Resident Privacy Policy

Application/Updating of this Policy

Sunrise’s collection, use and disclosure of personal information

Sunrise collects, uses, and discloses personal information to the extent required for the following purposes and activities.

(1) In connection with the provision of accommodation, for purposes that include but are not limited to:

• Processing applications for residence and creating a file for each resident;
• Keeping a record of the accommodation provided to a resident including maintenance and repairs and any concerns of a resident in connection with food services, supplies, equipment, programs and facilities;
• Keeping a record of expenses incurred by a resident and billing;
• Keeping a record of resident activities, including participation in any special programs or events; and
• All other administrative activities and requirements associated with the accommodation, programs and services provided to a resident other than health care services.

(2) In connection with health care, for purposes that include but are not limited to:

• Coordinating, providing and/or managing health care, including identifying health care needs and resident preferences and instructions;
• Monitoring and evaluating health care received by a resident;
• Communication with a resident’s health care providers for purposes including consultation and referral of the resident to the providers;
• Contacting a resident’s substitute decision maker or family;
• Determining eligibility and coverage for insurance and other benefits;
• Obtaining payment or reimbursement for health care;
• Keeping records required by law; and
• Responding to inquiries from governmental programs or authorities.

(3) In connection with our business administration, for purposes that include but are not limited to:

• Complying with regulatory and other legal requirements;
• Maintaining required certification, licenses and accreditation;
• Quality assurance activities including evaluating the performance of our staff;
• Corporate planning, risk management, resource allocation;
• Audits, inspections and investigations;
• Legal and other proceedings;
• Obtaining and maintaining insurance coverage and making claims; and
• Any contemplated or actual restructuring or reorganization of our business or operations, including an assignment, sale, merger or other transaction involving all, substantially all or a part of our business or operations and the due diligence required to determine whether to proceed with any such transaction.

Where a family member assists or otherwise attends to matters (such as financial or health care matters) for a resident, subject to certain exceptions prescribed by applicable law, Sunrise may be legally required to obtain consent from the resident or the substitute decision-maker acting on behalf of the resident prior to sharing relevant personal information with that family member. To ensure continuity of care and other services, Sunrise may ask a resident to identify an individual with the authority to act on the resident’s behalf (each, an “authorized representative”) in the event that the resident is unable to do so, including to provide consent to the use and disclosure of personal information. It is the responsibility of residents to communicate any change in their authorized representative to Sunrise.

Where permitted or required by law, for example to prevent harm to a resident or someone else, Sunrise may use and disclose personal information without consent.

Sunrise’s use of external service providers

Sunrise transfers or permits access to personal information to external service providers (“Service Providers”) where their services require its use. Sunrise uses Service Providers to take advantage of their specialization and expertise. Sunrise may also engage its parent company (including affiliates and subsidiaries of its parent) to assist it in providing the activities described in paragraphs 1 through 3 above. Sunrise selects its Service Providers with care and requires them, through contracts, to protect and restrict their use of personal information. Some of Sunrises’ Service Providers, including its parent, operate in the U.S. Personal information made available to such Service Providers will be subject to U.S. as well as Canadian law and may be disclosed pursuant to either or both laws, including to governments in either or both countries and their agencies.

The kinds of Service Providers Sunrise may use include the following:

• Cloud hosting and data storage
• Information technology management and maintenance
• Accounting and payment processing
• Human resources and communications
• Resident services (including food, healthcare, cleaning, supplies, equipment, programs and facilities services)

Consent

As noted above, there are circumstances in which Sunrise is permitted or required by law to use or disclose personal information without consent or to assume that it has consent. Resident consent may be obtained separately for particular programs or services that are not identified in this Policy.

A resident may withdraw consent to Sunrise’s collection, use, disclosure and retention of the resident’s personal information as set out in this Privacy Policy at any time, subject to legal or contractual restrictions and reasonable notice. To withdraw consent, a resident may contact Sunrise at the contact information set out at the end of this Privacy Policy.

