Privacy Notice

Last Updated and Effective: November 15th, 2023

We at EPR Properties, a Maryland real estate investment trust, and our affiliate entities, which are disclosed annually in our Form 10-K as filed with the SEC (collectively, “EPR”, “us”, “our”, or “we”) are strongly committed to transparency, and we want you (“you” or “your”) to understand how we collect, use, share and protect your personal information, as well as the rights and choices you have with respect to your personal information and how you can contact us to get answers to your questions. This Privacy Notice applies to the personal information we obtain in various contexts, including when you access or use our website (www.eprkc.com and its various sub domains) or any website, application, or service that links to this Privacy Notice; interact or communicate with us; engage with us on social media; or interact with our advertising or marketing materials. Our “Services”, as used in this Privacy Notice, refer to the provision of our website and the features and content therein. Our privacy practices are subject to the applicable laws of the places in which we operate so you may see additional region-specific terms that only apply to customers located in those geographic regions, or as required by applicable laws. Please read those additional privacy disclosures to understand how they apply to you.

By using our Services, you acknowledge the terms of this Privacy Notice. If you do not understand the terms of this Privacy Notice, please do not use our Services. If you have questions about this Privacy Notice, please contact us before using, or continuing to use, our Services. Our Services may include links to websites and/or applications operated and maintained by third parties. Please note that we have no control over the privacy practices of websites or applications that we do not own. We encourage you to review the privacy practices of those third parties.

We reserve the right to change our Privacy Notice from time to time by posting the changes here. If we choose to amend this Privacy Notice, we will revise the Last Updated date at the top of this Privacy Notice when we post the updated version. We may also provide you with notice by prominently posting on our website, via email or both, if we make any significant changes to this Privacy Notice. Your use of our Services after we have informed you in one of these ways that we made changes to our Privacy Notice will mean that you have accepted those changes.

TYPES OF INFORMATION WE COLLECT
HOW WE COLLECT PERSONAL INFORMATION
HOW WE USE PERSONAL INFORMATION
HOW WE SHARE PERSONAL INFORMATION
HOW WE PROTECT PERSONAL INFORMATION
DATA TRANSFERS
CHILDREN’S PRIVACY
YOUR CALIFORNIA PRIVACY RIGHTS
YOUR CHOICES AND CONTROLS
THIRD PARTY WEBSITE AND APPS
CONTACT US

TYPES OF INFORMATION WE COLLECT

We collect two basic types of information from you when you provide it to us or when you use or interact with our Services or through our advertising and media across the Internet: personal information and non-personal information.

Personal information includes all information that relates to you or which are opinions about you personally and either identifies or may be used to identify you personally (collectively, “personal information”). We may only collect the following, limited types of personal information from you depending upon the device you are using and how you interact with us or use or interact with our Services, such as your:

Contact Information. Name, address, email address, phone number, company name, title, and other contact information.
Device Information. IP address, browser type and version, browser plug-in types and versions, operating system and platform, device type, device identifiers, and information about how you use our Services.
Geolocation Data. Information generated from your IP address that permits us to determine your general location.
Inferences. Drawn from or created based on any of the information identified in this list.

We strive to uphold data minimization principles and only seek to collect personal information from you for the purposes described in this Privacy Notice. To see all of the categories of personal information we collect, click here.

Non-personal information includes information that does not personally identify you or information that has been anonymized (collectively, “non-personal information”). When we combine non-personal information with personal information, we treat the combined information as personal information.

You can always refuse to provide your personal information, but please note that some personal information is necessary to provide our Services.

HOW WE COLLECT PERSONAL INFORMATION

We need to collect personal information from you in order to provide you with our Services, as well as to improve your experience. You may provide us with personal information in several ways, including, for example when you:

Visit our website;
Engage with us on social media or interact with our advertising or marketing materials;
Sign up to receive our newsletter or promotional information; or
Interact with us online in any other way, including through our Services.

Web Beacons & Cookies

Like many websites and apps, we use web beacons and “cookies”, which are small text or image files that are stored on your computer or equipment when you visit certain online pages that record your preferences and actions, including how you use a website. We use this information for analytics purposes which allows us to improve your experience. The information we collect through these technologies will also be used to manage your session. Out of these, the files that are categorized as “necessary” are stored on your browser as they are essential for the working of basic functionalities of the website. Disabling these necessary files may result in a website or app not functioning properly.

