Privacy Policy

This Privacy Policy (the "Privacy Policy") informs you of our policies and procedures regarding the collection, use, and disclosure of information we receive when you access and use our website at https://vivereconcierge.com, including https://vivereconcierge.com/network (the "Site"), the Vivere Concierge mobile application (the "App"), our concierge subscription and coordination services, our provider network application and vetting process, and all related products, software, content, and services (all of the foregoing collectively, the "Services"), owned, controlled, or offered, directly or indirectly, by Vivere Hubwell LLC (together with its subsidiaries and affiliates, "Vivere," "we," "our," or "us").

Vivere believes the privacy of the people we serve is paramount. We work in people's homes and with their families, often at moments of real vulnerability, and we treat the information entrusted to us accordingly. We strive to use Personal Information (as defined below) only in the ways outlined in this Privacy Policy.

By using the Services, you represent that you have read, understand, and agree to this Privacy Policy and the Terms of Service, that you are a resident of the United States, and that you are at least 18 years of age. Please do not use, install, or access the Services if you do not agree to this Privacy Policy.

Who This Policy Covers

This single Privacy Policy applies to everyone who interacts with Vivere. Because different people share different kinds of information with us, we identify four groups throughout this policy:

Where a section applies to only one group, we say so. Where no group is named, the section applies to everyone.

Vivere Concierge Providers are independent contractors and independent businesses, not employees of Vivere. Providers maintain their own privacy practices and are separately responsible for the information they collect from Clients in the course of delivering their services. This Privacy Policy does not govern a Provider's own collection or use of information. See Section 9.

1. What We Mean by Personal Information

For purposes of this Privacy Policy, "Personal Information" means any information from or about a person that either identifies that person directly or that makes that person identifiable when combined with other information from or about that person from any source. Where this Privacy Policy uses the terms "personal information," "sensitive personal information," "sell," "share," "service provider," "contractor," "third party," "business purpose," and "consumer," those terms have the meanings given to them in the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (together, the "CCPA").

Personal Information does not include information that has been deidentified or aggregated so that it can no longer reasonably be linked to you, or publicly available information as defined by applicable law.

2. Information We Collect

2.1 Information You Provide To Us — Clients and Family Members

When you use the Services or otherwise communicate with us, we collect information you provide directly. For example, we collect information when you: (i) visit the Site or use the App; (ii) submit the "Contact Us" form or otherwise inquire about the Services; (iii) register for the Services or have an account or profile created on your behalf (an "Account"); (iv) participate in an in-home onboarding visit with your concierge; (v) request or coordinate a service; (vi) communicate with your concierge by call, text message, or in the App; (vii) enroll in the Family Plan Extension or are designated as a Family Member or emergency contact; (viii) sign up to receive emails or text messages; (ix) request technical support; or (x) otherwise communicate with us.

You can choose not to provide information we request; however, this may limit your ability to use or access the Services.

Information Clients and Family Members provide may include, without limitation:

• Identifiers and contact information: name, preferred name, postal address, email address, telephone number(s), date of birth or age, and Account credentials.
• Household and home information: home address, residence type, floor plan or layout details, accessibility features, entry and access instructions, alarm or lock arrangements, pets in the home, and the names and roles of other household members or staff.
• Family and relationship information: the names, contact details, and relationship of Family Members, emergency contacts, powers of attorney, health care agents, and other authorized representatives, and the scope of what each is authorized to receive or decide.
• Preference and lifestyle information: routines, schedule, dietary preferences and restrictions, faith or cultural observances, hobbies and interests, travel preferences, and service preferences captured during onboarding.
• Service and coordination records: requests you make, appointments scheduled, notes your concierge records to fulfill a request, service history, feedback, and the identity of Providers engaged on your behalf.
• Health and wellness information (see Section 3): mobility and fall-risk information, functional or occupational therapy assessments, medication reminder schedules, dietary and nutrition needs, care plan details, the categories of in-home clinical or therapeutic services you request, and information underlying any health and safety alerts you elect to send to Family Members.
• Commercial and payment information: subscription plan and Family Plan Extension status, billing name and address, transaction and payment history, and the last four digits and expiration date of a payment card. We do not store full payment card numbers or bank account numbers. Payments are processed by a third-party payment processor, and your full payment credentials are collected and retained by that processor under its own privacy policy and security controls.
• Communications: the contents of emails, text messages, in-App messages, contact-form submissions, and voicemails, and records of such correspondence.
• Any other information you choose to share with us.

