Washington Consumer Health Data Privacy Policy

1. Processing Consumer Health Data Under the MHMDA

From time to time, the Service may offer functions which allow users to review and/or select medical cannabis products for purchase at one of the Company's stores.

Such functions of the Service involve collecting Personal Information from you that may identify your past, present, or future physical or mental health status and be subject to the MHMDA. We process all Consumer Health Data as described below:

a. Information Regarding Your Consumer Health Data

The Company only collects and processes Consumer Health Data from you for the purpose of providing the functions specified above. Similarly, the Company shares such Consumer Health Data with its affiliates and service providers solely for the purposes of the specified above functions.

The Company may collect and use the following types of Consumer Health Data:

• Data that identifies a consumer seeking health care services; and
• Information derived or extrapolated from nonhealth information that is associated with the categories of data listed above, or otherwise identifies the consumer associated with categories of data listed above.

b. How We Use Your Consumer Health Data

We use the above categories of Consumer Health Data for the following purposes:

• Fulfilling the purposes for which you provided the Consumer Health Data or that were described when it was collected;
• Performing the Service functions that you requested from us and responding to your questions or requests for information;
• Notifying you about the Service functions that you requested from us;
• Facilitating operations performance, security, and integrity, including: undertaking activities to prevent, detect, and investigate security incidents that compromise the availability, authenticity, integrity, or confidentiality of stored or transmitted Consumer Health Data or that otherwise threaten to compromise the performance, security, or integrity of our business; and performance analytics, identity verification and authorization, site and application optimization, and quality control.
• Recordkeeping and auditing.
• Complying with our legal obligations and risk management, audit, investigations and reporting, and other legal and compliance reasons.

c. Sources of Consumer Health Data

We collect Consumer Health Data from the following sources:

• You
• Your device
• Our affiliates and service providers, who provide us with information about consumers who are viewing our content across websites or applications, interacting with our promotions, benefits or other programs.

d. How We Disclose Consumer Health Data

We do not sell your Consumer Health Data. We may disclose any of the Consumer Health Data categories listed above to processors, service providers, and contractors that help us provide our Service to you. We may also disclose your Consumer Health Data to other third parties, including the Department of Health when you visit our stores in-person to register an authorization form and obtain a medical cannabis recognition card.

We instruct processors, service providers, and contractors to only use Consumer Health Data as permitted by our contracts with them and consistent with applicable law.

We may also disclose Consumer Health Data as permitted by applicable law, including:

• With your consent;
• To prevent, detect, protect from, or respond to security incidents, identity theft, fraud, harassment, or malicious or deceptive activities.
• To a third party acquiring our assets if the Company sells its business or otherwise is part of a merger, acquisition, bankruptcy, or other transaction involving a third party taking control of our assets or business.
• To investigate, report, or take legal action to protect our rights, property, and safety and the rights, property, and safety of others.
• To protect your or others' vital interests, including health and safety.

2. Rights Regarding Your Consumer Health Data

Under Washington's My Health My Data Act, consumers have the right (i) to confirm the specific categories of Consumer Health Data that we are processing, and to access such data; (ii) to receive a list of all third parties and affiliates with whom we have shared or sold your Consumer Health Data and an active email address or other online mechanism that you may use to contact these third parties; (iii) to withdraw consent from our collection and sharing of your Consumer Health Data; and (iv) to have your Consumer Health Data deleted upon request. Consumers may exercise any of these rights up to twice per year.

a. How to Exercise Your Rights

To exercise these rights, you may submit a verifiable consumer request to us by using the contact information provided at the bottom of this page. Only you, or a person that you authorize to act on your behalf, may make a verifiable consumer request related to your information. Your verifiable consumer request must provide sufficient information that allows us to reasonably verify that you are the person about whom we collected Consumer Health Data or an authorized representative, and describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it. We cannot respond to your request or provide you with information if we cannot verify your identity or authority to make the request. Making a verifiable consumer request does not require you to create an account with us. We will only use Consumer Health Data provided in a verifiable consumer request to verify the requestor's identity or authority to make the request.

We endeavor to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to ninety (90) days from the day that we received your request), we will inform you of the reason and extension period in writing.

b. Exceptions

The above rights are not absolute, and in some instances, we may decline your request as permitted by law. If your request to exercise a right is denied, you may appeal that decision by contacting us using the information at the bottom of this page. If your appeal is unsuccessful, you can raise a concern or lodge a complaint with the Washington State Attorney General at www.atg.wa.gov/file-complaint.

Note that we may retain some of your Consumer Health Data even after your request has been processed, to the extent necessary to comply with our legal obligations or as necessary to provide the Service to you.

3. Contact Us

If you have any questions regarding this Consumer Health Data Policy or our data processing practices, please contact us at the address below: