Notice of Privacy Practices for Curaleaf Patients

Effective Date: August 1, 2021

Protecting the privacy of your health information is important. This Notice of Privacy Practices (“Notice”) describes how Curaleaf, Inc. (“Company” or “us” or “we” or “our”) collects, stores, and uses protected health information, and your rights as required by the State of Illinois, consistent with the requirements of the Health Insurance Portability and Accountability Act (“HIPAA”) Privacy Rule.

If you have any questions about this Notice or our privacy practices, please email us at HIPAA@curaleaf.com or contact Customer Support at (781) 451-0150, available Monday-Friday from 8:30 a.m. to 5 p.m. EST, excluding holidays. If you wish to receive a paper copy of this notice at any time contact HIPAA@curaleaf.com.

THIS NOTICE DESCRIBES HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.

PLEASE REVIEW IT CAREFULLY.

Section One: Our Organization

This Notice describes the privacy practices of Curaleaf, Inc., its affiliates, and its employees. Curaleaf, Inc. will share protected health information of patients as necessary to carry out treatment, payment, and health care operations as permitted by law. This Notice is specifically applicable to the following dispensary locations serving medical patients:

• Deerfield, Illinois- 151 South Pfingsten Road Suite V, Deerfield, IL 60015
• Justice, Illinois- 8340 South Roberts Road, Justice, IL 60458
• Mokena, Illinois- 9930 190th Street Unit H, Mokena, IL, 60448
• Morris, Illinois- 2400 6, Morris, IL, 60450
• Worth, Illinois- 11425 South Harlem Avenue, Worth, IL, 60482

Section Two: Our Responsibilities

We respect the privacy of your health information. Each time you visit us or order online from one of our above listed locations, we may record your personal information, Protected Health Information as defined under HIPAA, and payment information (“Information”). These records may be kept on paper, electronically, or stored by other media. Curaleaf, Inc. is required by law to:

• Maintain the privacy and security of your Information
• Notify you following a breach of your unsecured Information as required by law
• Provide this Notice to you and describe the ways we may use and share your Information
• Notify you of your rights regarding your Information
• Follow the terms of this Notice. We reserve the right to make changes to this Notice at any time and to apply new privacy or security practices to health information we maintain. Our website will contain the most current version of our Notice. You can request a paper copy of this Notice by emailing HIPAA@curaleaf.com or calling Customer Support at (781) 451-0150, Monday-Friday from 8:30 a.m. to 5 p.m. EST, excluding holidays

Section Three: Our Uses and Disclosures

This Notice explains how we may use and share your Information to provide services, obtain payment for these services, and operate our business. This Section also describes several other circumstances in which we may use and share your Information. We do not need your authorization to use or disclose your Information in the following circumstances.

• To provide Information related to treatment, payment, and health care operations. For example, we can use your Information and share it with other professionals who are treating you. We can also use and share your Information to run our business, improve your care, and contact you when necessary. In addition, Curaleaf can use and share your Information to bill and get payment for our services and dispensed therapies, unless you pay directly and tell us not to share your Information for payment purposes
• To provide Information provided to caregivers or relatives, with an opportunity to object to the disclosure
• To provide limited Information provided for the purposes of research, public health, product recalls, and other safety issues
• As permitted or required by law, including disclosures to courts and other government agencies

Section Four: Your Rights

We will not use or share your Information for any reason other than those described in this Notice without a written authorization signed by you or a person legally authorized to act on your behalf (an “Authorized Agent”). An authorization is a document that you sign that directs us to use or disclose specific information for a specific purpose. Access to your Information: You may access and receive a copy of the Information that we retain on your behalf. For Information that we maintain electronically, you may request a copy in a reasonable electronic format, if readily producible. Requests for access must be made in writing and signed by you or an Authorized Agent. Amend Certain Records: You can ask us to correct or amend Information that you think is incorrect or incomplete. To make this request you should, contact us with the request as described below. We may say “no” to your request, but we will tell you why in writing within 60 days. Requests to Limit Disclosures: You may ask us not to use or share certain Information. We are not required to agree to your request and we may say “no” if it would affect your care. If you pay for our service or product out-of-pocket in full, you can ask us not to share that information for the purpose of payment or our operations. We will say “yes” unless a law requires us to share that Information.

Receive Confidential Communications: You may ask us to contact you in a special way. You will need to ask us in writing. We will try to grant reasonable requests. To submit a request to receive, verify, or correct your Information, email us at HIPAA@curaleaf.com or mail your request to Curaleaf, Inc., 301 Edgewater Place, Suite 405, Wakefield, MA 01880. Only you or an Authorized Agent may make a request related to your Information. Receive an Accounting of Disclosures: You may request an accounting of the people or organizations, outside of Curaleaf, Inc., with whom we have disclosed your Information. Section Five: Breach Notification

A breach is an impermissible use or disclosure under the Privacy Rule that compromises the security or privacy of your Information. Our Responsibilities: You have the right to be notified in the event of a breach of your Information. If the privacy or security of your Information has been compromised, we will notify you promptly with the following information:

• A brief description of what happened
• A description of the information involved in the breach
• Recommended steps you can take to protect yourself from harm
• What steps were taken to investigate the breach, mitigate harm, and prevent future breaches
• Contact procedures so you can obtain further information.

Your Responsibilities: In the event of a breach, you are to contact the Illinois Department of Financial and Professional Responsibility at FPR@medicalcannabis@illinois.gov and the Illinois Department of Public Health at DPH.medicalcannabis@illinois.gov.

Further Information and Complaints

If you would like more information about your privacy rights, file a complaint, are concerned that we have violated your privacy rights, disagree with a decision that we made about access to your protected health information, or would like further information about Curaleaf, Inc.’s privacy policies, please email us at or contact Customer Support at (781) 451-0150, available Monday-Friday from 8:30 a.m. to 5 p.m. EST, excluding holidays. We will not take action against you if you file a complaint with us or with a state agency.