Information about other people. If you provide us with Personal Information about another person — for example, when a Family Member enrolls a parent, or when a Client designates an emergency contact — you represent that you have the authority or consent to do so. We will use that information only to provide and administer the Services.

2.2 Information You Provide To Us — Providers

When you apply to, are considered for, or participate in the Vivere Concierge Professional Network, we collect information you provide directly, including without limitation:

• Identifiers and business information: full name, business or DBA name, email address, telephone number, business address, website or portfolio link, and entity type.
• Professional and qualification information: service category, areas of Los Angeles served, description of services, years of experience, experience working with older adults or private households, availability and capacity, references, and sample work.
• Licensing, insurance, and credentialing information: professional license, registration, or certification numbers and status; bonding status; general liability, professional liability, and workers' compensation insurance carriers, policy numbers, coverage limits, and certificates of insurance; and any documentation you upload (resume, brochure, license, certificate, or insurance documentation).
• Commercial information: typical pricing or rate structure, quotes, invoices, engagement history, and Client feedback about your services.
• Background screening information (see Section 2.5): where applicable to your service category and where you have provided the separate authorization required by law, information obtained from criminal background checks, motor vehicle records, sex offender registry checks, professional license verification, and identity verification.
• Payment and tax information: where Vivere remits payment to you, your payment or remittance details and taxpayer identification information (such as a Form W-9 and TIN or EIN) collected for tax reporting purposes.
• Communications: the contents of your application, intro conversation notes, emails, text messages, and other correspondence with us.

A note on your rights as a Provider. California law no longer broadly exempts information collected in an employment, applicant, or business-to-business context. If you are a California resident, the rights described in Section 12 apply to the information you provide to us as a Provider or Provider applicant, in addition to any rights you have as a consumer.

Joining the network does not guarantee work. Submitting an application does not create an employment, agency, partnership, or joint venture relationship with Vivere, and does not guarantee that you will be approved or referred any Client.

2.3 Automatically Collected Information

Most of the data we collect in and through the Site and the App is technical in nature and is collected and processed automatically through application programming interfaces, software development kits, cookies, and similar technologies. Alone or in combination with other data, such automatically collected data may constitute Personal Information. It may include, without limitation:

• Device data: device model and identifiers, operating system and version, mobile carrier, device settings, time zone, and language.
• Usage data: pages and screens viewed, features used, search terms entered, referring and exit pages, session duration, and dates and times of access.
• Network and internet information: IP address, URLs, browser type, click streams, and approximate location derived from IP address.
• Location data (App only): if you enable location permissions in the App, we may collect precise geolocation to support service coordination, transportation, and safety features. Precise geolocation is sensitive personal information under California law. You can disable location sharing at any time in your device settings; certain features may not function if you do.
• Cookies and similar technologies: see Section 6.

2.4 Communications Monitoring and Call Recording

Your concierge communicates with you by phone, text message, and through the App, and we retain records of those communications to deliver, document, and improve the Services.

We do not record telephone calls unless we have first told you on the call that the call is being recorded and you have consented. California is a two-party consent state under California Penal Code § 632, and we do not record or monitor any confidential communication without the consent of all parties.

Text messaging. By providing your mobile number and opting in, you consent to receive service-related and, where separately authorized, promotional text messages from Vivere. Message and data rates may apply. Reply STOP to any message to opt out of further messages, or HELP for assistance. You may also opt out by contacting us using the details in Section 16. Opting out of promotional messages does not stop transactional or service-related messages necessary to deliver the Services.

