Version: 11 November 2026
Platform data controller: Cannabox Co., Ltd. (Thailand)
PDPA Contact: [email protected]
1. Overview & Scope
This policy applies when you use Cannabox to:
- Find prices, shops, maps, reviews, or guides.
- Create an account or manage a profile.
- Submit a price, photo, receipt, review, or other community content.
- Manage a shop listing, partner account, job application, or enquiry.
- Request a consultation, prescription, order, or delivery where available.
Cannabox connects patients with partner clinics and supports applications, payments and documents. Cannabox does not provide medical consultations, diagnose or prescribe. The clinic and its doctors are responsible for medical care and clinical records. Cannabox remains responsible for the personal data it handles for its platform and referral activities.
2. Personal Data We Collect
Identity & Verification Data
Name, username, age or date of birth, and verification details when required for a service.
Identity documents or images when needed for patient or account verification.
Email, phone, address, and account preferences you provide.
Clinic referral and health information
When you request a clinic referral, Cannabox collects the identity and contact details, ID images, health answers and consent choices you submit, and shares the information needed for assessment with the partner clinic. Required fields are marked *. Without necessary information or consent, we may be unable to arrange the referral.
The licensed clinic and its authorised practitioners create and manage clinical assessments, diagnoses, and medical records.
The clinic may return prescription status or documents needed to complete the service and coordinate your chosen fulfilment path.
Device & Usage Data
Searches, approximate location from IP, and precise location only when you choose to share it.
Device, browser, usage, and security logs.
Cookies and language or display preferences.
Payment Data
Payment status and transaction references, plus points, referrals, and redemption activity where used. Card details are handled by payment providers.
Community and partner data
Shop, strain, price, receipt or menu proof, photo, review, profile, CV, job application, business listing, and enquiry details you submit. Public contributions may show your chosen display name; proof and private contact details are for review and support.
3. Purposes of Processing
We use your data to:
- Run search, maps, accounts, listings, and price comparisons.
- Review submitted prices and proof before publication.
- Display approved contributions and manage points or referrals.
- Support shop listings, partner accounts, applications, and enquiries.
- Arrange clinic referrals, support applications, collect payments, coordinate documents and pass information needed for assessment to the partner clinic.
- Meet the legal duties that apply to Cannabox; the clinic is responsible for its own clinical and professional record duties.
- Protect the platform and detect misuse.
- Send service notices about your account or request.
- Send optional marketing when you choose to receive it.
4. Lawful Bases Under PDPA
Consent: Where required for health data, optional cookies, marketing, and selected sharing with a dispensary.
Contract or requested steps: Accounts, contributions, partner tools, referral arrangements, payment handling and related transactions. This does not replace a required legal basis for health data.
Legal obligation: Records and disclosures required by applicable law.
Legitimate interests: Security, fraud prevention, moderation, and service improvement where your rights are respected.
5. Disclosure of Personal Data
We share personal data only as necessary with:
- Salus Clinic (Salus Bioceutical (Thailand) Co., Ltd.) and its authorised doctors receive relevant referral information for assessment and care. The clinic obtains clinical consent separately and controls its clinical records. Cannabox may store clinic records on the clinic’s instructions as its processor, alongside its own referral records.
- Cannabox receives consultation status and issued documents to coordinate your request. With your sharing choice, your selected or referring shop receives identity/contact details, prescription status and the issued PT33 through its authenticated portal. PT33 contains medical information. Uploaded ID images and raw health answers are not included in shop access. Chat notifications contain only a notice and portal link. Delivery providers receive the recipient/contact/address details needed to deliver documents.
- Payment, hosting, email and security providers receive information necessary for their services. We limit the information shared and review the applicable protection arrangements. Patient information is not used for advertising or analytics.
- Employers or partners when you submit an application or enquiry to them; authorities when required by law.
- Other users may see your chosen public name, reviews, and approved price details.
We do not sell personal data or use patient medical data for marketing or analytics. We do not publish medical records, identity documents, receipt proof, or private contact details with a price submission.
6. International Transfers
Hosting, payment and communications providers may process information outside Thailand. Before such a transfer, the applicable recipient, purpose and protection arrangements must be checked, including:
- Data protection terms with providers.
- Limited access.
- Security controls suited to the data.
- Other protections required by applicable law.
Contact us for the processing locations and safeguards applicable to your request. A hosting provider’s certification does not certify Cannabox’s application.
7. Retention of Personal Data
The clinic determines retention of its clinical records under applicable medical-record requirements. Where Cannabox holds those records for the clinic, it follows the clinic’s documented instructions; closing a referral does not automatically delete a clinical record.
For Cannabox’s own records, retention depends on purpose: ID photos/selfies are kept for necessary identity verification and related issues; intake answers and PT33 copies for arranging and completing the referral, document handoff and related support; payment records for applicable financial duties and disputes; consent and access records for demonstrating and reviewing authorised processing. We review necessity when the referral or issue is completed. Legal duties or a specific legal hold may require longer retention.
When a purpose and any retention duty end, records must be securely deleted or anonymised. A deletion request is reviewed across live records, linked files, recipients and backup expiry; access restrictions remain effective during that process. Ask support about the criteria and status for a particular record. These criteria do not mean records are kept indefinitely.
8. Your PDPA Rights
You may request:
- Access or correction
- Data portability
- Deletion (where legally permissible)
- Restriction or objection
- Withdrawal of consent (for consent-based processing)
Submit requests to: [email protected]
Tell support which request or record is involved and the right you want to exercise. Do not email ID images or medical documents unless we arrange a secure verification method. We verify identity proportionately, record the request, and coordinate clinic-held records with the clinic. We explain any legal exception and the effect of withdrawal on an unfinished referral. You may also complain to the Thai personal data protection authority.
9. Security Measures
We use measures appropriate to the data and service, including:
- Encrypted connections.
- Account access controls.
- Staff and shop permissions limited to authorised work; staff must set up an authenticator before opening patient records.
- Provider review.
- Logging and abuse monitoring.
Despite safeguards, no system is 100% secure—please keep account credentials confidential.
10. Cookies & Preferences
We use cookies and similar technologies to enhance your experience on our website. For detailed information about our use of cookies, including the types of cookies we use, their purposes, and how to manage them, please see our Cookie Policy.
In summary, we use:
- Essential cookies for login and session integrity
- Preference cookies for language and display settings.
- With your permission, Google Analytics measures public-page visits. It does not load on medical, payment or account pages. Advertising trackers and session replay remain off.
You may manage cookies through your browser or our cookie consent banner; some features may not function without essential cookies. For more information, please visit our Cookie Policy.
11. Minors
Cannabox services are intended for adults aged 20 or over. Care of a younger person must follow applicable law and clinician requirements.
12. Automated Processing
Automated checks may flag duplicate submissions, suspicious activity, or invalid price proof and affect whether a contribution appears publicly.
Medical decisions are made by licensed practitioners. Contact us to request review of a platform decision.
13. Third-Party Websites
External sites have independent privacy practices.
Cannabox is not responsible for their policies.
14. Changes to This Policy
We may update this Policy to reflect legal, operational, or service changes.
Material updates will be communicated via site/app notice or email where appropriate.
15. Contact
Data Protection/Privacy: [email protected]
General Support: [email protected]
Cannabox Co., Ltd., Bangkok, Thailand. Request the registered address for formal notices.