Acts Retirement-Life Communities, Inc. Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW YOUR MEDICAL INFORMATION MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Effective date: October 5, 2026

Purpose

ACTS Retirement-Life Communities, Inc. and certain affiliated entities that are part of the Acts Retirement Life Communities, Inc. Affiliated Covered Entity (“Acts ACE,” “we,” “us” and “our”) respect your privacy. We are also legally required to maintain the privacy of your protected health information (“PHI”) under the Health Insurance Portability and Accountability Act (“HIPAA”).

As part of our commitment and legal compliance, we are providing you with this Notice of Privacy Practices (“Notice”). This Notice describes:

• Our legal duties and privacy practices regarding your PHI, including our duty to notify you following a data breach of your unsecured PHI.
• Our permitted uses and disclosures of your PHI.
• Your rights regarding your PHI.

Acts ACE Entities

The members of the Acts ACE are treated as one entity for HIPAA compliance purposes and may disclose PHI with one another for treatment, payment, and health care operations, as described in this Notice.

Acts ACE Entities include:

• ACTS Retirement-Life Communities, Inc.
• ACTS Retirement Services, Inc.
• ACTS Acquisition & Development Company, LLC
• ACTS Retirement-Life Communities, Management LLC
• Acts Alliance Management, LLC
• Acts Construction Services, LLC
• Acts Management Services, Inc.
• Acts Legacy Foundation, Inc.
• Acts Communities of Maryland, Inc.
• Mease Life, Inc.
• Bonita Springs Retirement Village Inc. (doing business as The Terraces)

Contact

If you have questions, wish to exercise your rights, or want to file a complaint, contact:

Privacy Officer (or Designee): Holly Schade, Senior VP, Chief Clinical Officer & HIPAA Privacy Officer

Mail: 420 Delaware Drive, Fort Washington, PA 19034

Phone: 215-661-8330

Email: actsinfo@actslife.org

Compliance Hotline (Privacy or Confidentiality Concerns): 1-888-919-0742

PHI Defined

Your PHI:

• Is health information about you:
  • which someone may use to identify you; and
  • which we keep or transmit in electronic, oral, or written form.
• Includes information such as your:
  • name;
  • contact information;
  • past, present, or future physical or mental health or medical conditions;
  • payment for health care products or services; or
  • prescriptions

Scope

We create a record of the care and health services you receive, to provide your care, and to comply with certain legal requirements. This Notice applies to all the PHI that we generate and to substance use treatment-related records (“substance use treatment records”) under 42 U.S.C. §290dd-2 and 42 C.F.R. Part 2 (“Part 2”) that we receive or maintain. We also follow the confidentiality protections of Part 2 for such records.

We and our employees and other workforce members follow the duties and privacy practices that this Notice describes and any changes once they take effect.

Changes to this Notice

We can change the terms of this Notice, and the changes will apply to all information we have about you. The new notice will be available on request, in our office, and on our website.

Data Breach Notification

We will promptly notify you if a data breach occurs that may have compromised the privacy or security of your PHI. Most of the time, we will notify you in writing, by mail, or we may email you if you have provided us with your current email address and you have previously agreed to receive notices electronically. In limited circumstances when we have insufficient or out-of-date contact information, we may provide notice in a legally acceptable alternative form.

Your Rights

When it comes to your health information, you have certain rights. This section explains your rights and some of our responsibilities to help you.

You have the right to:

• Get a copy of your PHI. You can ask to see or obtain an electronic or paper copy of the PHI that we maintain about you (right to request access). Alternatively, you may request a summary of your PHI or an explanation of your PHI. Where permitted, we may charge a reasonable, cost-based fee for the costs of copying, mailing, or other supplies associated with your request;
• Ask us to correct your medical record. You may ask us to correct or amend PHI that we maintain about you that you think is incorrect or inaccurate.
• Ask us to limit what we use or share. You have the right to ask us to limit what we use or share about your PHI (right to request restrictions). You can contact us and request us not to use or share certain PHI for treatment, payment, or operations or with certain persons involved in your care.
• Get a list of those with whom we've shared your PHI. You have the right to request an accounting of certain PHI disclosures that we have made.
• Choose someone to act for you. If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your PHI. We will confirm the person has this authority and can act for you before we take any action.
• Request confidential communications. You have the right to request that we communicate with you about health matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or at a specific address.
• Make a complaint. You have the right to complain if you feel we have violated your rights. We will not retaliate against you for filing a complaint. You may either file a complaint:
  • directly with us by contacting our Privacy Officer; or
  • with the Secretary of the U.S. Department of Health and Human Services at Office for Civil Rights, U. S. Department of Health and Human Services, 233 N. Michigan Ave., Suite 240, Chicago, IL 60601, in writing within 180 days of a violation of your rights.

Right to Use of Voice-Controlled Non-Video Electronic Devices in Assisted Living and Skilled Care Center Settings.

In Resident Rooms/living units: The increasing popularity and emerging use of digital technologies by residents and their families include the use of voice-controlled electronic devices that respond to verbal commands. This includes but is not limited to digital assistants, voice-activated devices, and smartphone applications (Such as Siri, Google Now or Alexa devices; operating systems/applications (Such as Windows 10, etc.)) that allow voice commands. The use of these devices will follow all current local, state, and federal laws and regulations, as written in Acts ACE policies and procedures. Obtaining written consent to the use of the device by the resident or their legal representative. Consent to use of the device can be withdrawn at any time. Use of this device is limited to single occupancy living units/ bedrooms in assisted living and skilled care settings at Acts ACT communities. Written notification of the use of the device is posted outside the resident’s room that indicates that the device is in operation, and it may record conversations, including conversations not intended to be recorded.