2.5 Background Checks and Verification (Providers)

Depending on your service category, Vivere may request or obtain background screening reports about you as part of vetting. Where we do:

• We will provide you with a separate, standalone written disclosure and obtain your written authorization before procuring any consumer report or investigative consumer report, as required by the federal Fair Credit Reporting Act (FCRA), the California Investigative Consumer Reporting Agencies Act (ICRAA, Cal. Civ. Code § 1786 et seq.), and the California Consumer Credit Reporting Agencies Act (CCRAA, Cal. Civ. Code § 1785 et seq.).
• That disclosure will identify the screening agency, describe the nature and scope of the investigation, and inform you of your right to request a copy of any report obtained and to check a box to receive a copy at no charge.
• We will comply with all applicable notice, adverse action, and pre-adverse action requirements before declining an application based in whole or in part on the contents of a report.
• We do not use criminal history information in a manner inconsistent with the California Fair Chance Act or the Fair Employment and Housing Act where those laws apply.

Background screening reports are handled as confidential, access is limited to personnel with a need to know, and reports are retained only as long as necessary for the vetting decision and applicable legal recordkeeping.

2.6 Information From Other Sources

We may receive information about you from: Family Members and authorized representatives; Providers who report on the status or completion of a service; publicly available sources and licensing boards (for Provider license verification); background screening agencies (with your authorization, as described above); payment processors; and our service providers and analytics partners.

2.7 Information You Share on Third Party Websites or Social Media

The Services may include links to third-party websites and social media services. Your use of those services may result in the collection or sharing of information about you by those third parties. We encourage you to review the privacy policies and settings of any third-party service with which you interact.

3. Sensitive Personal Information, Health Information, and Our HIPAA Status

3.1 Sensitive Personal Information

Under the CCPA, certain categories are treated as sensitive personal information. Depending on the Services you use, Vivere may collect the following categories of sensitive personal information:

• Account log-in credentials in combination with a password or credential allowing access to an Account;
• Precise geolocation (App only, with your permission);
• Contents of your mail, email, and text messages where Vivere is not the intended recipient (for example, when your concierge acts on correspondence at your direction);
• Personal information concerning your health;
• A driver's license, state identification card, or other government identification number, where collected for Provider identity verification or transportation services.

We use and disclose sensitive personal information only for the purposes permitted under Cal. Code Regs. tit. 11, § 7027(m) — that is, to perform the Services you have requested, to ensure security and integrity, for short-term transient use, to perform services on our behalf, to verify or maintain the quality and safety of the Services, and for other purposes that do not infer characteristics about you. We do not use or disclose sensitive personal information for the purpose of inferring characteristics about you. Because our use is limited to these purposes, the CCPA's Right to Limit does not apply; nevertheless, we describe how to make such a request in Section 12.

Sensitive personal information and AI development. Sensitive personal information is excluded from the training data described in Section 4.1. Where a communication selected for deidentification contains sensitive content, that content is removed or generalized before the record enters a training dataset. We do not use sensitive personal information in identifiable form to develop or train AI features.

3.2 Health Information and Our HIPAA Status

Vivere is generally not a "covered entity" under the Health Insurance Portability and Accountability Act ("HIPAA"). Vivere is a lifestyle coordination and concierge service. We do not provide medical care, we do not bill health plans or Medicare, and we do not function as a health care provider, health plan, or health care clearinghouse.

Licensed professionals in our network — including in-home nursing agencies, house-call physicians, occupational and physical therapists, and geriatric care managers — are independently responsible for their own HIPAA and clinical recordkeeping obligations, and their handling of your medical information is governed by their own notices of privacy practices, not this Privacy Policy.

Nevertheless, because we may receive health-related information in the course of coordinating your care and lifestyle, we treat health-related information as sensitive and confidential, and we handle it consistent with the protections of the California Confidentiality of Medical Information Act (CMIA, Cal. Civ. Code § 56 et seq.) where applicable. Specifically:

• We collect health-related information only to the extent needed to coordinate the services you request;
• We disclose health-related information to a Provider only to the extent that Provider needs it to deliver the service you requested;
• We disclose health-related information to Family Members only where you have expressly authorized us to do so — for example, by enrolling in the Family Plan Extension and opting into health and safety alerts, or by designating an authorized representative;
• We do not use health-related information for marketing or advertising, and we do not sell it;
• We do not use identifiable health-related information to develop or train artificial intelligence features. Health-related content is removed or generalized during the deidentification process described in Section 4.1, and that process runs only for Clients who have opted in;
• You may withdraw or modify a health and safety alert authorization at any time in the App or by contacting your concierge or the address in Section 16.

