Privacy Policy — Cannabox

1. Overview & Scope

This Privacy Policy explains how we collect, use, store, disclose, and protect personal data when you:

• Visit our website or app,
• Verify age or patient eligibility,
• Engage in telemedicine sessions,
• Receive prescriptions (e.g., PorThor 33),
• Place orders or receive deliveries.

2. Personal Data We Collect

3. Purposes of Processing

We use your data to:

• Verify age/patient eligibility and prevent fraud
• Book telemedicine consultations
• Issue, store, and verify medical documents
• Coordinate order fulfillment, delivery, and customer support
• Comply with MoPH/DTAM/FDA regulations and legal obligations
• Maintain audit logs required under telemedicine rules
• Secure platform operations and detect misuse
• Send service notifications (orders, prescriptions, appointments)
• Send optional marketing communication (only with consent)

4. Lawful Bases Under PDPA

5. Disclosure of Personal Data

We share personal data only as necessary with:

• Licensed practitioners and clinics (consultations, prescriptions)
• Licensed dispensaries and delivery partners (fulfillment, ID checks)
• Payment processors
• Government authorities (DTAM, MoPH, FDA, PHOs) as required
• IT and cybersecurity vendors operating under PDPA-compliant contracts

We do not sell personal data.

6. International Transfers

Where data is processed outside Thailand, we apply safeguards such as:

• Encryption
• Access control restrictions
• PDPA-compliant data processing agreements
• Approved transfer mechanisms

Details are available upon request.

7. Retention of Personal Data

8. Your PDPA Rights

You may request:

• Access or correction
• Data portability
• Deletion (where legally permissible)
• Restriction or objection
• Withdrawal of consent (for consent-based processing)

Submit requests to: [email protected]

We may verify your identity before acting on requests.

9. Security Measures

We implement administrative, technical, and organizational safeguards including:

• Encryption at rest and in transit
• Multi-factor authentication
• Role-based access control
• Secure architecture and vendor due diligence
• Logging and monitoring for suspicious activity

Despite safeguards, no system is 100% secure—please keep account credentials confidential.

10. Cookies & Preferences

We use cookies and similar technologies to enhance your experience on our website. For detailed information about our use of cookies, including the types of cookies we use, their purposes, and how to manage them, please see our Cookie Policy.

In summary, we use:

• Essential cookies for login and session integrity
• Preference cookies ("Remember me for 30 days")
• Analytics cookies (aggregated, non-sensitive)

You may manage cookies through your browser or our cookie consent banner; some features may not function without essential cookies. For more information, please visit our Cookie Policy.

11. Minors

Services are not intended for persons under 20 except where lawful medical treatment is arranged with appropriate consent.

12. Automated Processing

We use automated checks (e.g., fraud scoring, duplicate accounts, document validity).

A human may review decisions upon request.

13. Third-Party Websites

External sites have independent privacy practices.

Cannabox is not responsible for their policies.

14. Changes to This Policy

We may update this Policy to reflect legal, operational, or service changes.

Material updates will be communicated via site/app notice or email where appropriate.

15. Contact