You can set your browser or device to refuse beacons or cookies or to indicate when they are being sent. If you delete them or if you opt-out, or if you set your browser or device to decline these technologies, some Services may not function properly. Our Services do not currently change the way they operate upon detection of a Do Not Track or similar signal.

Online Analytics

We also use various types of online analytics including Google Analytics, a web analytics service provided by Google, Inc. (“Google”), on our website. Google Analytics uses cookies or other tracking technologies to help us analyze how users interact with and use the website, compile reports on the related activities, and provide other services related to website and app activity and usage. The technologies used by Google may collect information such as your IP address, time of visit, whether you are a return visitor, and any referring website or app. The information generated by Google Analytics will be transmitted to and stored by Google and will be subject to Google’s privacy policies. To learn more about Google’s partner services and to learn how to opt-out of tracking of analytics by Google click here.

Other Sources

We also may collect personal information from other sources, such as our partners or third-party service providers, for the purposes listed in the How We Use Personal Information section below, including to enable us to verify or update information contained in our records and to better customize the Services for you.

Social Media Integration

Our Services may, from time to time, contain links to and from social media platforms. You may choose to connect to us through a social media platform, such as Facebook, LinkedIn or X (formerly Twitter), and when you do, we may collect additional information from you, including the information listed in the Types of Information We Collect section above. Please be advised that social media platforms may also collect information from you. When you click on a social plug-in, such as Facebook’s “Like” button or X’s “Tweet” button, that particular social network’s plugin will be activated and your browser will directly connect to that provider’s servers. We encourage you to review the social media platforms’ usage and disclosure policies and practices, including the data security practices, before using them.

HOW WE USE PERSONAL INFORMATION

We primarily use personal information to provide, maintain, and improve our Services, but we may also use personal information to do any or all of the following:

facilitate your interactions and transactions with us, such as requests for support or additional Services;
respond to your requests, communications, suggestions, comments, inquiries, and requests (including your feedback about our Services);
administer our relationship with you;
develop new products, features, and services;
better understand and address the preferences of our customers;
provide personalized Services, including personalized experiences, content, and ads;
analyze product performance, maintenance, and operations;
provide you with, and improve, relevant marketing offers or information from us or relevant third parties;
ensure our systems and premises are secure;
develop and manage relationships with our business partners;
respond to legally binding requests from law enforcement, regulatory authorities, or other third parties;
defend, protect, or enforce our rights or applicable terms of service or to fulfill our legal or contractual obligations;
manage any dispute and accidents and take legal or other professional advice;
to prevent fraud or the recurrence of fraud;
assist in the event of an emergency;
comply with applicable law or legal directives; or
any other purpose with your consent.

We may also combine your personal information collected through various sources, including information collected through our Services, and develop a customer profile that will be used for the purposes above.

Typically, we retain personal information for the period necessary to fulfill the purposes outlined in this Privacy Notice, unless a longer retention period is required or permitted by law. In many situations, we must retain some or all of your personal information to comply with our legal obligations; resolve disputes; enforce our agreements; protect against fraudulent, deceptive, or illegal activity; or for other legitimate business purposes, such as for auditing, accounting, or tax purposes.

We may use personal information to create non-personal information. We may use non-personal information for any legitimate business purpose.

HOW WE SHARE PERSONAL INFORMATION

We do not sell personal information, we do not share personal information with third parties for cross-context behavioral advertising purposes.

We only share personal information in limited circumstances as described in this Privacy Notice. For example, we may share personal information with our corporate affiliates and subsidiaries as well as our third-party service providers, suppliers, vendors, professional advisors and business partners, which may include IT service providers, financial institutions and payment providers, customer relationship management vendors, social media platforms, other cloud-based solutions providers, lawyers, accountants, auditors and other professional advisors. We contract with such vendors and advisers to ensure that they only process your personal information under our instructions and ensure the security and confidentiality of your personal information. We share personal information with these third parties to help us:

with the uses described in the How We Use Information section above;
in the operation, management, improvement, research and analysis of our Services;
with our marketing and promotional projects, such as sending you information about products and services you may like and other promotions (provided you have not unsubscribed from receiving such marketing and promotional information from us); and
to comply with your directions or any consent you have provided us.

