Privacy Policy | Cannabox

Effective Date: 26 September 2026

Platform data controller: Cannabox Co., Ltd. (Thailand)

1. Overview & Scope

This policy applies when you use Cannabox to:

Find prices, shops, maps, reviews, or guides.
Create an account or manage a profile.
Submit a price, photo, receipt, review, or other community content.
Manage a shop listing, partner account, job application, or enquiry.
Request a consultation, prescription, order, or delivery where available.

For a medical consultation, the licensed clinic is responsible for clinical assessments, prescriptions, and medical records. Cannabox and the clinic coordinate patient intake and scheduling.

2. Personal Data We Collect

Identity & Verification Data

Name, username, age or date of birth, and verification details when required for a service.

Identity documents or images when needed for patient or account verification.

Email, phone, address, and account preferences you provide.

Medical & Service Data

If you request care, Cannabox collects your intake answers, identity details, and consent choices and transfers the information needed for assessment to the licensed clinic.

The licensed clinic and its authorised practitioners create and manage clinical assessments, diagnoses, and medical records.

The clinic may return prescription status or documents needed to complete the service and coordinate your chosen fulfilment path.

Device & Usage Data

Searches, approximate location from IP, and precise location only when you choose to share it.

Device, browser, usage, and security logs.

Cookies and language or display preferences.

Payment Data

Payment status and transaction references, plus points, referrals, and redemption activity where used. Card details are handled by payment providers.

Community and partner data

Shop, strain, price, receipt or menu proof, photo, review, profile, CV, job application, business listing, and enquiry details you submit. Public contributions may show your chosen display name; proof and private contact details are for review and support.

3. Purposes of Processing

We use your data to:

Run search, maps, accounts, listings, and price comparisons.
Review submitted prices and proof before publication.
Display approved contributions and manage points or referrals.
Support shop listings, partner accounts, applications, and enquiries.
Collect intake information, arrange and support consultations, take service payments, and transfer necessary patient information to the licensed clinic.
Meet applicable legal and professional record duties.
Protect the platform and detect misuse.
Send service notices about your account or request.
Send optional marketing when you choose to receive it.

4. Lawful Bases Under PDPA

Consent: Where required for health data, optional cookies, marketing, and selected sharing with a dispensary.

Contract or requested steps: Accounts, contributions, partner services, consultations, and transactions.

Legal obligation: Records and disclosures required by applicable law.

Legitimate interests: Security, fraud prevention, moderation, and service improvement where your rights are respected.

5. Disclosure of Personal Data

We share personal data only as necessary with:

The licensed clinic and its authorised practitioners for medical assessment, treatment, prescriptions, and clinical record keeping.
Cannabox receives limited consultation outcomes and prescription information needed for patient support and requested fulfilment; dispensaries or delivery partners receive only what is needed for a service you request or a sharing choice you make.
Payment, hosting, communications, and security providers where needed for platform services and under appropriate data protection terms; analytics providers do not receive patient medical data.
Employers or partners when you submit an application or enquiry to them; authorities when required by law.
Other users may see your chosen public name, reviews, and approved price details.

We do not sell personal data or use patient medical data for marketing or analytics. We do not publish medical records, identity documents, receipt proof, or private contact details with a price submission.

6. International Transfers

Some providers may process data outside Thailand. We assess these transfers and use appropriate safeguards such as:

Data protection terms with providers.
Limited access.
Security controls suited to the data.
Other protections required by applicable law.

Details are available upon request.

7. Retention of Personal Data

The licensed clinic manages retention of clinical assessments, prescriptions, and medical records under applicable legal and professional requirements.

Cannabox keeps platform accounts, patient intake and scheduling information, payment references, contributions, partner records, and support records while needed for the service, legal duties, or disputes.

We remove or anonymise information when it is no longer needed, subject to retention duties. Ask us about a particular record.

8. Your PDPA Rights

You may request:

Access or correction
Data portability
Deletion (where legally permissible)
Restriction or objection
Withdrawal of consent (for consent-based processing)

Submit requests to: [email protected]

We may verify your identity and explain if a legal exception applies. You may also contact the Thai personal data protection authority.

9. Security Measures

We use measures appropriate to the data and service, including:

Encrypted connections.
Account access controls.
Limited staff and partner permissions.
Provider review.
Logging and abuse monitoring.

Despite safeguards, no system is 100% secure—please keep account credentials confidential.

10. Cookies & Preferences

We use cookies and similar technologies to enhance your experience on our website. For detailed information about our use of cookies, including the types of cookies we use, their purposes, and how to manage them, please see our Cookie Policy.

In summary, we use:

Essential cookies for login and session integrity
Preference cookies for language and display settings.
Analytics and measurement tools, subject to applicable choices.

You may manage cookies through your browser or our cookie consent banner; some features may not function without essential cookies. For more information, please visit our Cookie Policy.

11. Minors

Cannabox services are intended for adults aged 20 or over. Care of a younger person must follow applicable law and clinician requirements.

12. Automated Processing

Automated checks may flag duplicate submissions, suspicious activity, or invalid price proof and affect whether a contribution appears publicly.

Medical decisions are made by licensed practitioners. Contact us to request review of a platform decision.

13. Third-Party Websites

External sites have independent privacy practices.

Cannabox is not responsible for their policies.

14. Changes to This Policy

We may update this Policy to reflect legal, operational, or service changes.

Material updates will be communicated via site/app notice or email where appropriate.

15. Contact

Data Protection/Privacy: [email protected]

General Support: [email protected]

Cannabox Co., Ltd., Bangkok, Thailand. Request the registered address for formal notices.