Vivmark Residential Consumer Health Data Privacy Policy

Effective Date: August 20, 2026

This supplemental Consumer Health Data Privacy Policy (“Health Privacy Policy") applies to Vivmark Residential, its affiliates, subsidiaries and related entities (collectively, “Company,” “we,” “our” or “us”) and explains our practices as to personal information that qualifies as "consumer health data" as such term is defined by Washington's My Health My Data Act, including any regulations thereunder (“the “MHMD Act”) and supplements our Privacy Notice. In the event of a conflict with any other privacy policy or notice, other than an express notice given at the time of collection, this Health Privacy Policy shall govern with respect to consumer health data.

1. Categories of Consumer Health Data Collected

The categories of consumer health data that we collect may include the following categories:

  1. Individual health conditions, treatment, diseases, or diagnosis
  2. Social, psychological, behavioral, and medical interventions
  3. Health-related surgeries or procedures
  4. Use or purchase of prescribed medication
  5. Diagnoses or diagnostic testing, treatment, or medication
  6. Bodily functions, vital signs, symptoms, or measurements indicating consumer health data

2. Sources of Consumer Health Data

We collect consumer health data from the following sources: you, your healthcare provider with your written consent and authorization, agents and representatives (for example, doctors who provide you a medical note), our affiliates and related entities, and other third parties that may have your consumer health data in relation to the processing purposes described herein.

3. Purposes of Consumer Health Data Collection and Uses

We may collect and use your consumer health data if you make a disability-related accommodation or modification request, a complaint or claim to or about us that may allege personal injury, an incident report involving personal injury, or if you are involved in an accident or incident at one of our physical locations. For example:

  • If you are present during an incident or accident that occurs at one of our physical locations (such as a safety or security incident), we may collect information about you, including consumer health data, in relation to this. This includes your physical characteristics that we observe through review of security footage, if available, to investigate the incident, some of which the MHMD Act may classify as consumer health data.
  • We may collect your consumer health data relating to personal injury claims in connection with incidents occurring at one of our physical locations. This could include all the categories of consumer health data in the list below.
  • When you apply to become a resident and/or when you become a resident, we provide you the option to submit information for the purposes of us evaluating disability-related accommodations or modification requests. This information may fall under the "individual health conditions, treatment, diseases, or diagnosis" category the from the list below.
  • For other resident service requests, or claims or complaints, we may collect some or all of the categories of consumer health data from the list above that you provide to us, or that we receive from third parties, and that are necessary for us to collect in addressing your request, claim or complaint.

We may also collect and use  your consumer health data to prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any activity that is illegal under applicable state law or federal law; to preserve the integrity or security of systems; or to investigate, report, or prosecute those responsible for any such action that is illegal under applicable state law or federal law. This includes maintaining business and regulatory records related to such purposes.

4. Sharing of Consumer Health Data

We may share all of the categories of consumer health data that we collect, depending on the circumstances under which we collected it. We share consumer health data with parties in limited circumstances, as follows:

  • Vendors that are classified as “processors” under the MHMD Act which process consumer health data to assist us in providing services requested by consumers, and for the other purposes described in this Health Privacy Policy.
  • Our other agents and contractors who assist us with the processing purposes described in this Health Privacy Policy, such as legal representatives who assist us with complaints involving consumer health data.
  • If your request, claim or complaint, or an incident or accident, relates to one of our third party on-site management services (e.g., third party security services that patrol some of our communities and/or our concierge services), we will share your personal information, including any consumer health data that is necessary to your request or complaint, with the applicable third party so that they can respond to your request, claim or complaint, or assist us with doing so.
  • If your request, claim or complaint, or an incident or accident, relates to one of our affiliated or related entities, we may share your consumer health data with such affiliates or related entities.
  • Assignees or potential assignees as part of an acquisition, merger, asset sale, or other transaction where another party assumes control over all or part of our business.
  • With specific affiliates AvalonBay Communities Inc. and its surviving subsidiaries and related entities, Vivmark Residential and its surviving subsidiaries and related entities, Equity Residential Management, LLC, and ERP Operating Limited Partnership, in order to carry out our operations and provide services.
  • Other parties with your consent.

We do not sell consumer health data.

5. Consumer Health Data Rights

Subject to certain limitations under the MHMD Act, consumers may have the following rights related to your consumer health data:

  • Right to confirm processing of consumer health data and access to such data
  • Right to delete
  • Right to withdraw consent (from processing which requires your consent)
  • Right to obtain a list of third parties and affiliates with whom we have shared your consumer health data
  • Right to appeal our refusal to act on a request within a reasonable time after you receive our decision. You may appeal our decision regarding your request by following the instructions in our response to your request. If your appeal is unsuccessful, you can raise a concern or lodge a complaint with the Washington State Attorney General at http://www.atg.wa.gov/file-complaint.

If you choose to exercise any of your privacy rights, we will not discriminate against you.

We may limit your request as necessary for us to complete or document the request.

To exercise these rights, legacy-Vivmark Residential consumers may use our Washington Consumer Rights Request Form and/or legacy-AvalonBay consumers may use our Privacy Web Form. Please note, as required under the MHMD Act, we take commercially reasonable efforts to authenticate your request before we process your request. If we believe we need further information to authenticate your request, we may ask you to provide additional information to us. Pursuant to the requirements of Washington's My Health My Data Act, we will respond to your privacy requests free of charge, up to twice annually. If requests are manifestly unfounded, excessive, or repetitive, we may charge a reasonable fee to cover the administrative costs of complying with the request or decline to act on the request.

6. Changes to this Health Privacy Policy

If we change this Health Privacy Policy, we will post the revised version here and change the Effective Date and/or contact you directly where we deem appropriate to do so under applicable law. You should check here regularly for the most up-to-date version of this Health Privacy Policy.

7. Contact Us

If you have any questions about this Health Privacy Policy or practices described in it, you may contact us by email at [email protected] or [email protected].