Privacy Policy

Management Office

Effective Date: October 29, 2019
Last Updated: June 16, 2026

1. Introduction

Healthcare Realty Trust Incorporated ("Healthcare Realty," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy describes how we collect, use, disclose, and protect personal information when you visit healthcarerealty.com (the "Site"), contact us, or otherwise interact with our services.

2. Information We Collect

We collect personal information that you provide to us, as well as information collected automatically when you use our Site. In the past 12 months, we have collected the following categories of personal information:

Category	Examples
Identifiers	Name, email address, phone number, IP address
Professional or employment-related information	Company name, job title, industry
Internet or network activity	Browsing history on our Site, pages visited, links clicked
Geolocation data	General location inferred from IP address
Inferences	Preferences or interests drawn from browsing activity
Communications data	Messages submitted via contact or leasing inquiry forms

We do not collect sensitive personal information as defined under CPRA (e.g., Social Security numbers, financial account numbers, health data, precise geolocation).

3. How We Collect Information

We collect personal information from the following sources:

Directly from you — when you complete contact forms, leasing inquiries, or newsletter sign-ups
Automatically — through cookies, web beacons, and analytics tools when you browse our Site
Third-party partners — including analytics providers, advertising networks, and mapping services

4. How We Use Your Information

We use the personal information we collect for the following purposes:

Responding to contact form submissions, leasing inquiries, and general requests
Sending requested communications (opt-in only)
Analyzing website traffic and improving user experience
Measuring advertising effectiveness (marketing cookies — consent only)
Complying with legal obligations
Detecting and preventing fraud or security incidents

5. How We Disclose Your Information

We do not sell or share your personal information for monetary consideration. However, we may disclose personal information to the following categories of third parties for business purposes:

Service providers — analytics, hosting, email delivery, and marketing platforms acting on our behalf
Professional advisors — attorneys, accountants, and auditors under confidentiality obligations
Government authorities — when required by law or legal process

In the past 12 months, we have not sold personal information or shared it for cross-context behavioral advertising.

6. Cookies and Tracking Technologies

Our Site uses cookies and similar technologies to:

Remember your preferences
Analyze Site usage and performance
Support marketing and advertising efforts

You can manage your cookie preferences at any time via our Cookie Manager or by adjusting your browser settings. Please note that disabling certain cookies may affect Site functionality.

A full, auto-updating list of all cookies in use on this site — including name, provider, purpose, and expiration — is available on our Cookie Policy page.

7. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Policy, unless a longer retention period is required or permitted by law. Criteria we use to determine retention periods include:

The duration of our relationship with you
Legal and regulatory obligations
Applicable statutes of limitations

8. Your Privacy Rights

EU / EEA / UK / Swiss residents (GDPR / FADP):

Right of access to your personal data
Right to rectification of inaccurate data
Right to erasure ("right to be forgotten")
Right to restriction of processing
Right to data portability
Right to object to processing based on legitimate interests
Right not to be subject to solely automated decision-making
Right to lodge a complaint with your supervisory authority

California residents (CCPA / CPRA):

Right to know what personal information is collected, used, and disclosed
Right to delete personal information we hold about you
Right to correct inaccurate personal information
Right to opt out of the sale or sharing of personal information
Right to limit the use of sensitive personal information (we do not collect sensitive PI)
Right to non-discrimination for exercising your rights
Global Privacy Control (GPC): We honor GPC browser signals automatically via CookieYes. If your browser sends a GPC signal, non-essential scripts will not load for your session without further action from you.

Colorado, Connecticut, Virginia, Texas, Montana, Nebraska, Delaware, Utah, Iowa, and other US state residents:

Right to access your personal information
Right to correct inaccurate personal information
Right to delete personal information
Right to data portability
Right to opt out of the sale of personal information, targeted advertising, and profiling in furtherance of decisions with legal or similarly significant effects
Right to appeal a denied rights request — submit appeals to [email protected] with the subject "Privacy Appeal — [Original Request Type]"

Brazilian residents (LGPD):

Right to confirmation of data processing and access
Right to correction of incomplete or inaccurate data
Right to anonymization, blocking, or deletion of unnecessary data
Right to data portability
Right to deletion of data processed with consent
Right to information about third parties with whom data is shared
Right to refuse consent and be informed of consequences

Canadian residents (PIPEDA):

Right to access your personal information
Right to correct inaccurate personal information
Right to withdraw consent with reasonable notice

9. How to Exercise Your Rights

Email [email protected] with subject line "Privacy Request — [Type of Request]" (e.g., "Privacy Request — Deletion"). Include your name and sufficient information to verify your identity.

Response times: 30 days (GDPR) / 45 days (US state laws), with an extension of up to an additional 45 days when reasonably necessary.

Authorized agents may submit requests on your behalf with written permission or a power of attorney.

10. International Data Transfers

Healthcare Realty is based in the United States. If you access our site from outside the US, your personal information may be transferred to and processed in the United States and other countries that may not provide the same level of data protection as your home country.

For transfers of personal data from the EU, EEA, UK, or Switzerland:

We rely on Standard Contractual Clauses (SCCs) approved by the European Commission or equivalent transfer mechanisms
All third-party vendors that receive EU/EEA personal data (Google, CookieYes/Usercentrics, etc.) have executed DPAs with applicable SCCs

You may request a copy of the applicable transfer safeguards by contacting [email protected].

11. Children\'s Privacy

Our Site is not directed to children under 16 years of age. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us immediately.

12. Security

We implement appropriate technical and organizational measures — including TLS encryption for data in transit, access controls, and regular security reviews — to protect personal information against unauthorized access, alteration, disclosure, or destruction.

No method of internet transmission is 100% secure. We cannot guarantee absolute security of your information transmitted to our site.

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify affected individuals and relevant supervisory authorities as required by applicable law (within 72 hours under GDPR; as required under applicable US state laws).

13. Third-Party Links

Our Site may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies.

14. Changes to This Policy

We will update this Privacy Policy at least once every 12 months, or whenever our data practices change materially. The "Last Updated" date at the top of this page reflects the most recent revision. We encourage you to review this Policy periodically.

Your continued use of the Service after we post any modifications to the Privacy Policy on this page will constitute your acknowledgment of the modifications and your consent to abide and be bound by the modified Privacy Policy.

15. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

Healthcare Realty Trust Incorporated
3310 West End Avenue, Suite 700
Nashville, TN 37203

Email: [email protected]
Phone: 615.269.8175