Communities Owned Devices for Use in Common Areas: The use of these devices will follow all current local, state, and federal laws and regulations, as written in Acts ACE policies, and so that the resident’s right to privacy and dignity is protected. Only limited trained staff have access to the administrative rights for the device. Written notification of the use of the devices within common areas of Acts ACE communities is posted and includes notification that the device is in operation and maybe recording conversations, including conversations not intended to be recorded. The community will delete any recorded conversation history from the device used by the community on a routine basis and that these conversations are not shared in any way.

Your Choices

For certain health information, you can tell us your choices about what we share. If you have a clear preference for how we share your information in the situations described below, please contact us and we will make reasonable efforts to follow your instructions.

In these cases, you have both the right and choice to tell us whether to:

• Share information, such as your PHI, general condition, or location, with your family, close friends, or others involved in your care.
• Share information in a disaster relief situation, such as to a relief organization to assist with locating or notifying your family, close friends, or others involved in your care.
• Exclude your information, such as your name, room number, or general condition from a hospital directory.
• Use or share substance abuse treatment records about you for fundraising purposes that benefit us.

If you are not able to tell us your preference, for example if you are unconscious, we may share your information if we believe it is in your best interest, according to our best judgment. We may also share your information when needed to lessen a serious and imminent threat to health or safety.

In these cases, we will not share your information unless you give us your written permission:

• Most sharing of a mental health care professional's notes (psychotherapy notes).
• Marketing purposes.
• Selling or otherwise receiving compensation for disclosing your PHI.
• Other uses and disclosures not described in this Notice.

In a civil, criminal, administrative, or legislative proceeding against an individual, we will not use or share information about your substance abuse treatment records unless a court order requires us or you give us your written permission.

You may revoke your authorization at any time, but it will not affect information that we already used and disclosed.

In the case of fundraising: We may contact you for fundraising efforts, but you can tell us not to contact you again.

Uses and Disclosures of Your PHI

The law permits or requires us to use or disclose your PHI for various reasons, which we explain in this Notice. We have included some examples, but we have not listed every permissible use or disclosure. When using or disclosing PHI or requesting your PHI from another source, we will make reasonable efforts to limit our use, disclosure, or request about your PHI to the minimum we need to accomplish our intended purpose. PHI that the law permits or requires us to disclose may be further shared by recipients and is no longer protected by law or the safeguards and restrictions in place when it is in our possession.

Uses and Disclosures for Treatment, Payment, or Health Care Operations

• We may use or disclose your PHI and share it with other professionals who are treating you, including doctors, nurses, technicians, medical students, or hospital personnel involved in your care. For example, care team members may share information with one another to coordinate your care.
• Billing and payment. We may use and disclose your PHI to bill and get payment from health plans or others. For example, we share your PHI with your health insurance plan so it will pay for the services you receive.
• Running our organization. We may use and disclose your PHI to run our practice, improve your care, and contact you when necessary. For example, we may use your PHI to manage the services and treatment you receive or to monitor the quality of our health care services.

Other Uses and Disclosures

We may share your information in other ways, usually for public health or research purposes or to contribute to the public good. For more information on permitted uses and disclosures, see www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/index.html. For example, these other uses and disclosures may involve:

• Appointments and Communications. We may use or disclose PHI to: remind you about appointments; describe treatment alternatives; and provide information about health related benefits or services.
• Our business associates. We may use and disclose your PHI to outside persons or entities that perform services on our behalf, such as auditing, legal, or transcription (Business Associates). The law requires our business associates and their subcontractors to protect your PHI in the same way we do. We also contractually require these parties to use and disclose your PHI only as permitted and to appropriately safeguard your PHI.
• Complying with the law. For example, we will share your PHI if the Department of Health and Human Services requires it when investigating our compliance with privacy laws.
• Health Information Exchange. Acts ACE may participate in secure Health Information Exchange (HIE) networks that allow authorized providers to access and share your health information electronically for permitted purposes. You may have the right to opt out of HIE sharing, where applicable. To request an opt out, contact us in accordance with this Notice. Opting out does not prevent other lawful disclosures of PHI.
• Helping with public health and safety issues. For example, we may share your PHI to:
  • report injuries, births, and deaths;
  • prevent disease;
  • report adverse reactions to medications or medical device product defects;
  • report suspected child neglect or abuse, or domestic violence; or
  • avert a serious threat to public health or safety.
• Responding to legal actions. For example, we may share your PHI to respond to:
  • a court or administrative order or subpoena;
  • discovery request; or
  • another lawful process.
• For example, we may share your PHI for some types of health research that do not require your authorization, such as if an institutional review board (IRB) has waived the written authorization requirement.
• Working with medical examiners or funeral directors. For example, we may share PHI with coroners, medical examiners, or funeral directors when an individual dies.
• Responding to organ and tissue donation requests. For example, we may share your PHI to arrange an authorized organ or tissue donation from you or a transplant for you.
• Addressing workers' compensation, law enforcement, or other government requests. For example, we may use and disclose your PHI for:
  • workers' compensation claims;
  • health oversight activities by federal or state agencies;
  • law enforcement purposes or with a law enforcement official; or
  • specialized government functions, such as military and veterans' activities, national security and intelligence, presidential protective services, or medical suitability.

The privacy laws of a particular state or other federal laws might impose a more stringent privacy standard. If these more stringent laws apply and are not superseded by federal preemption rules, we will comply with the more stringent law.