Patient Privacy Policy

1. Our Privacy Commitment

California Medical Marijuana Card ("we", "us", "our") respects your privacy. We comply with the federal Health Insurance Portability and Accountability Act (HIPAA), the HITECH Act, the California Confidentiality of Medical Information Act (CMIA), and the California Consumer Privacy Act (CCPA). This policy explains how we handle the information you share with us and the choices you have.

2. Information We Collect

We collect the minimum information necessary to provide a safe and compliant telehealth evaluation. This includes:

• Identifying information: name, date of birth, address, phone, email
• Proof of California residency: state ID, driver's license, or equivalent
• Medical information you share with the physician: symptoms, medical history, current medications
• Payment information processed through a secure third-party payment processor (we do not store full card numbers)
• Technical data: IP address, browser type, device type, and pages visited, for security and analytics

3. How We Use Your Information

• To conduct your medical cannabis evaluation and issue (or decline) a recommendation
• To verify your identity and California residency
• To process payment and issue refunds
• To send appointment confirmations, recommendation copies, and renewal reminders
• To improve the Site, our patient experience, and platform security
• To comply with our legal obligations

4. How We Share Your Information

We do not sell, rent, or trade your personal or medical information. We share information only as needed to deliver our services and as required by law:

• Treating physicians. The licensed California physician evaluating you receives the information needed for treatment.
• Service providers. Vetted third parties (telehealth platform, payment processor, hosting provider) under written agreements that bind them to confidentiality and HIPAA-equivalent safeguards.
• Dispensaries (when you authorize). A dispensary may verify your recommendation directly with the issuing clinic at the time of purchase. We only confirm validity; we do not share underlying medical records.
• Legal obligations. Where required by court order, subpoena, or applicable law.

5. How We Protect Your Information

We use industry-standard administrative, physical, and technical safeguards designed to protect your information. All telehealth visits take place on a HIPAA-compliant platform with end-to-end encryption. Records are stored on encrypted servers, accessible only by authorized personnel under role-based access controls. We routinely review our security practices and train all staff on patient confidentiality.

6. Your Rights Under HIPAA and California Law

• Request a copy of the medical information we hold about you
• Request that we correct inaccurate information
• Request restrictions on how your information is used or shared
• Request confidential communication (for example, a specific email or phone)
• Receive an accounting of certain disclosures we have made
• File a complaint with us or with the U.S. Department of Health and Human Services Office for Civil Rights without fear of retaliation

To exercise any of these rights, email contact@californiamedicalmarijuanacard.org with the subject line "Privacy Request".

7. California Specific Rights (CCPA)

If you are a California resident, you have the right to know what personal information we collect, the right to request deletion of certain personal information, and the right to opt out of any "sale" of personal information (note: we do not sell your personal information). To submit a CCPA request, contact us at the email above.

8. Cookies and Analytics

The Site uses essential cookies for security and basic functionality. We also use limited analytics tools to understand how visitors use the Site so we can improve it. You can disable non-essential cookies in your browser settings without affecting the core functionality of the Site.

9. Children's Privacy

The Site is intended for users 18 and older, or for minors using the Site through a parent or legal guardian acting as primary caregiver. We do not knowingly collect personal information directly from children under 13. If you believe a child has provided us information, please contact us so we can delete it.

10. Federal Database and Background Check Notice

California's Medical Marijuana Identification Card Program (administered by CDPH) protects patient information under state confidentiality law and does not share it with federal firearm databases such as NICS. We do not share your information with the ATF, DEA, employers, insurers, or law enforcement except where compelled by valid legal process.

11. Data Retention

Medical records are retained for at least seven years from the date of the last visit, as required by California law for adult patients, and longer for minor patients. You may request earlier deletion of non-clinical information, subject to legal recordkeeping requirements.

12. Changes to This Policy

We may update this policy from time to time to reflect changes in law or our practices. The "Last updated" date above shows when the policy was last revised. We encourage you to review this page periodically.

13. Contact Us

Questions about this policy, our privacy practices, or your rights? Reach our Privacy Officer at contact@californiamedicalmarijuanacard.org. We respond to every privacy inquiry promptly.