Releaf

Your privacy is important to us.

This Privacy Notice explains how Releaf collects, uses, stores and protects your personal data when you visit our website, create an account, interact with our platform or use our services.

We are committed to handling your personal data lawfully, fairly and transparently and in accordance with applicable data protection laws.

Please read this Privacy Notice carefully. It should be read together with our Website Terms of Use and, where applicable, any Country-Specific Patient Terms that apply to the services you receive.

This Privacy Notice applies to personal data collected through www.releaf.com, including all country-specific sections, subdomains and subfolders (for example, www.releaf.com/de) (together, the Platform).

It applies to:

• visitors to the Platform;
• individuals who create an account;
• prospective patients;
• existing and former patients;
• individuals making enquiries about our services;
• individuals purchasing products or services through the Platform; and
• any other person whose personal data we process through the Platform.

Additional privacy information may be provided where you access healthcare services within a particular jurisdiction.

Where there is any inconsistency between this Privacy Notice and any country-specific privacy information provided in connection with healthcare services, the country-specific privacy information will prevail to the extent of that inconsistency.

The Platform is operated by Releaf Dispensary Ltd, a company incorporated in England and Wales (company number 14097825) whose registered office is:

1 King's Avenue
London
 N21 3NA
 United Kingdom

In this Privacy Notice, references to "Releaf", "we", "our" or "us" mean Releaf Dispensary Ltd.

For the purposes of applicable data protection legislation, Releaf Dispensary Ltd will generally act as the controller of your personal data when operating the Platform.

However, where you receive healthcare services, other organisations (including healthcare professionals, clinics or pharmacies) may also process your personal data in connection with the services they provide to you. Depending on the circumstances, those organisations may act as independent data controllers, joint controllers or processors.

Where appropriate, further information about those organisations and their role in processing your personal data will be provided before you receive those services.

Releaf operates an international platform that supports healthcare services across multiple jurisdictions.

Although the Platform is accessible internationally, the healthcare services, products and medicines available through it differ between countries and are subject to local legal and regulatory requirements.

Accordingly:

• not all services are available in every jurisdiction;
• the organisations involved in providing services may differ between countries;
• different healthcare providers may be responsible for delivering your care; and
• additional country-specific terms and privacy information may apply.

Nothing in this Privacy Notice should be interpreted as meaning that every service described on the Platform is available in every country.

Our role in processing your personal data depends upon how you interact with the Platform.

For example:

Where healthcare services are provided by independent healthcare professionals, clinics or pharmacies, those organisations may process your personal data independently in accordance with their own legal obligations and privacy notices.

If you have any questions about this Privacy Notice or how we process your personal data, you can contact us:

Data Protection Officer

Releaf Dispensary Ltd

1 King's Avenue

London

N21 3NA

United Kingdom

Email: dataprotection@releaf.com

If we appoint a representative or additional contact point for a particular jurisdiction, their details will be made available in the relevant country-specific section of the Platform.

In this Privacy Notice:

Country-Specific Patient Terms means the terms governing healthcare services provided within a particular jurisdiction.

Healthcare Provider means any doctor, clinician, pharmacy, dispensing provider or other healthcare organisation involved in providing healthcare services to you.

Personal Data means any information relating to an identified or identifiable individual.

Platform means the website located at www.releaf.com, together with its country-specific sections, subdomains, subfolders and associated services.

Processing means any operation performed on Personal Data, including collection, storage, use, disclosure, transmission or deletion.

Special Category Data means personal data requiring additional protection under applicable data protection laws, including information concerning health.

The personal data we collect depends on how you interact with the Platform and the services you choose to use.

We may collect personal data directly from you, automatically when you use the Platform, from third parties acting on your behalf or, where permitted by law, from other organisations involved in providing healthcare services.

The categories of personal data we collect are set out below.

