Privacy Policy

Membership and account details such as full name, email address, password login credentials, and email verification records.

Telemed and prescription intake details such as passport or Thai ID number, date of birth, age, nationality, medical conditions, medication or allergy history, symptoms, vital signs, usage details, consent acknowledgements, and e-signature.

Identity files and uploads such as ID or passport images, photos holding the ID document, and attached signature files.

Profile and account support details such as phone number, address, country, membership tier status, newsletter preference, and account update history.

Order and rewards records such as order history, qualifying spend, membership grants, loyalty balances, points ledger activity, redemptions, and related support or admin notes.

Business enquiry and Project Atlas application details such as farm or company name, contact details, location, facility size, cultivation method, capacity, certifications, licence status, introduction, campaign tags, and referring page.

Technical and session data such as authenticated session tokens, cart/session identifiers, cookie preferences, basic request metadata, and limited security/rate-limit data such as IP address on some account actions.

To create and secure your account, confirm your email, and help you sign in.

To process membership services, maintain rewards and tier eligibility, and support customer service.

To collect and review telemed or prescription-related information and manage renewals or follow-up actions.

To reuse your e-signature when reapplying for your prescription in the future, where you have authorized us to do so.

To store required identity and medical supporting files for authorized internal review.

To prevent fraud, enforce security controls, investigate misuse, and comply with legal obligations.

To keep the site working, including cart continuity, session handling, and consent preferences.

To review business enquiries and Project Atlas farm applications, identify their source, communicate next steps, and manage the qualification pipeline.

Customer account, membership, order, and prescription data is stored in our Supabase-backed database and file storage systems, along with essential browser storage on your device for login, cart, and session continuity.

Access is limited to authorized internal users who need it for operations, support, security, membership handling, or prescription administration.

The most sensitive telemed uploads and prescription files are currently restricted to owner/admin access in the internal admin system.

We do not sell personal information.

We may share data with service providers that help operate the site and business, such as hosting, authentication, database, file-storage, payment, or email providers.

We may disclose information when required by law, to respond to valid legal requests, or to protect our rights, users, staff, or the public.

Essential cookies or browser storage may be used for login, security, cart, consent preferences, and other core site functions.

At the time of this policy version, we did not find Google Analytics, Facebook Pixel, or similar marketing trackers loading by default in the current frontend codebase.

If non-essential analytics or marketing tools are added later, they should only load after you accept cookies.

We keep account, membership, telemed, business enquiry, application, and support records for as long as reasonably needed to operate the service, manage your relationship with us, and protect the business.

Some data may be kept longer where needed for security, fraud prevention, dispute handling, tax/accounting records, legal compliance, or prescription/medical administration records.

When data is no longer needed, we aim to delete, anonymize, or limit access to it, subject to legal or operational retention requirements.

You can request access to the personal data we hold about you.

You can ask us to correct inaccurate or incomplete information.

You can request deletion of your personal data. We will review the request and delete data we are not required to keep for legal, security, accounting, or medical-record purposes.

You can update some account details directly from your member account area when available.