Emergencies. If we reasonably believe there is an imminent risk to your health or safety, or the health or safety of another person, we may disclose relevant information to emergency responders, medical personnel, or your designated emergency contacts without prior authorization, to the extent permitted by law.

If Vivere ever performs functions that make it a HIPAA business associate of a covered entity, it will do so under a written Business Associate Agreement, and the terms of that agreement will control over this Privacy Policy with respect to the protected health information covered by it.

4. How We Use Collected Information

We use the information you provide to us for the following purposes:

1. To further our legitimate interests in providing, operating, and maintaining the Services, including coordinating requests, scheduling, and household management on your behalf;
2. To administer your use of the Services and any Account you may have with us, and to collect and remit payment for the subscription and any add-ons;
3. To personalize your experience, including tailoring service coordination to your stated preferences, routines, home, and needs;
4. To match Clients with appropriate Providers, and to contact Providers when a Client need matches their services, location, and availability;
5. To vet, verify, credential, and periodically re-verify Providers, including license, insurance, and background verification as described in Section 2.5;
6. To communicate with Family Members and authorized representatives to the extent the Client has authorized;
7. To deliver health and safety alerts you have opted into;
8. To provide Service announcements, and to inform you of new releases and features;
9. To provide you with further information and offers from us or from third parties we believe you may find useful, such as newsletters and promotional materials, subject to your communication preferences and applicable law;
10. To perform tasks on behalf of and according to the instructions of a third party, such as payment processors and other service providers;
11. To enforce our Terms of Service and resolve disputes;
12. To comply with a legal requirement or process, including civil and criminal subpoenas, court orders, and other compulsory disclosures;
13. To further our legitimate interest in protecting the rights, property, and safety of Vivere, our Clients, Family Members, Providers, and the public, including fraud prevention, abuse prevention, and elder-safety concerns;
14. To contact you to obtain feedback regarding the Site and the Services; and
15. With your consent, to create deidentified training data used to develop, train, test, and evaluate Vivere's own artificial intelligence features, as described in Section 4.1.

In addition, we use automatically collected information to: monitor and analyze use of the Services and for technical administration of the Site and App; improve the Site, App, and Services; generate and derive aggregated or deidentified data and insights concerning use of the Services; and verify that users meet the criteria required to process their requests.

4.1 Artificial Intelligence and Automated Processing

Automated assistance in day-to-day service. We use software tools that incorporate automated processing to help draft, summarize, route, and prioritize routine communications and service requests. A Vivere team member reviews the output. We do not make decisions producing legal or similarly significant effects about you based solely on automated processing without human involvement. Any AI-powered feature we deploy in the App will be clearly identified to you as automated, and you will always be able to reach a human concierge.

Developing Vivere's own AI features. Vivere may develop artificial intelligence features for the App, such as an AI concierge chat assistant. To do so responsibly, we may use records of communications between Clients and their concierge — including in-App messages, text messages, and transcripts — to create deidentified training data. The following limits apply to that process, and we consider them binding commitments:

