are governed by a separate HIPAA Notice of Privacy Practices provided at admission, and by applicable federal and state healthcare privacy regulations.

Sensitive Personal Information

We may collect Sensitive Personal Information as defined under applicable state law, which may include: precise geolocation data, racial or ethnic origin (only if voluntarily provided for care purposes), and health-related data. We use Sensitive Personal Information only for the purposes for which it was collected. We do not use it for inferential profiling, targeted advertising, or cross-context behavioural advertising. Where required by state law, you have the right to limit our use of Sensitive Personal Information.

We retain personal information only for as long as necessary to fulfil the purposes described in this Policy, comply with legal obligations in the states where we operate, resolve disputes, and enforce our agreements.

• Inquiry and lead records: Up to 3 years from last contact, unless a residency agreement is executed
• Resident application and move-in records: Duration of residency plus 7 years (consistent with standard senior living regulatory requirements)
• Marketing contact records: Until opt-out, or 3 years of inactivity, whichever is earlier
• Website analytics data: Up to 26 months
• Call recordings (quality assurance): Up to 12 months
• Security and access logs: Up to 12 months
• Legal hold records: As required by applicable law or ongoing legal proceedings

When personal information is no longer required, we securely delete or anonymize it in accordance with our internal data destruction policy.

United Legacy implements a layered set of technical, administrative, and physical safeguards to protect your personal information against unauthorized access, disclosure, alteration, and destruction, including:

• Encryption of personal information in transit (TLS 1.2+/HTTPS) and at rest
• Role-based access controls limiting data access to authorized personnel on a need-to-know basis
• Multi-factor authentication for internal systems containing personal information
• Regular security assessments, penetration testing, and vulnerability scanning
• Comprehensive employee privacy and security training
• Written data protection agreements with all vendors and service providers

No method of internet transmission or electronic storage is completely secure. While we use commercially reasonable means to protect your information, we cannot guarantee absolute security. In the event of a data breach that affects your rights and interests, we will notify you as required by applicable federal and state law. As we operate across all 50 states, we monitor and comply with each state’s breach notification requirements.

Depending on the state in which you reside, you may have some or all of the following rights with respect to your personal information:

• Right to Know / Access — Request details about what personal information we hold about you, including categories and specific pieces
• Right to Correct — Request correction of inaccurate personal information
• Right to Delete — Request deletion of your personal information, subject to certain legal exceptions
• Right to Portability — Receive a copy of your personal information in a structured, machine-readable format
• Right to Opt Out of Sale / Sharing — Opt out of the sale or sharing of your personal information for cross-context behavioral advertising
• Right to Limit Sensitive Data Use — Restrict our use and disclosure of your Sensitive Personal Information
• Right to Non-Discrimination — We will never discriminate against you for exercising any of these rights
• Right to Appeal — If we deny your request, you have the right to appeal our decision

To exercise any of these rights, please contact us using the information at the end of this Policy. We will respond to verified requests within the timeframes required by your state’s law — generally 45 days, with one permitted extension of up to 45 additional days. We may need to verify your identity before processing your request. You may designate an authorised agent to act on your behalf.

Because United Legacy Retirement Communities operates in all U.S. states, we honor the privacy rights afforded by every applicable state consumer privacy law. The following state-specific disclosures supplement the rights described above.

California (CCPA / CPRA)

California residents have rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). California’s “Shine the Light” law: We do not share personal information with third parties for their own direct marketing purposes. To exercise California rights, contact us at corporate@unitedlegacyrc.com or call 972-731-6700. You may designate an authorized agent. If we deny your request, you may appeal by contacting us with the subject line “California Privacy Rights Appeal.”

Washington (My Health My Data Act)

Washington residents have additional rights regarding Consumer Health Data collected in connection with our services. We collect health-adjacent data only with your consent and use it only as described above. You have the right to access, correct, delete, or withdraw consent for processing your Consumer Health Data. Submit requests to corporate@unitedlegacyrc.com with subject line “Washington Health Data Request.”

Colorado, Connecticut, Virginia, Texas, Oregon, Montana, Iowa, Indiana, Tennessee, Delaware, New Hampshire, New Jersey, Nebraska, Maryland, and Minnesota

Residents of states with enacted comprehensive consumer privacy laws are entitled to all rights described above. To submit a request, contact corporate@unitedlegacyrc.com. Appeals may be submitted with the subject line “Privacy Rights Appeal — [Your State].” We will respond to appeals within the timeframe required by your state’s law.

Nevada (SB 220 / SB 260)

Nevada law permits residents to opt out of the sale of covered information. We do not sell covered information as defined under Nevada law. If you have questions, contact corporate@unitedlegacyrc.com.

All Other States

Even where your state has not enacted a comprehensive consumer privacy statute, United Legacy is committed to responding to reasonable requests to access, correct, or delete your personal information. We apply the standards of the most protective applicable state law as a baseline across all our operations. Contact us at corporate@unitedlegacyrc.com with any privacy inquiry.

The Site is intended for adults aged 18 and older. We do not knowingly collect personal information from individuals under the age of 13. If we become aware that we have inadvertently collected information from a child under 13, we will promptly delete it. If you believe we have collected information from a minor, please contact us immediately at corporate@unitedlegacyrc.com.

The Site may contain links to third-party websites, social media platforms, referral partners, or other external resources. These links are provided for your convenience and do not signify our endorsement. We have no control over the content, privacy practices, or security of third-party sites and accept no responsibility for them. We encourage you to review the privacy policy of any third-party site before providing your personal information.

The Site may use artificial intelligence tools to assist with functions such as: chat assistants and virtual inquiry agents, inquiry routing and response prioritization, content personalization, and care-level matching recommendations. These tools are used to enhance your experience and the efficiency of our team’s responses.

We do not use fully automated systems to make legally significant or care-determinative decisions about individuals without human review. All AI-assisted outputs that affect a prospective resident’s care pathway are reviewed by a qualified United Legacy team member before action is taken.

Where AI tools process your personal information, they do so under the same data protection standards described in this Policy and under contractual obligations with our AI service providers. You have the right to request human review of any automated process that materially affects you by contacting corporate@unitedlegacyrc.com.

United Legacy Retirement Communities is committed to making the Site and this Privacy Policy accessible to everyone, including individuals with disabilities. The Site is designed to conform to WCAG 2.1 Level AA accessibility guidelines. If you require this Policy in an alternative format, experience any accessibility barriers on the Site, or have suggestions for improvement, please contact us at corporate@unitedlegacyrc.com or call 972-731-6700.

The Site is designed for and directed to individuals residing in the United States. If you access the Site from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those of your country of residence.

As United Legacy expands internationally in the future, this Policy will be updated to address applicable international data protection requirements, including the GDPR (European Union/EEA), UK GDPR, PIPEDA (Canada), and other relevant frameworks. International visitors with privacy questions are welcome to contact us at corporate@unitedlegacyrc.com.

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements across any of the states in which we operate, or other factors. When we make material changes, we will:

• Update the “Effective Date” and “Last Reviewed” date at the top of this Policy
• Post the updated Policy on the Site
• Where required by law or where changes are significant, notify you by email or via a prominent notice on the Site

Your continued use of the Site following the posting of an updated Policy constitutes your acceptance of the changes. We encourage you to review this Policy whenever you interact with us.