Effective Date: August 1, 2021
Protecting the privacy of your health information is important. This Notice of Privacy Practices (“Notice”) describes how Curaleaf, Inc. (“Company” or “us” or “we” or “our”) collects, stores, and uses protected health information, and your rights as required by the State of Illinois, consistent with the requirements of the Health Insurance Portability and Accountability Act (“HIPAA”) Privacy Rule.
If you have any questions about this Notice or our privacy practices, please email us at HIPAA@curaleaf.com or contact Customer Support at (781) 451-0150, available Monday-Friday from 8:30 a.m. to 5 p.m. EST, excluding holidays. If you wish to receive a paper copy of this notice at any time contact HIPAA@curaleaf.com.
THIS NOTICE DESCRIBES HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.
PLEASE REVIEW IT CAREFULLY.
This Notice describes the privacy practices of Curaleaf, Inc., its affiliates, and its employees. Curaleaf, Inc. will share protected health information of patients as necessary to carry out treatment, payment, and health care operations as permitted by law. This Notice is specifically applicable to the following dispensary locations serving medical patients:
We respect the privacy of your health information. Each time you visit us or order online from one of our above listed locations, we may record your personal information, Protected Health Information as defined under HIPAA, and payment information (“Information”). These records may be kept on paper, electronically, or stored by other media. Curaleaf, Inc. is required by law to:
This Notice explains how we may use and share your Information to provide services, obtain payment for these services, and operate our business. This Section also describes several other circumstances in which we may use and share your Information. We do not need your authorization to use or disclose your Information in the following circumstances.
We will not use or share your Information for any reason other than those described in this Notice without a written authorization signed by you or a person legally authorized to act on your behalf (an “Authorized Agent”). An authorization is a document that you sign that directs us to use or disclose specific information for a specific purpose. Access to your Information: You may access and receive a copy of the Information that we retain on your behalf. For Information that we maintain electronically, you may request a copy in a reasonable electronic format, if readily producible. Requests for access must be made in writing and signed by you or an Authorized Agent. Amend Certain Records: You can ask us to correct or amend Information that you think is incorrect or incomplete. To make this request you should, contact us with the request as described below. We may say “no” to your request, but we will tell you why in writing within 60 days. Requests to Limit Disclosures: You may ask us not to use or share certain Information. We are not required to agree to your request and we may say “no” if it would affect your care. If you pay for our service or product out-of-pocket in full, you can ask us not to share that information for the purpose of payment or our operations. We will say “yes” unless a law requires us to share that Information.
Receive Confidential Communications: You may ask us to contact you in a special way. You will need to ask us in writing. We will try to grant reasonable requests. To submit a request to receive, verify, or correct your Information, email us at HIPAA@curaleaf.com or mail your request to Curaleaf, Inc., 301 Edgewater Place, Suite 405, Wakefield, MA 01880. Only you or an Authorized Agent may make a request related to your Information. Receive an Accounting of Disclosures: You may request an accounting of the people or organizations, outside of Curaleaf, Inc., with whom we have disclosed your Information. Section Five: Breach Notification
A breach is an impermissible use or disclosure under the Privacy Rule that compromises the security or privacy of your Information. Our Responsibilities: You have the right to be notified in the event of a breach of your Information. If the privacy or security of your Information has been compromised, we will notify you promptly with the following information:
Your Responsibilities: In the event of a breach, you are to contact the Illinois Department of Financial and Professional Responsibility at FPR@medicalcannabis@illinois.gov and the Illinois Department of Public Health at DPH.medicalcannabis@illinois.gov.
If you would like more information about your privacy rights, file a complaint, are concerned that we have violated your privacy rights, disagree with a decision that we made about access to your protected health information, or would like further information about Curaleaf, Inc.’s privacy policies, please email us at HIPAA@curaleaf.com or contact Customer Support at (781) 451-0150, available Monday-Friday from 8:30 a.m. to 5 p.m. EST, excluding holidays. We will not take action against you if you file a complaint with us or with a state agency.