• Deidentification before use. Communications are never used for training in their original form. Before any communication enters a training dataset, we remove or replace direct identifiers — including names, postal addresses, email addresses, telephone numbers, and account numbers — with generic placeholders (for example, "Client" and "Concierge"). We also remove or generalize indirect information that could reasonably be used to identify you, including specific dates, neighborhoods and street names, employer names, the names of Family Members and Providers, specific dollar amounts, and rare or distinctive details. We do not retain any key, code, or mapping that would allow a training record to be linked back to you.
• Our public commitment not to reidentify. Consistent with California Civil Code § 1798.140(m), Vivere publicly commits to maintain and use deidentified training data solely in deidentified form; not to attempt to reidentify it; and to contractually obligate any recipient of that data to do the same. We take reasonable technical and organizational measures to prevent reidentification, and we periodically test our deidentification process for effectiveness.
• Your choice. We use your communications to create training data only if you have affirmatively opted in. Opting in is never a condition of receiving the Services. Declining will not affect your service, your pricing, your concierge relationship, or the quality of care you receive, and we will not ask you repeatedly.
• Sensitive and health information. We exclude sensitive personal information from training data. Health-related content is either removed or generalized so that it cannot reasonably be linked to you, and we do not use identifiable health-related information to train AI features. See Sections 3.1 and 3.2.
• Vivere's features only. Deidentified training data is used solely to develop Vivere's own features. We do not sell it, we do not use your information to train generative AI models offered by third parties for their own purposes, and our service providers are contractually prohibited from using your information to train or improve their own models.
• Safeguards on model output. We test AI features before and after deployment to guard against a model reproducing details from training data, and we apply filtering designed to prevent one Client's information from surfacing to another.
• Withdrawing your consent. You may withdraw your consent at any time in the App or by contacting us using the details in Section 16. Withdrawal stops all future use of your communications for this purpose and removes your records from future training datasets. Please note: information that has already been incorporated into a trained model generally cannot be extracted from that model. We will, however, delete the underlying records and exclude them from every subsequent training run.
• Transparency. Before we make any generative AI feature publicly available, we will publish the training-data disclosures required by California's Generative Artificial Intelligence: Training Data Transparency Act (Cal. Civ. Code § 3111), and we will complete the risk assessment required by California privacy regulations before using personal information to train that feature.

5. Third Parties We Share Personal Information With

We may disclose Personal Information you provide to us, or that we collect automatically, to the following categories of recipients:

• Providers in the Vivere network, but only the information reasonably necessary for them to perform the specific service you have requested — typically your name, service address, contact information, access instructions, scheduling details, and the relevant service context. We do not give Providers blanket access to your record.
• Clients and their authorized Family Members, with respect to Provider information, when we refer or propose a Provider for an engagement — typically the Provider's business name, service category, credentials, licensing and insurance status, and contact details.
• Family Members and authorized representatives of a Client, to the extent the Client has authorized.
• Service providers and contractors that perform functions on our behalf and are contractually restricted from using your information for their own purposes, including: cloud hosting and data storage, application development and maintenance, communications and messaging platforms, scheduling and CRM software, payment processing, background screening agencies, accounting and tax preparation, insurance, and analytics.
• Professional advisors, including attorneys, auditors, and insurers, under duties of confidentiality.
• Public authorities, such as law enforcement or Adult Protective Services, where we are legally required to do so, where necessary to protect our rights or the rights of third parties, or where we have a good-faith belief that disclosure is necessary to prevent harm to a vulnerable adult.
• Emergency responders and medical personnel, in the circumstances described in Section 3.2.
• Our subsidiaries and affiliates, or a subsequent owner, co-owner, or operator of the Site and Services and their advisors, in connection with a corporate merger, consolidation, restructuring, financing, sale of substantially all of our stock or assets, bankruptcy proceeding, or other corporate reorganization, in accordance with this Privacy Policy.

We do not sell your Personal Information, and we do not share your Personal Information for cross-context behavioral advertising. We have not sold or shared Personal Information in the 12 months preceding the "Last updated" date of this Privacy Policy. We have never sold or shared the Personal Information of consumers we know to be under 16 years of age.

6. How We Use Cookies and Other Technologies

We and our service providers use cookies, pixels, local storage, and similar technologies on the Site and in the App to:

• Strictly necessary: authenticate users, maintain sessions, secure the Services, and remember your privacy choices.
• Functional: remember your preferences and settings.
• Analytics: understand how the Site and App are used so we can improve them.

We do not use advertising or cross-context behavioral advertising cookies. Most browsers let you refuse or delete cookies through their settings; if you do, some features of the Site may not function properly. See Section 7 regarding opt-out preference signals.

7. Do Not Track and Opt-Out Preference Signals

Global Privacy Control. Even though we do not sell or share Personal Information, we honor the Global Privacy Control (GPC) and other browser-based or device-based opt-out preference signals that meet the requirements of California law. When we detect such a signal, we treat it as a valid request to opt out of sale and sharing for that browser or device, and, if you are logged into an Account, for the consumer associated with that Account.

Do Not Track. Vivere does not track its users over time and across third-party websites to provide targeted advertising, and therefore does not respond to "Do Not Track" (DNT) browser signals. Some third-party sites do keep track of your browsing activities when they serve you content.

