1. Introduction

Supply Drops ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy describes how we collect, use, disclose, and protect your personal information in compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.

2. Personal Information We Collect

We collect the following types of personal information:

• Identity & Contact: Full name, email, phone number, date of birth, and address.
• Government ID: A copy of your government-issued ID for identity verification (patients only).
• Health Information: Medical document (prescription) details, health card number, and any medical notes disclosed during registration. This is sensitive personal information collected with your consent.
• Order & Payment: Order history, shipping address, and e-Transfer payment confirmations. We do not collect or store your banking credentials.
• Identity Code: A unique 7-icon identity sequence used as your anonymous display identifier within the community. This replaces your username in public-facing community features.
• Usage Data: Pages visited, features used, and device information for platform improvement and security.

3. How We Use Your Information

We use your personal information to:

• Verify your identity and eligibility to access medical cannabis;
• Process and fulfill your orders, including shipping and tracking;
• Communicate with you about your account, orders, and platform updates;
• Connect you with licensed suppliers and physicians for product access and prescriptions;
• Comply with Health Canada, CRA, and provincial regulatory requirements;
• Maintain platform security and prevent fraud or unauthorized access.

4. Health Information & Consent

Collection of your health information (medical documents, health card details) is voluntary and requires your explicit consent. We collect this information to verify your eligibility for medical cannabis access as required under the Cannabis Regulations. You may withdraw consent at any time by contacting us; however, withdrawal may limit your ability to access certain platform features.

5. Identity System Privacy

Supply Drops uses a 7-icon identity code system to protect your privacy in community features. Your email address and real name are never displayed to other community members — only your anonymous identity code is visible. Your identity code is locked for 365 days once set and can be renewed. Identity change requests are reviewed by our admin team.

6. How We Disclose Your Information

We do not sell your personal information. We may share your information with:

• Licensed Suppliers: Your name, shipping address, and order details necessary to fulfill your order. Suppliers are bound by these same privacy obligations.
• Physicians: Your prescription and medical information, as authorized by you, for telehealth consultations and prescription management.
• Payment Processors: Your email for e-Transfer confirmation (we do not share banking credentials).
• Regulatory Authorities: When required by Health Canada, CRA, or law enforcement under lawful authority.
• Service Providers: Third-party services that help us operate the platform (hosting, analytics), bound by confidentiality agreements.

7. Data Security

We use administrative, technical, and physical safeguards to protect your personal information, including encrypted data transmission, secure authentication, and role-based access controls. Access to your health information is restricted to authorized staff with a legitimate need. Despite these measures, no system is perfectly secure, and we cannot guarantee absolute security.

8. Data Retention

We retain your personal information for as long as your account is active or as needed to comply with legal and regulatory requirements. Health Canada and CRA regulations may require retention of certain records (e.g., sales, prescriptions) for specified periods. You may request deletion of your account; however, certain records may be retained as required by law.

9. Your Privacy Rights

Under PIPEDA, you have the right to:

• Access the personal information we hold about you;
• Request correction of inaccurate or incomplete information;
• Withdraw consent for the collection, use, or disclosure of your information (subject to legal exceptions);
• File a complaint with the Privacy Commissioner of Canada if you believe your privacy rights have been violated.

To exercise these rights, contact us through the platform.

10. Cookies & Tracking

We use cookies and similar technologies to maintain your session, remember preferences, and analyze platform usage. You can control cookies through your browser settings, but disabling them may limit platform functionality.

11. Children's Privacy

The platform is not intended for individuals under the legal age of cannabis access in their province. We do not knowingly collect personal information from minors. If you believe a minor has registered, please contact us so we can remove the account.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email. Continued use of the platform after changes constitutes acceptance of the updated policy.

13. Contact

For privacy questions or to exercise your rights, contact us through the platform or at the contact information provided.

Last updated: September 2026