8.1 Information You Provide Directly

You may provide personal data when you:

• visit or use the Platform;
• create an account;
• complete registration forms;
• make enquiries;
• subscribe to newsletters or marketing communications;
• book appointments;
• complete medical questionnaires;
• participate in consultations;
• purchase products or services;
• contact customer support; or
• otherwise communicate with us.

Depending on the circumstances, this information may include:

• your name;
• date of birth;
• postal address;
• email address;
• telephone number;
• country of residence;
• preferred language;
• account credentials;
• payment and billing information;
• communications with us;
• preferences;
• identification documents where verification is required; and
• any other information you choose to provide.

8.2 Health Information

Where you register for healthcare services or become a patient, we may collect information relating to your health.

Depending on the services you access, this may include:

• symptoms;
• medical history;
• diagnoses;
• medications;
• allergies;
• treatment history;
• consultation notes;
• prescriptions;
• clinical assessments;
• adverse events;
• outcome measures;
• healthcare correspondence; and
• other information necessary for the safe provision of healthcare services.

We only collect health information that is relevant to the services being provided.

8.3 Identity Verification Information

Where required by law, regulation or our own verification procedures, we may collect information to verify your identity.

This may include:

• photographic identification;
• proof of address;
• facial image or biometric comparison where identity verification technology is used;
• age verification information; and
• information confirming your eligibility to access particular services.

8.4 Information Collected Automatically

When you use the Platform, certain information is collected automatically.

This may include:

• IP address;
• browser type;
• operating system;
• device identifiers;
• language settings;
• pages visited;
• referring website;
• dates and times of access;
• session information;
• cookie identifiers; and
• information about how you use the Platform.

Some of this information is collected through cookies and similar technologies. Further information is available in our Cookie Policy.

8.5 Information From Third Parties

Where permitted by law, we may receive personal data from third parties, including:

• healthcare professionals;
• clinics;
• pharmacies;
• diagnostic laboratories;
• healthcare record providers;
• identity verification providers;
• payment providers;
• fraud prevention agencies;
• customer support platforms;
• marketing partners;
• analytics providers; and
• publicly available sources where relevant.

The categories of information received will depend on the services you access and the purpose for which the information is shared.

Certain personal data we process is classified as Special Category Data under applicable data protection legislation.

This includes information concerning your:

• physical health;
• mental health;
• medical history;
• treatments;
• prescriptions;
• healthcare consultations; and
• other health-related information necessary for the provision of healthcare services.

We recognise that this information requires a higher level of protection.

We will only process Special Category Data where:

• you have provided it voluntarily;
• it is necessary for the provision of healthcare services;
• it is required to comply with legal or regulatory obligations; or
• another lawful basis under applicable data protection legislation applies.

We implement additional technical and organisational safeguards to protect Special Category Data against unauthorised access, loss or misuse.

If you provide personal data relating to another individual, you confirm that:

• you are authorised to provide that information; and
• where required, you have informed them how their personal data will be used.

The Platform is intended primarily for adults.

We do not knowingly collect personal data from children except where:

• permitted by applicable law;
• necessary in connection with the provision of healthcare services; or
• authorised by a parent, guardian or other person legally entitled to act on the child's behalf.

If we become aware that we have collected personal data from a child unlawfully, we will take appropriate steps to delete that information.

We use cookies and similar technologies to:

• operate the Platform;
• remember your preferences;
• maintain security;
• understand how the Platform is used;
• improve performance;
• personalise content where appropriate; and
• measure the effectiveness of communications and marketing.

Depending on your location, you may be given options to manage your cookie preferences before non-essential cookies are placed on your device.

Further information about the cookies we use, the purposes for which they are used and how you can manage your preferences is available in our Cookie Policy.

We only process your personal data where we have a lawful basis for doing so.

The way in which we use your personal data depends upon how you interact with the Platform and the services you choose to access.

The purposes for which we process your personal data are described below.