8. Links to Other Websites

We may make content or services from other websites available to you through links located on the Site. This Privacy Policy applies only to the Site and the Services. We do not exercise control over third-party services or other websites that provide information or links from within the Site or the Services. Your interactions with these third-party services are governed by the privacy policy of the company providing them. These other sites and services may place their own cookies or other files on your browser, collect data, or solicit Personal Information from you. We encourage you to read the privacy policies and other terms of such third parties before using their services.

9. Providers Are Independent Businesses

Vivere is not an open marketplace and is not a staffing agency, home health agency, or employer of Providers. Providers in the Vivere Concierge Professional Network are independent contractors and independent businesses.

• Providers control their own privacy practices. Information that a Provider collects from you directly — in your home, through their own intake forms, invoices, clinical records, or apps — is governed by that Provider's privacy policy and, where applicable, their own HIPAA notice of privacy practices, not by this Privacy Policy.
• We contractually require Providers to keep Client information confidential, to use it only to perform the requested service, to maintain reasonable security, and to comply with applicable privacy and elder-protection laws. We cannot, however, guarantee a Provider's compliance.
• Clients should direct requests concerning information held by a Provider to that Provider. We are happy to help you identify the right contact — reach out using the details in Section 16.

10. Security

We understand the importance of the privacy and security of Personal Information and have made it a priority. Vivere implements and maintains reasonable security procedures and practices appropriate to the nature of the Personal Information we hold, as required by California Civil Code § 1798.81.5, including access controls and role-based permissions, encryption of data in transit and at rest where appropriate, confidentiality obligations in our contracts with service providers and Providers, and privacy and security training for our personnel.

However, no method of transmission or storage is completely secure. We cannot guarantee that unauthorized third parties will never overcome those measures or use your Personal Information for improper purposes, and we do not promise that Personal Information about you or private communications will be protected from unauthorized disclosure or use.

Breach notification. If we become aware of a breach of the security of the system involving unencrypted personal information as defined in California Civil Code § 1798.82, we will notify affected California residents in the most expedient time possible and without unreasonable delay, consistent with the requirements of that section.

11. Children

The Services are intended for adults and are not directed to children. We do not knowingly collect Personal Information from anyone under 18 years of age, and Accounts may only be created by adults. We do not sell or share the Personal Information of consumers under 16 years of age.

If you believe a child under 18 has provided us with Personal Information, please contact us at info@vivereconcierge.com and we will take steps to delete it.

12. Your California and Other U.S. State Privacy Rights

The terms in this section apply to residents of U.S. states with consumer privacy laws. Vivere currently operates in California, and this section is written primarily to comply with the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (the "CCPA"). Residents of other states with comparable laws — including Colorado, Connecticut, Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah, and Virginia — have substantially similar rights, and we extend the rights described below to them.

In the event of a conflict between this Section and the remainder of this Privacy Policy, this Section takes precedence for applicable state residents.

12.1 Mandatory California Disclosures

Categories of Personal Information collected in the preceding 12 months.

Sources. We collect these categories from the sources described in Sections 2.1, 2.2, 2.3, 2.5, and 2.6.

Business or commercial purposes. We collect these categories for the purposes described in Section 4.

Disclosure for a business purpose. In the preceding 12 months, we have disclosed categories A, B, C, D, F, G, H, I, K, and L to the categories of recipients listed in Section 5 for the business purposes described in Section 4.

Sale or sharing. We do not sell Personal Information and we do not share Personal Information for cross-context behavioral advertising. We have not done so in the preceding 12 months. We do not sell or share the Personal Information of consumers under 16 years of age.

Sensitive personal information. We collect the categories of sensitive personal information listed in Section 3.1 and use them only for the purposes permitted under Cal. Code Regs. tit. 11, § 7027(m). We do not use or disclose sensitive personal information for the purpose of inferring characteristics about you. Sensitive personal information is excluded from AI training data.

Automated decisionmaking technology. We do not use automated decisionmaking technology to make decisions producing legal or similarly significant effects concerning you. Where we process personal information to develop or train artificial intelligence features, we do so as described in Section 4.1, only with your opt-in consent, and only after deidentification.

