Your information, protected.

Most information comes directly from you.

We may also receive information from people or organizations involved in providing services to you, including:

• healthcare professionals;
• licensed cannabis sellers or fulfilment partners;
• your insurance company;
• and service providers acting on our behalf.

To set up and bill your orders, Flora may request your coverage and authorization details from your insurance company, including any limits on what your coverage pays for.

We only collect information from these sources where there is an appropriate purpose and legal authority to do so.

We use personal information to operate Flora, register you as a medical client, coordinate fulfilment, administer eligible benefits, provide support, protect the service and maintain required records.

We may also use or disclose information where permitted or required by law.

We do not use personal information for unrelated purposes without an appropriate legal basis or your consent where consent is required.

We do not sell your personal or health information.

We disclose information only where there is an appropriate purpose, and only what is needed for that purpose.

Licensed cannabis partners

So that you can be registered as a patient and your orders can be fulfilled, and so the partner can meet its own legal obligations.

Healthcare professionals

So that professionals involved in your care can support it, where you have authorized the disclosure or applicable law permits it.

Benefit administrators

So that coverage can be verified, claims administered and payment reconciled with your insurance company.

Service providers

So that Flora can run: technology, hosting, security, communications, payment and support. Service providers handling information on our behalf are required to protect it and use it only for authorized purposes.

Authorities

Where disclosure is required or permitted by applicable law.

Some information connected to your registration, account, orders or benefits must be kept to meet legal, regulatory or record-keeping requirements.

How long we keep information depends on the type of record, why it is needed and the requirements that apply.

Closing your Flora account does not necessarily mean that all records can be deleted immediately.

When information is no longer required, we securely delete, destroy or anonymize it in accordance with our retention practices and applicable law.

Health information is sensitive.

We use administrative, technical and physical safeguards appropriate to the sensitivity of the information we hold.

These safeguards are intended to protect information against unauthorized access, disclosure, loss, theft, alteration or misuse.

Access to personal information is limited to people and service providers who require it for an authorized purpose.

If a privacy or security incident occurs, we investigate it and notify affected individuals, regulators or other parties where required by law.

Depending on the circumstances and applicable privacy law, you may:

Request access

Ask to see personal information we hold about you.

Request a correction

Ask us to correct personal information that is inaccurate or incomplete.

Withdraw consent where applicable

Where we rely on your consent, you may withdraw it, subject to legal or contractual restrictions.

We will explain any consequences that apply.

Ask how your information has been handled

You can ask questions about why information was collected, how it has been used or disclosed, and how it is protected.

Raise a privacy concern

You may contact our Privacy Officer if you believe your information has not been handled appropriately.

You may also have the right to make a complaint to the privacy regulator responsible for the applicable privacy law.

Some records must be preserved in their original form or retained for a required period. Where that applies, we will explain what we can change or remove and what we are required to keep.

High Hopes Research Society is a British Columbia not-for-profit organization.

British Columbia’s Personal Information Protection Act (PIPA) applies to personal information handled by private-sector organizations within its scope, including not-for-profit organizations.

Depending on the activity, jurisdiction and Flora’s role, other privacy laws may also apply, including the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and provincial health-information legislation such as Ontario’s Personal Health Information Protection Act (PHIPA).

Medical cannabis activities are also governed by requirements under the federal Cannabis Act and Cannabis Regulations.

We use an AI service provider in the United States to read messages you send us, so we can recognize when you may need urgent help and route you to the right person. It doesn’t receive your name and may not use your information for anything else, including training.

Flora stores your information in Canada, except text messages and email you exchange with us: these go through providers outside Canada, so your mobile number, messages and emails are processed there.

We may send service communications that are necessary to operate your account, registration and orders. Promotional communications are separate, and you can unsubscribe from them at any time.

From time to time, Flora members may be invited to participate in research.

Participation is always voluntary and will be explained separately at the time of the opportunity. Choosing not to participate will not affect your Flora account, registration, orders or eligible benefits.

Any research use of your information will be based on the consent and privacy terms provided for that specific research opportunity.