Effective Date: February 23, 2026
Last Updated: February 23, 2026
Please read this Privacy Policy carefully.
This Privacy Policy governs the privacy practices of SeniorCRE, LLC ("SeniorCRE," "we," "us," or "our") concerning the collection, use, and disclosure of information through our website, platform, and services (collectively, the "Services").
By accessing or using the SeniorCRE platform (the "Platform" or "Services"), you acknowledge and agree to the data practices described in this Privacy Policy.
This Privacy Policy describes how SeniorCRE, LLC ("SeniorCRE," "we," "us," or "our") collects, uses, discloses, and safeguards information when you use:
- Web applications and dashboards
- Operator platform (clinical, staffing, operations, analytics)
- Marketplace and deal room tools
- Mobile applications and APIs
- Investor, broker, and vendor portals
This Policy applies to operators, brokers, investors, vendors, business users, residents' representatives (where applicable), and website visitors.
1. Information We Collect
1.1 Information You Provide
Account Information
- Name, email, phone number
- Company name, role, job title
- Business contact information
Professional Information
- Licenses, credentials, certifications
- Verification documents
Property & Transaction Data
- Listings, financials, occupancy, NOI/EBITDA
- Offering memoranda and deal documents
- Transaction terms and communications
Payment Information
- Billing details and payment information
- Payment data is processed by third-party PCI-compliant processors
Communications
- Messages, uploads, files
- Support requests and chat logs
Identity Verification
- Government identification
- Tax or accreditation documentation (where required)
Healthcare / Operational Data (Operator Customers)
- Resident and operational information
- Care documentation, eMAR, staffing, and community data
- Subject to HIPAA where applicable and where a Business Associate Agreement (BAA) is in place
1.2 Information Collected Automatically
- IP address and device identifiers
- Browser type and operating infrastructure
- Usage activity and feature interactions
- Session data and authentication tokens
- Performance metrics and error logs
- Approximate location based on IP
1.3 Information from Third Parties
- Identity verification providers
- Market data and property data sources
- Public records and licensing databases
- Analytics and infrastructure providers
- Third-party integrations authorized by you
2. How We Use Information
2.1 Service Delivery
- Create and manage accounts
- Operate platform features and workflows
- Facilitate transactions, listings, and communications
- Generate dashboards, analytics, and reports
2.2 Platform Improvement and Development
- Improve functionality and performance
- Conduct testing and product development
- Detect security threats, fraud, or abnormal activity
2.3 Communications
- Account notifications and service updates
- Security alerts
- Billing communications
- Customer support
- Marketing communications (opt-out available)
2.4 Legal and Compliance
- Enforce Terms of Service and EULA
- Respond to legal requests and regulatory obligations
- Protect the security and integrity of the Services
3. Aggregated and De-Identified Data
SeniorCRE may create aggregated, anonymized, or de-identified data derived from Customer information solely to:
- Operate, secure, and improve the Services for the Customer that contributed the underlying data;
- Produce analytics, dashboards, and AI/ML outputs displayed inside that Customer’s own tenant;
- Produce peer-group benchmarks visible to other operators only where the contributing Customer has separately opted in, and only in a form that identifies no individual or organization; and
- Satisfy SeniorCRE’s own legal, regulatory, audit, and security obligations.
SeniorCRE does not sell, license, syndicate, or otherwise transfer aggregated, anonymized, or de-identified Customer data to pharmaceutical companies, payers, ACOs, reinsurers, life sciences researchers, academic institutions, data brokers, or marketers. SeniorCRE does not operate a life sciences or data-brokerage business line on top of Customer information.
Such data will not identify any individual or specific customer organization, and the underlying data continues to be owned by the Customer that produced it.
4. Information Sharing and Disclosure
We do not sell personal information.
We may disclose information:
4.1 With Your Authorization
- When you participate in transactions, listings, or workflows
- When you enable integrations or sharing features
4.2 Service Providers
We use trusted vendors for:
- Cloud hosting and infrastructure
- Payment processing
- Communications and messaging
- Analytics and monitoring
- Identity verification
These providers process data on our behalf under contractual safeguards.
4.3 Marketplace Participants
Transaction-related data may be shared with relevant brokers, buyers, sellers, operators, or vendors involved in a specific workflow.
4.4 Legal Requirements
We may disclose information:
- To comply with law, regulation, subpoena, or court order
- To protect against fraud, security threats, or abuse
- To enforce our agreements
4.5 Business Transfers
Information may be transferred in connection with a merger, acquisition, financing, restructuring, or sale of assets.
5. Data Security
We implement administrative, technical, and physical safeguards designed to protect information, including:
- Encryption in transit and at rest
- Database-level access enforcement using PostgreSQL Row-Level Security (RLS), ensuring permissions are enforced at the data layer — not just the application interface
- Role-based access control with least-privilege defaults across 23 defined roles and 7 access tiers, with segregation of duties across Clinical, Financial, and HR domains
- Property-level and region-level data isolation for multi-location operators, preventing cross-property data access
- Automatic expiration of agency and temporary staff access at contract or assignment end
- Concurrent session limits per role to prevent credential sharing
- Automatic account deactivation for prolonged inactivity based on configurable thresholds
- Time-bound delegated access for shift coverage and PTO scenarios, with self-delegation prevention
- Break-glass emergency access with mandatory documentation, full audit trail (IP, user agent, modules accessed, duration), and post-incident review workflow
- Immutable audit logging on clinical tables containing Protected Health Information, with tamper-proof retention
- Multi-factor authentication (MFA) enforcement for administrative, clinical, and financial roles
- Security monitoring and incident response
No system is completely secure, and we cannot guarantee absolute security.
6. Data Retention
We retain information for as long as necessary to:
- Provide the Services
- Maintain operational and transaction records
- Comply with legal, regulatory, and audit requirements
Operational and transaction records may be retained for up to seven (7) years or longer if required by law.
Upon account closure, data is deleted or anonymized within a reasonable period unless retention is legally required.
7. Your Privacy Choices and Rights
Depending on your jurisdiction, you may have the right to:
- Access your information
- Correct inaccurate data
- Request deletion (subject to legal obligations)
- Opt out of marketing communications
Requests may be submitted to: support@seniorcre.com
8. HIPAA and Healthcare Information
If you use the Platform to process Protected Health Information (PHI):
- A Business Associate Agreement (BAA) must be executed
- SeniorCRE implements safeguards consistent with HIPAA security requirements
- Customers are responsible for clinical accuracy and regulatory compliance
If no BAA is in place, PHI should not be stored or transmitted through the Platform.
9. Cookies and Tracking
We use cookies and similar technologies for:
- Authentication and session management
- Preferences and functionality
- Performance and analytics
You may control cookies through your browser settings.
10. International Data Transfers
Information may be processed in the United States or other jurisdictions where our service providers operate. Appropriate contractual safeguards are used where required.
11. Children's Privacy
The Services are not intended for individuals under 18, and we do not knowingly collect personal information from minors.
12. Third-Party Links
The Services may contain links to third-party sites. We are not responsible for their privacy practices.
13. Changes to This Policy
We may update this Privacy Policy periodically. Material changes will be communicated via:
- Email notification
- Platform notice
- Updated revision date
Continued use of the Services constitutes acceptance of the updated Policy.
14. Contact Information
Privacy Officer
SeniorCRE, LLC
5 Cowboys Way, Suite 300
Frisco, TX 75034
Email: support@seniorcre.com
Support: support@seniorcre.com
© 2026 SeniorCRE