Deidentified information. Vivere publicly commits to maintain and use deidentified information solely in deidentified form, not to attempt to reidentify it, and to contractually obligate any recipient to do the same. Deidentified and aggregate information is not "personal information" under the CCPA.

Retention. See Section 13.

12.2 Your Rights

Depending on where you live, you may have the following rights:

• Right to know or access. You have the right to know whether we are processing your Personal Information and to request the specific pieces of Personal Information we have collected about you, along with the categories collected, the sources, the business purposes, and the categories of third parties to whom we disclosed it.
• Right to delete. You have the right to request that we delete Personal Information we have collected from or about you. We will comply, and direct our service providers to do the same, subject to exceptions permitted by law. Deletion covers the records we hold about you, including any communications retained for AI development. Because deidentified training data contains no information that can be linked back to you, it is not Personal Information subject to deletion; and information already incorporated into a trained model generally cannot be extracted from that model. See Section 4.1.
• Right to correct. You have the right to request that we correct inaccurate Personal Information about you. We will use commercially reasonable efforts to correct it, and may ask you to provide documentation showing that the information we retained is inaccurate.
• Right to data portability. You may request a copy of the Personal Information you previously provided to us in a portable and, to the extent technically feasible, readily usable format.
• Right to opt out of sale or sharing. You have the right to opt out of the sale of your Personal Information and of sharing for cross-context behavioral advertising or targeted advertising. We do not sell or share, so there is nothing to opt out of — but we honor GPC signals as described in Section 7, and you may submit a request at any time and we will confirm our practice in writing.
• Right to limit use of sensitive personal information. You have the right to limit our use and disclosure of sensitive personal information to what is necessary to perform the Services. As described in Section 3.1, our use is already limited to permitted purposes, so this right does not apply; you may nevertheless submit a request and we will confirm.
• Right to non-discrimination. You have the right to be treated in a non-discriminatory manner for exercising your rights. We will not deny you Services, charge you different prices, or provide a different level or quality of Services because you exercised a privacy right. Please note that if you request deletion of information necessary to deliver the concierge service, we may be unable to continue providing that service.
• Right to a list of third parties. In some states, you may have the right to obtain a list of the specific third parties to which we have disclosed Personal Information.
• Right to appeal. See Section 12.5.

We will not charge or penalize you for exercising your rights, but we may reasonably limit the number of requests you may make and impose appropriate charges as permitted by law.

12.3 Who May Exercise These Rights

You may make a request to exercise your rights yourself. A conservator, guardian, agent under a power of attorney, or other legally authorized representative may make a request on behalf of a person they represent, upon proof of authority. A parent or legal guardian may make a request on behalf of their minor child.

Authorized agents. If you use an authorized agent, you must (a) provide the agent with signed, written permission to submit requests on your behalf, and (b) verify your identity directly with us, or (c) directly confirm with us that you granted permission to the agent. Authorized agents must meet the same authentication requirements that apply to requests we receive directly from you. We may deny a request from an authorized agent if we do not have proof of authorization.

12.4 Verifiable Consumer Requests and How to Submit Them

To verify your request, you must provide sufficient information to allow us to reasonably verify that you are the person about whom we collected Personal Information, and you must describe your request in sufficient detail to allow us to understand, evaluate, and respond.

When we receive your request: (a) we will acknowledge receipt; (b) we will try to match the information you provide with information we already maintain about you; (c) if required to verify your identity, we may ask for additional information or ask you to log into your Account; and (d) we will consider the sensitivity and value of the data, the risk of harm, and the likelihood of fraud in determining how to verify you. Because we serve older adults, who are disproportionately targeted by fraud, we apply careful verification and will not disclose Personal Information to a requester whose identity or authority we cannot reasonably verify.

We will use Personal Information collected during verification only to verify your identity. If we cannot verify your identity as required by applicable law, we will decline the request and tell you why.

To submit a request:

• Email: info@vivereconcierge.com
• Mail: [MAILING ADDRESS]
• Phone: [TOLL-FREE OR BUSINESS PHONE]
• In the App: Clients may also submit a request through the privacy settings in the Vivere Concierge mobile app, or by asking their concierge directly.