We may share personal information with law enforcement and regulatory authorities or other third parties as required or permitted by law for the purpose of:

responding to a subpoena, court order, or other legal processes;
defending, protecting, or enforcing our rights;
assisting in the event of an emergency; and
complying with applicable law.

In accordance with applicable law, we may also transfer or assign personal information to third parties as a result of, or in connection with, a sale, merger, consolidation, change in control, transfer of assets, bankruptcy, reorganization, or liquidation. If we are involved in defending a legal claim, we may disclose personal information about you that is relevant to the claim to third parties as a result of, or in connection with, the associated legal proceedings.

To see all of the categories of personal information we share, click here.

We share non-personal information with third parties as reasonably necessary to meet our business needs.

HOW WE PROTECT PERSONAL INFORMATION

We are dedicated to ensuring the security of your personal information. We use physical, electronic, and administrative security measures appropriate to the risks and sensitivity of the personal information we collect. Personal information is maintained on our servers or those of our service providers, and is accessible by authorized employees, representatives, and agents as necessary for the purposes described in this Privacy Notice. We aim to provide secure transmission of your personal information from your devices to our servers. We have processes to store personal information that we have collected in secure operating environments. Our security procedures mean that we may occasionally request proof of identity before we disclose your personal information to you. While we attempt to protect your personal information in our possession, no method of transmission over the internet or security system is perfect, and we cannot promise that information about you will remain secure in all circumstances. If you suspect an unauthorized use or security breach of your personal information, please contact us immediately.

DATA TRANSFERS

The information we collect may be transferred to, stored, and processed in any country or territory where one or more of our business partners or service providers are based or have facilities which may be a different to your home country. While other countries or territories may not have the same standards of data protection as those in your home country, we will continue to protect personal information that we transfer in line with this Privacy Notice requiring that our business partners or service providers adhere to this Privacy Notice and the applicable privacy regulations in your home country.

CHILDREN’S PRIVACY

Our Services are not for children or those under the age of 13. We do not knowingly collect personal information from children or other persons who are under 13 years of age. Individuals who are children or those under the age of 13 should not attempt to provide us with any personal information. If you think we have received personal information from children or those under the age of 13, please contact us immediately.

YOUR CALIFORNIA PRIVACY RIGHTS

We do not share personal information with third parties for their own direct marketing purposes without your consent. California residents under 18 years old, in certain circumstances, may request and obtain removal of personal information or content that you have posted on our Services. Please be mindful that this would not ensure complete removal of the content posted by you on our Services. To make any request pursuant to California privacy law, please contact us.

YOUR CHOICES AND CONTROLS

In accordance with applicable law, you may exercise certain choices and rights in connection with our Services as described in this section. Some of the rights may vary depending on your country, province, or state of residence.

Access to your personal information

You have the right to request access to the personal information that we collect, use, and disclose about you. You also have the right to not receive discriminatory treatment for exercising your access right. To submit a request or designate an authorized agent to make a request, please contact us using the information below.

Deleting your personal information

You have the right to request that we delete your personal information, subject to some exceptions under applicable law. Once we have received and confirmed your request, we will delete (and direct our partners and service providers to delete) your personal information, unless an exception under applicable law applies. You have the right to not receive discriminatory treatment for exercising your deletion right. To submit a request or designate an authorized agent to make a request, please contact us using the information below.

Correcting your personal information

You have the right to request that we update or correct the personal information we collect. You also have the right to not receive discriminatory treatment for exercising your correction right. To submit a request or designate an authorized agent to make a request, please contact us using the information below.

Email Communications / Direct Marketing

You may have the opportunity to receive certain communications from us related to our Services. If you provide us with your email address in order to receive communications, you can opt-out of marketing emails at any time by following the instructions at the bottom of our emails and adjusting your email preferences. Please note that certain emails may be necessary for the operation of our Services. You will continue to receive these necessary emails, if lawful and appropriate, even if you unsubscribe from our optional marketing communications.

THIRD PARTY WEBSITES AND APPS

Our website and Services may contain links to other websites or apps operated by third parties. Please be advised that the practices described in this Privacy Notice do not apply to information gathered through these third-party websites and apps. We have no control over, and are not responsible for, the actions and privacy policies of third parties and other websites and apps.

CONTACT US

We welcome requests, questions, comments, and feedback on this Privacy Notice and our management of personal information. If you have requests, questions, concerns, or feedback, you can always contact us in the following ways. For your protection, we may need to verify your identity before assisting with your request, such as verifying that the information used to contact us matches the information that we have on file.

