Privacy Policy

Lilac Meadows | Independent Living Community | Virginia
Effective Date: September 21, 2026| Last Reviewed: September 21, 2026

Purpose. Lilac Meadows respects the privacy of residents, applicants, visitors, employees,
contractors, and other individuals whose information we receive. This policy explains what
information we collect, how we use and disclose it, how we protect it, and how individuals may
raise questions or exercise applicable rights.

Important notice. Independent living communities are not automatically subject to HIPAA.
HIPAA applies only if the facility is a covered entity or business associate, or operates a covered
health-care component. The Virginia Consumer Data Protection Act also applies only when
statutory scope requirements are met, and it contains entity- and data-level exemptions. If Lilac
Meadows is subject to HIPAA, its separate Notice of Privacy Practices controls protected health
information where required by law.

1. Scope
   This policy applies to personal information handled by Lilac Meadows in paper, electronic,
   photographic, audio, video, and other formats. It covers information collected through
   applications, residency agreements, resident services, building access, safety systems,
   communications, events, websites, and interactions with staff and service providers. It does not
   replace any separate notice required for employee records, protected health information,
   financial accounts, or other specially regulated data. By accessing or using our website, you
   agree to this privacy policy.
2. Information We Collect
    Identity and contact information, including name, address, telephone number, email
   address, date of birth, and emergency contacts.
    Residency and service information, including application materials, lease or residency
   records, unit information, service preferences, maintenance requests, and
   communications.
    Financial and transaction information, including billing records, payment status, and
   limited payment information processed through approved vendors.
    Health, accessibility, and safety information voluntarily provided or reasonably needed to
   respond to emergencies, assess requested accommodations, or coordinate authorized
   services.
   Security and technology information, including access-control records, visitor logs,
3. incident reports, device or network information, and video surveillance in disclosed
4. common areas.
5.  Other information provided by residents, applicants, representatives, visitors, vendors, or
6. lawful sources.
7.  From third parties, for example, our business partners

3. How We Use Information
   We use personal information only for legitimate operational, contractual, safety, and legal
   purposes, including to:
    Evaluate applications and establish, administer, and end residency;
    Provide housing, amenities, requested services, accommodations, communications, and
   resident programming;
    Bill and collect amounts due, maintain business records, and prevent fraud;
    Protect residents, visitors, staff, property, networks, and facilities; respond to
   emergencies; and investigate incidents;
    Coordinate with authorized representatives, emergency contacts, and service providers;
    Comply with laws, licensing or regulatory requirements, subpoenas, court orders,
   insurance obligations, and lawful government requests; and
    Improve operations, quality, accessibility, and resident experience.
4. When We Disclose Information
   We may disclose information to employees and contractors who need it to perform their duties;
   service providers that support billing, technology, maintenance, security, transportation, food
   service, activities, or other operations; health or emergency personnel when reasonably
   necessary; a resident’s authorized representative or emergency contact; insurers, auditors,
   lenders, legal advisers, or transaction parties subject to appropriate confidentiality protections;
   and government or law-enforcement authorities when permitted or required by law. We do not
   sell personal information for money. If our practices change, we will update this policy and
   provide any notice or choice required by applicable law.
5. Safeguards and Confidentiality
   We maintain administrative, technical, and physical safeguards appropriate to the nature of the
   information and the risks involved. Measures may include role-based access, staff training,
   secure storage, vendor oversight, authentication controls, incident-response procedures, and
   secure disposal. Staff and contractors must access and disclose information only for authorized purposes. No security method is perfect, but suspected losses, unauthorized access, or disclosure must be reported promptly to the Privacy Contact listed below.
6. Retention and Disposal
   We retain information only as long as reasonably necessary for the purposes described in this policy and to satisfy legal, contractual, insurance, tax, audit, safety, and dispute-resolution requirements. When appropriate, records are securely destroyed, deleted, or de-identified according to the facility’s retention schedule.
   
   7. Access, Correction, and Other Requests
   Individuals may contact us to ask what information we maintain about them, request a
   reasonable correction, update contact or emergency information, ask how information has been
   used or disclosed, or raise a privacy concern. Rights may vary by the type of record and
   applicable law. We may verify identity and authority before acting, and we may deny or limit a
   request when permitted or required by law, while explaining the reason when appropriate.
   If the Virginia Consumer Data Protection Act applies to Lilac Meadows and the information at
   issue, eligible Virginia consumers may have rights to confirm processing, access, correct, delete,
   or obtain a portable copy of personal data, and to opt out of certain targeted advertising, sale, or
   profiling. Requests may be submitted through [email/web form/mailing address]. We will
   respond and provide any appeal process within the time required by applicable law.
   Unfortunately, the transmission of information via the internet is not completely secure.
   Although we do our best to protect your personal information, we cannot guarantee the security
   of your personal information transmitted to our website. Any transmission of personal
   information is at your own risk. We are not responsible for circumvention of any privacy
   settings or security measures contained on the website.
   Requests for health records will be handled under applicable Virginia law and, when relevant,
   HIPAA. A legally authorized representative may submit a request with documentation of
   authority.
   
   8. Resident Privacy in the Community
   Staff will respect residents’ privacy in their living spaces and personal affairs. Entry into a residence will follow the residency agreement and applicable law, with exceptions for emergencies, resident requests, maintenance, safety checks, or other authorized purposes. Residents should avoid sharing another person’s private information without permission and should report privacy concerns to management.
7. Privacy Incidents and Notifications
   Suspected privacy or security incidents must be reported immediately to the Privacy Contact.
   Lilac Meadows will investigate, contain, document, and mitigate incidents and will provide
   notifications to affected individuals, regulators, law enforcement, or others when required by
   applicable federal or Virginia law. No person will be retaliated against for making a good-faith
   report or complaint.
8. Complaints and Questions
   Privacy questions, requests, and complaints should be directed to:
   Lilac Meadows: Public Relations
   Facility: Lilac Meadows
   Address: 203 Interstate Drive, Covington, VA 24426
   Telephone: 540-962-2502
   Email: lilacmeadowsva@gmail.com
   
   If applicable, individuals may also contact the relevant government agency, including the Virginia Office of the Attorney General or the U.S. Department of Health and Human Services Office for Civil Rights. Lilac Meadows will not retaliate against anyone for exercising a legal right or filing a good-faith complaint.
9. Changes to This Policy
   We may revise this policy to reflect changes in law, technology, operations, or services. The current version will be available at the front desk, and material changes will be communicated as required by law or contract.
10. Administration
    The Privacy Contact is responsible for implementing this policy, coordinating training, maintaining required documentation, reviewing service-provider privacy obligations, and reviewing this policy at least annually and after material legal or operational changes.