We will respond within 45 days. If we require additional time (up to 45 additional days), we will inform you of the reason and extension period within the initial 45-day period. Disclosures we provide in response to a right-to-know request will cover the 12-month period preceding our receipt of the request, unless you request a longer period and providing it would not be impossible or involve disproportionate effort. For portability requests, we will select a format in which to provide your Personal Information. We may charge a fee to process or respond to a request that is excessive, repetitive, or manifestly unfounded.

12.5 Appeals

If you disagree with our decision on your request, you may ask us to reconsider. Submit your appeal within 60 days of receiving our decision, using the contact details in Section 12.4, with "Privacy Appeal" in the subject line. We will acknowledge and process your appeal and, within 60 days of receiving it, inform you in writing of any action taken or not taken, including a written explanation of our reasons. If we deny your appeal, we will provide you with a method to contact the appropriate state regulator, including the California Privacy Protection Agency or California Attorney General.

12.6 California Shine the Light

Pursuant to California Civil Code § 1798.83, California residents may request (a) a list of all third parties to whom we disclosed Personal Information within the past year for those third parties' direct marketing purposes, and (b) a description of the categories of Personal Information disclosed. We do not disclose Personal Information to third parties for their own direct marketing purposes. You may confirm this by contacting us as described in Section 16.

12.7 California Data Broker Law

Vivere is not a "data broker" as defined by California Civil Code § 1798.99.80 and is not registered with the California Privacy Protection Agency under the Delete Act. We collect Personal Information directly from the individuals with whom we have a direct relationship.

13. Data Retention

We keep Personal Information for as long as it is needed to fulfill the purposes for which it was collected, to provide the Services, to deal with possible legal claims, to comply with our business interests, and to abide by applicable law. Our general retention criteria:

Deidentified training data is not Personal Information and may be retained indefinitely, subject to the commitments in Section 4.1.

Thereafter, we delete Personal Information or deidentify it. Even if you request deletion, we may be required by law or otherwise permitted to retain certain Personal Information — for example, to complete a transaction, comply with a legal obligation, exercise or defend legal claims, or detect security incidents. Once those requirements no longer apply, we will delete the information in accordance with your request.

14. Managing Your Privacy and Communication Preferences

We keep your data on your behalf and for your benefit.

• Account information. Clients may correct Account information in the App or by asking their concierge. Providers may update their network profile by contacting us.
• Email. You may unsubscribe from marketing emails using the link in any such email. We will continue to send transactional and service-related emails necessary to deliver the Services.
• Text messages. Reply STOP to opt out, or contact us at info@vivereconcierge.com.
• Health and safety alerts. Clients may turn alerts on or off, and change which Family Members receive them, in the App or by contacting their concierge.
• AI development. Clients may opt in or out of allowing their communications to be used to create deidentified AI training data, at any time, in the App or by contacting their concierge. This setting is off unless you turn it on. See Section 4.1.
• Location. Disable location permissions in your device settings.
• Deletion. Submit a request as described in Section 12.4. Following a verified deletion request, we will delete Personal Information within the timeframes required by law, subject to the exceptions in Section 13.
• Provider network withdrawal. Providers may withdraw from the network at any time by contacting us; we will cease referring you and will handle your information in accordance with Section 13.

15. Changes to This Privacy Policy

Our security and privacy practices are periodically reviewed and enhanced as necessary. This Privacy Policy may change as we update and expand the Services. You can tell when it was last updated by reviewing the "Last updated" legend at the top of this page. We will endeavor to notify you of material changes by email or through the App, but we will not be liable for any failure to do so, and we encourage you to review this Privacy Policy periodically. Your continued use of the Services after a change takes effect constitutes acceptance of that change.

16. Contacting Us

If you have questions or concerns about this Privacy Policy or our privacy practices, or if you need this Privacy Policy in an alternative accessible format, please contact us:

Vivere Hubwell LLC, PO Box 505, Irvine, CA 92620. Email: info@vivereconcierge.com, Phone: 1.855.2VIVERE

We are committed to making our privacy practices accessible. If you or a family member needs assistance reading, understanding, or exercising rights under this Privacy Policy, contact us and we will help — including by walking through it by phone or in person.