Medical Cannabis Privacy Notice

Your Information. Your Rights. Our Responsibilities.

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.  PLEASE REVIEW IT CAREFULLY.

Effective Date: July 11, 2024

This Medical Cannabis Privacy Notice (“Notice”) applies to the medical dispensaries of Cresco U.S. Corp. and its subsidiaries, and Cresco Labs Inc. and its subsidiaries (we refer to all of these entities as “Sunnyside”). Sunnyside collects and creates information about medical cannabis customers, which we refer to here as medical information.  Medical information is information that is necessary to dispense cannabis per healthcare providers’ directions, to report what is dispensed as required by law, to fulfill medical cannabis customers’ rights, for Sunnyside’s operations that support our services (which we refer to as our medical cannabis operations) as otherwise permitted by law and for these purposes more fully described below. You may also share your personal information with us to receive marketing information and we will treat that as your medical information.

We will abide by this Notice for as long as it remains in effect. We reserve the right to change the terms of this Notice as necessary and to make a new Notice effective for all medical information collected by Sunnyside. We are also required to inform you that there may be a provision of state laws that relate to the privacy of your medical information that may be stricter (or more protective of you) than a standard or requirement under medical information privacy law, and we will comply with the stricter (or more protective) standard. A copy of any revised Notice or information pertaining to a specific State law may be obtained by mailing a request to the Privacy Officer, Cresco Labs, LLC, 600 W Fulton Street, Suite 800, Chicago, IL 60661.

 

Your Rights

You have the right to:

• Request restrictions on certain uses and disclosures of your medical information, but we may not be able to agree to the requested restriction.

• Receive confidential communications of your medical information

• Review and/or get a copy of your medical information in our record about your medical cannabis orders and purchases.

• Change your medical information in our record about your medical cannabis purchases and related records

• Request confidential communication of your medical information

• Get a brief description of the medical information disclose and the purposes of the disclosures

• Get a hard copy of this Notice

 

 Your Choices

We will assume we may share your medical information with your family and friends and your caregivers when they accompany you or represent that they are your personal representative.

Our Uses and Disclosures

We may use and share your medical information as we:

    • Process your healthcare provider direction and dispense the medical cannabis, including interacting with your care giver, and required reporting of the dispensing

    • Run our organization, including quality assessment and improvement activities, reviewing the competence or qualifications of our workforce, conducting or arranging for quality review, legal services, and auditing functions, business planning and development, and business management and general administrative activities

    • Get paid for your medical cannabis sale

    • Help with public health and safety issues, including emergencies and regulators’ oversight of us

    • Comply with the laws including reporting laws

    • Respond to organ and tissue donation requests

    • Address workers’ compensation, law enforcement, and other government requests or orders

    • Respond to lawsuits and legal actions


Our Responsibilities

    • We are required by law to maintain the privacy and security of your medical information. This may include state laws that are more stringent because they protect sensitive types of information such as mental health laws.

    • We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information as required by law, and will also let state and federal regulators know as required by law.

    • We will follow the duties and privacy practices described in this Notice and give you a hard copy of it upon your request.

    • We will not use or share your medical information other than as described in this Notice unless you tell us we can in writing. For example, if we want to use your medical information to conduct research or to share your story, we will first ask you for your authorization to do so.  If you tell us we can, you may change your mind at any time. Let us know in writing if you change your mind.


Changes to the Terms of this Notice.

We can change the terms of this Notice, and the changes will apply to all information we have about you. The new notice will be available upon request, in the dispensary, and on our website.

 

For Further Information.

To exercise your rights, for questions, or further assistance regarding this Notice, you may contact the HIPAA Privacy Officer by email at privacyoffice@crescolabs.com by telephone at (312) 929-0993, or by writing to the HIPAA Privacy Officer at HIPAA Privacy Officer, Cresco Labs, LLC, 600 W Fulton Street, Suite 800, Chicago, IL 60661.

 

Regulatory Contact Information.

For Illinois purchasers, you can contact the Illinois Department of Financial and Professional Regulation at FPR@medicalcannabis@illinois.gov and the Illinois Department of Public Health at DPH.medicalcannabis@illinois.gov.

If you have any questions or complaints regarding HIPAA’s application to us, you can contact the Secretary of Health and Human Services by submitting your request in writing by mail, fax, e-mail using the contact information below, or via the OCR Complaint Portal.  U.S. Department of Health and Human Services Office for Civil Rights Centralized Case Management Operations 200 Independence Ave., S.W.Suite 515F, HHH Building Washington, D.C. 20201 Customer Response Center: (800) 368-1019 Fax: (202) 619-3818 TDD: (800) 537-7697 Email: ocrmail@hhs.gov.