This notice describes Green Thumb Industries’ privacy practices and how medical information about you is protected and how it may be used and disclosed, as well as how you may access this information. Please review the following carefully.

Green Thumb Industries chooses to maintain the privacy of medical health information. As a result, all patients are provided with this Notice of our duties and privacy practices with respect to medical health information. When patient medical health information is used or disclosed, we are required to abide by the terms of this Notice (or other notice in effect at the time of the use or disclosure). A patient-specific log of medical cannabis products dispensed to the patient, including brand, administration form, dosage, dates dispensed, and any return of product, will be provided to the patient’s designated caregiver, if applicable, or the patient’s healthcare practitioner upon request.

Nothing in these privacy procedures should be construed to voluntarily or involuntarily waive Green Thumb Industries’ requirement to protect your medical health information.

In certain situations (described in Section IV below),we must obtain your written authorization in order to use and/or disclose your medical health information. We may also disclose medical health information to your other health care providers when such medical health information is required for them to treat you or conduct certain health care operations, such as quality assessment and improvement activities, reviewing the quality and competence of health care professionals, or compliance. However, we do not need any type of authorization from you for the following uses and disclosures:

• Disclosure to Relatives, Close Friends, and Other Caregivers. We may use or disclose medical health information to a family member, other relative, or your designated caregivers as identified by you when you are present for, or otherwise give permission prior to, the disclosure. If you object to such uses or disclosures, please notify the manager on duty.

• Department of Health. We may disclose medical health information as required by Department of Health regulations.

• Judicial and Administrative Proceedings. We may disclose medical health information in the course of a judicial or administrative proceeding in response to a legal order or other lawful process.

• Law Enforcement Officials. We may disclose medical health information to the police or other law enforcement officials, as required or permitted by law or in compliance with a court order, a grand jury, or administrative subpoena.

• Health or Safety. We may use or disclose medical health information to prevent or lessen a serious and imminent threat to a person or the public’s health or safety.

• As Required by Law. We may use and disclose medical health information when required to do so by any other law not already referred to in the preceding categories.

Use or Disclosure with Your Authorization. For any purpose other than those described in Section II, we may only use or disclose medical health information when you provide us your authorization.

• Further Information or Complaints. If you desire further information about your privacy rights, are concerned that we have violated your privacy rights, or disagree with a decision that made about access to medical health information, you may contact the manager on duty.

• Right to Request Additional Restrictions. You may request restrictions on our use and disclosure of medical health information to individuals(such as a family member, other relative, close personal friend, or any other person identified by you involved with your care or with payment related to your care. All requests for such restrictions must be made in writing. While all requests for additional restrictions will be considered carefully, we are not required to agree to a requested restriction.

• Right to Receive Confidential Communications. You may request to receive written medical health information by other means of communication or at alternative locations and can expect to be accommodated for any reasonable request.

• Right to Inspect Your Purchase History. You may request access to your purchase history.

• Right to Revoke Your Authorization. You may revoke your authorization or your special authorization, except to the extent that we have taken action in reliance upon it, by delivering a written revocation statement to the manager on duty.

• Right to Amend Your Records. You have the right to request that we amend medical health information maintained in your patient profile. If you desire to amend your records, please submit a request in writing to the manager on duty. All requests for amendments must be in writing. We will comply with your request unless we believe that the information that would be a mended is accurate and complete or other special circumstances apply.

• Right to Receive Paper Copy of this Notice. You may obtain a paper copy of this Notice, even if you agreed to receive such notice electronically.

Effective Date. This Notice is effective on December 1, 2018.

Right to Change Terms of this Notice. We may change the terms of this Notice at anytime. If we change this Notice, we may make the new notice terms effective for all medical health information that we maintain, including any information created or received prior to issuing the new Notice. If we change this Notice, we will post the revised notice in waiting are as of the dispensaries. You may also obtain any revised notice by contacting the manager at the Dispensary.

By signing below, I hereby acknowledge receipt of the Green Thumb Industries’ Notice of Privacy Practices.