13.1 Operating the Platform

We use personal data to:

• provide access to the Platform;
• create and manage user accounts;
• authenticate users;
• maintain the security and integrity of the Platform;
• personalise your experience where appropriate;
• respond to enquiries;
• provide customer support; and
• administer the Platform.

Our lawful basis for this processing is:

• performance of a contract;
• our legitimate interests in operating and improving the Platform; and
• compliance with legal obligations where applicable.

13.2 Providing Healthcare Services

Where you register as a patient or access healthcare services, we use your personal data to:

• assess your eligibility for services;
• arrange consultations;
• facilitate clinical assessments;
• support prescribing decisions;
• communicate with healthcare professionals;
• issue prescriptions where appropriate;
• coordinate dispensing and delivery;
• monitor treatment;
• manage follow-up care; and
• maintain healthcare records.

Our lawful basis for this processing includes:

• performance of a contract;
• provision of healthcare services;
• compliance with legal and regulatory obligations; and
• other lawful bases permitted under applicable data protection legislation.

Where Special Category Data is processed, we rely on the additional conditions available under applicable data protection laws relating to healthcare and the provision of medical treatment.

13.3 Managing Payments

Where you purchase products or services, we use your information to:

• process payments;
• verify transactions;
• issue invoices;
• administer refunds where applicable; and
• detect fraudulent activity.

Payment card information is processed by our authorised payment providers. We do not store full payment card details unless necessary and permitted by law.

13.4 Communications

We use your personal data to communicate with you regarding:

• appointments;
• prescriptions;
• healthcare services;
• customer support;
• service updates;
• security notifications;
• changes to our terms or policies; and
• other information necessary to administer your account.

These communications are generally necessary to perform our contract with you or to comply with our legal obligations.

13.5 Marketing

Where permitted by law, we may use your personal data to provide information about:

• our services;
• new products;
• educational content;
• promotions;
• surveys; and
• other information that we believe may be of interest to you.

Where consent is required, we will only send marketing communications where you have provided that consent.

You may withdraw your consent or unsubscribe from marketing communications at any time.

Operational communications relating to your account or healthcare services are not marketing communications.

13.6 Improving Our Services

We use information to:

• analyse how the Platform is used;
• improve user experience;
• develop new functionality;
• identify technical issues;
• improve healthcare services;
• evaluate outcomes;
• conduct quality assurance;
• manage complaints;
• train staff; and
• support business planning.

Where possible, we will use anonymised or aggregated information for these purposes.

13.7 Legal and Regulatory Obligations

We may process personal data where necessary to:

• comply with applicable laws;
• respond to lawful requests from regulators or public authorities;
• exercise or defend legal claims;
• prevent fraud;
• protect the safety of users;
• comply with healthcare regulations;
• investigate complaints; and
• meet our professional and regulatory obligations.

Releaf may use technology-assisted systems to support the operation of the Platform and the delivery of our services.

These systems may assist with activities such as:

• identity verification;
• fraud prevention;
• customer support;
• appointment management;
• document processing;
• service analytics;
• quality assurance; and
• administrative tasks.

Where automated tools are used in connection with healthcare services, they are intended to support—not replace—the judgement of appropriately qualified healthcare professionals.

We do not make solely automated decisions that produce legal or similarly significant effects concerning you unless permitted by applicable law and appropriate safeguards are in place.

Where permitted by law, we may use personal data to:

• improve healthcare services;
• evaluate clinical outcomes;
• conduct internal audits;
• develop new services;
• improve patient safety;
• undertake statistical analysis; and
• support research initiatives.

Where reasonably practicable, we will use anonymised or aggregated information for these purposes.

Where identifiable personal data is required for research, we will ensure that an appropriate lawful basis applies and that additional safeguards are implemented where required.

We retain personal data only for as long as necessary for the purposes described in this Privacy Notice.

Retention periods vary depending on:

• the nature of the information;
• the services provided;
• applicable legal requirements;
• healthcare record retention obligations;
• accounting and tax requirements;
• limitation periods for legal claims; and
• our legitimate business needs.