Email

[email protected]

Mail

909 Walnut, Suite 200

Kansas City, MO 64106

Submitting a Privacy Request

You can submit a request as described in the Your Choices and Controls section by:

Submitting a Request Form;
Calling (888) EPR-REIT; or
Emailing [email protected].

Verification Process and Required Information

Some of the requests under Your Choices and Controls must be verified to confirm the request came from you. We may contact you by phone or e-mail to verify your request. This process may require us to request additional personal information from you, including, but not limited to, your email address, mailing address, account name, and/or date of last interaction with us. In certain circumstances, we may decline a request to exercise a privacy right, particularly where we are unable to verify your identity.

Responding to Requests

Once you have submitted your request, we will respond within the time frame permitted by the applicable law. We may charge a reasonable fee for multiple requests in the same 12-month period, as permitted by law.

Authorized Agent

You may designate an authorized agent to submit a request on your behalf. To do so, you must (1) verify your own identity directly with us; and (2) provide the authorized agent with written documentation of their authority to act on your behalf, such as: (a) a power of attorney; or (b) sufficient evidence to show that you have provided the authorized agent signed permission to act on your behalf and directly confirmed with us that you provided the authorized agent permission to submit the request on your behalf. We may deny a request from an authorized agent that does not submit proof that they have been authorized by you to act on your behalf.

California Privacy Law Appendix

This appendix seeks to provide additional information to residents of California and supplements the information provided in the Privacy Notice above. As discussed above in further detail, we do “sell” or “share” any personal information as such terms are defined under California privacy law.

To learn more about the categories of personal information we collect, how we collect it, why we collect it, with whom we share it, and how long we retain it, please see the items below. To submit a privacy request, please see the instructions provided above in the Contact Us section.

Category	What we collect	How we collect it	Why we collect it	With whom we share it	How long we retain it
Identifiers	Name, mailing address, email address, phone number, and other contact information. For more information please see the Types of Information We Collect section above.	Collected when you directly provide it to us, through your use of our Services, or from third parties.	We collect this information for the purposes listed in the How We Use Information section above.	Shared with our affiliates, partners, vendors, and service providers as described in the How We Share Information section above.	We retain information for as long as necessary for the purpose for which it was initially collected, including the purposes listed in the How We Use Information section above.
Protected classification characteristics under California or federal law	Not collected.	N/A	N/A	N/A	N/A
Commercial information	Not collected.	N/A	N/A	N/A	N/A
Biometric information	Not collected.	N/A	N/A	N/A	N/A
Internet or other similar network activity	IP address, browser type and version, browser plug-in types and versions, operating system and platform, device type and device identifiers For more information please see the Types of Information We Collect section above.	Collected online when you directly provide it to us, through your use of our Services, or from third parties.	We collect this information for the purposes listed in the How We Use Information section above.	Shared with our affiliates, partners, vendors, and service providers as described in the How We Share Information section above.	We retain information for as long as necessary for the purpose for which it was initially collected, including the purposes listed in the How We Use Information section above.
Geolocation data	Imprecise location data derived from IP addresses. For more information please see the Types of Information We Collect section above.	Collected online or offline when you directly provide it to us, through your use of our Services, or from third parties.	We collect this information for the purposes listed in the How We Use Information section above.	Shared with our affiliates, partners, vendors, and service providers as described in the How We Share Information section above.	We retain information for as long as necessary for the purpose for which it was initially collected, including the purposes listed in the How We Use Information section above.
Sensory data (Audio, video, etc.)	Not collected.	N/A	N/A	N/A	N/A
Professional or employment-related information	Not collected.	N/A	N/A	N/A	N/A
Non-public education information	Not collected.	N/A	N/A	N/A	N/A
Inferences drawn from other personal information	Information generated from your use of our Services reflecting your preferences	Collected when you directly provide it to us, through your use of our Services, or from third parties.	We collect this information for the purposes listed in the How We Use Information section above.	Shared with our affiliates, partners, vendors, and service providers as described in the How We Share Information section above.	We retain information for as long as necessary for the purpose for which it was initially collected, including the purposes listed in the How We Use Information section above.
Sensitive personal information	Not collected.	N/A	N/A	N/A	N/A