1. Data Governance & Compliance Framework
GraceHaven Senior Care Franchise maintains comprehensive data protection protocols aligned with the California Consumer Privacy Act (CCPA as amended by CPRA), Virginia Consumer Data Protection Act (VCDPA), Colorado Privacy Act (CPA), and applicable US privacy principles.
2. Handling Candidate Criteria & Preferences
When you utilize our Franchise Finder or request orientation guides, you indicate parameters such as target capital availability and preferred care business models. We protect this data with rigorous technical and physical controls:
- All candidate forms are encrypted using TLS 1.3 in transit and AES-256 at rest.
- Candidate criteria are never sold, auctioned, or rented to external telemarketers or third-party lead aggregators.
- Access is restricted solely to authorized advisory personnel under strict non-disclosure obligations.
3. Exercising Your Data Rights
As a candidate, you possess specific enforceable rights under applicable state laws:
- Right to Know & Access: Obtain a detailed breakdown of all personal contact information and search parameters collected during your browsing sessions.
- Right to Deletion: Request immediate, permanent removal of your contact information and submitted preferences from all active systems.
- Right to Rectification: Request correction of outdated contact numbers, email addresses, or market preferences.
- Right to Non-Discrimination: We never charge fees, alter advisory access, or degrade website tools if you choose to exercise your privacy rights.
4. Notice of Right to Opt-Out (Do Not Sell/Share)
GraceHaven does not sell personal information for monetary compensation. Under certain state statutory definitions, sharing candidate parameters with a franchisor to facilitate an introduction you requested may be classified as a "share."
You may submit a formal Opt-Out or Data Deletion request at any time through our online inquiry form or by emailing our privacy team.
5. Security & Incident Response Protocol
GraceHaven maintains an automated incident response plan designed to contain threats, isolate compromised subsystems, notify impacted users without unreasonable delay, and coordinate transparently with regulatory authorities in the event of any security anomaly.