If a resident withdraws consent to the collection, use, disclosure and retention of the resident’s personal information for purposes that are integral to the provision of Sunrise’s programs and services, then Sunrise might not be able to permit the resident to stay at a Sunrise community, proceed with the resident’s intended interactions or transactions with Sunrise or otherwise receive the full benefit of Sunrise’s products and services.

If a resident withdraws consent to the collection, use, disclosure and retention of the resident’s personal information for additional purposes that are not integral to the provision of our products and services (e.g., to send advertising and marketing messages, to administer and facilitate participation in contests and promotions, and to conduct surveys) then withdrawing consent for those purposes will not affect the provision of Sunrise’s products and services to you.

Protection of personal information

Sunrise employs a variety of means to protect personal information; some protect our physical facilities, others impose rules and procedures on our staff and Service Providers, and still others protect our electronic information technology systems and records. Our security measures may vary from community to community to address the requirements of particular facilities, although the following safeguards apply across our communities in Canada.

We restrict the use of personal information by our staff to that required for the purposes identified to residents. We have assigned responsibility for our personal information management to local Community Privacy Representatives. We provide privacy training to our staff and enforce our privacy policies and procedures. Our privacy program includes procedures for receiving and processing privacy-related inquiries, concerns and complaints, processing requests for access and the correction of personal information, and the management of any privacy breach or security breach that could have an impact on personal information. We have dedicated staff responsible for our information technology systems and assess the sufficiency of our systems security regularly.

We maintain resident personal information in the community in which residents live, although a back-up copy may be stored elsewhere, including with our Service Providers in the U.S.

Access and correction of personal information

Except where the law permits or requires otherwise, residents are entitled to access a copy of their personal information on request to their Community Privacy Representative. We will make a reasonable effort to locate the information to which access has been requested. In accordance with retention periods and other requirements, policies and procedures, we may not have retained a record of all of the personal information we receive about a resident.

We ask that requests for access be made in writing to permit us to keep a record of the release of personal information (including to the resident to whom it relates). Staff will assist residents in making a written request if asked to do so. In the event that Sunrise refuses a request for access, Sunrise will provide its reasons for doing so. As set out below, residents may ask the privacy commissioner who administers the law applicable in their province to review the refusal. The rules differ from province to province, but where there will be a fee for duplication of records, Sunrise will tell you and will provide an estimate prior to processing the request.

Sunrise will correct or update personal information in its records where it agrees that there is a need to do so. Sunrise is not required and will not make changes to information that reflects the observations or professional judgment of a health care provider, except with the provider’s written approval, as maintaining the integrity of such information may be critical to protecting a resident and the members of the resident’s health care team.

Sunrise will process requests for access and correction as quickly as possible and except in usual circumstances to which Sunrise will alert the resident, within 30 days of receiving a request.

Retention of personal information

Sunrise will retain your personal information for the period reasonably necessary for the purposes set out or referenced in this Privacy Policy and to comply with our legal obligations or enforce or protect our legal rights, or a longer period required or permitted by applicable law. Sunrise will delete or dispose of your personal information, or depersonalize the information, when we are no longer reasonably required to retain the information for the purposes set out or referenced in this Policy.

Contacting Sunrise

If you have any comments or questions about this Policy or how Sunrise handles your personal information, please contact your Community Privacy Representative (the Executive Director of your Community) using the contact information as set out in the orientation package provided to residents, or by requesting the contact information for your Community Privacy Representative from staff in your Community.

You may also contact our Corporate Privacy Officer (located in the U.S.) by mail or email at:

Sunrise North Senior Living Ltd. – Privacy Officer
7902 Westpark Drive
McLean, Virginia 22102
email: corporateprivacyofficer@sunriseseniorliving.com

Residents may also file privacy complaints with applicable privacy commissioners. Contact information for the applicable privacy commissioner is set out in the orientation package provided to residents.

This Policy is effective as of December 1, 2021.