Where retention periods expire, we will securely delete or anonymise the relevant information unless we are required or permitted by law to retain it for longer.

Further information about our retention practices is available upon request.

We will only share your personal data where it is necessary to provide our services, comply with legal obligations, protect legitimate interests or where you have otherwise authorised us to do so.

Depending on the services you use, we may share your personal data with the following categories of recipients.

17.1 Healthcare Providers

Where you receive healthcare services, we may share your personal data with:

• doctors;
• clinicians;
• prescribing professionals;
• pharmacies;
• dispensing providers;
• laboratories; and
• other healthcare organisations involved in providing your care.

These organisations may act as independent data controllers in relation to the healthcare services they provide.

17.2 Service Providers

We use carefully selected third-party service providers to support the operation of the Platform.

These providers may assist with services including:

• cloud hosting;
• identity verification;
• payment processing;
• customer support;
• communications;
• appointment management;
• analytics;
• fraud prevention;
• cybersecurity;
• document management;
• software development; and
• secure data storage.

Where these organisations process personal data on our behalf, they do so under appropriate contractual arrangements requiring them to protect your personal data.

17.3 Professional Advisers

We may share personal data where necessary with:

• legal advisers;
• auditors;
• insurers;
• accountants;
• regulatory consultants; and
• other professional advisers.

17.4 Regulators and Public Authorities

We may disclose personal data where required or permitted by law, including to:

• courts;
• law enforcement agencies;
• healthcare regulators;
• data protection authorities;
• government departments; and
• other competent public authorities.

17.5 Business Transactions

If Releaf undergoes a merger, acquisition, restructuring, investment, sale of assets or other corporate transaction, personal data may be transferred as part of that transaction, subject to appropriate safeguards and applicable legal requirements.

As an international platform, personal data may be transferred to or accessed from countries outside the country in which it was originally collected.

Where personal data is transferred internationally, we will ensure that appropriate safeguards are in place in accordance with applicable data protection legislation.

These safeguards may include:

• transfers to countries benefiting from an adequacy decision;
• the use of approved contractual safeguards;
• binding corporate rules where applicable; or
• other lawful transfer mechanisms recognised by applicable data protection laws.

Further information about international transfers and the safeguards we use is available upon request.

We implement appropriate technical and organisational measures designed to protect personal data against:

• unauthorised access;
• accidental loss;
• unlawful destruction;
• alteration;
• misuse; and
• unauthorised disclosure.

These measures include, where appropriate:

• encryption;
• access controls;
• authentication measures;
• staff training;
• security monitoring;
• contractual controls with service providers; and
• regular review of our security practices.

Although we take reasonable steps to protect personal data, no method of electronic transmission or storage is completely secure.

Depending on your location and the applicable data protection legislation, you may have the right to:

• access your personal data;
• request correction of inaccurate information;
• request deletion of your personal data;
• restrict or object to certain processing;
• withdraw consent where processing is based on consent;
• request transfer of your personal data to another organisation;
• object to direct marketing;
• object to certain automated decision-making; and
• lodge a complaint with a supervisory authority.

These rights are not absolute and may be subject to legal or regulatory limitations.

If you wish to exercise any of your rights, please contact us using the details set out below.

If you have concerns about how we have handled your personal data, we encourage you to contact us first so that we have an opportunity to investigate and resolve the matter.

If you remain dissatisfied, you may lodge a complaint with the supervisory authority responsible for data protection in your country of residence or the jurisdiction in which the relevant processing took place.

For users in the United Kingdom, the supervisory authority is the Information Commissioner's Office.

Further information is available at www.ico.org.uk.

We may update this Privacy Notice from time to time to reflect:

• changes to our services;
• changes to applicable law;
• regulatory guidance;
• technological developments; or
• changes to our business operations.

Where changes are material, we will take appropriate steps to bring them to your attention.

The latest version of this Privacy Notice will always be available on the Platform and will include the date on which it was last updated.