THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

I.  Our Privacy Obligations

This Notice of Privacy Practices (“Notice”) describes the privacy practices of dispensaries owned or operated by Green Thumb Industries Inc. and its affiliates (collectively, “GTI/RISE,” “we,” or “us”) with respect to medical information. GTI/RISE maintains medical information for the reasons described in this Notice. When medical information is used or disclosed, we are required by law to abide by the terms of this Notice (or other notice in effect at the time of the use or disclosure). Our current Notice is AVAILABLE at www.gtigrows.com. If you have any questions about this Notice please contact the manager on duty, or you may contact GTI/RISE’s Headquarters using the information in Part VI, below.

Please also keep in mind that, depending on how you interact with us, information we collect about you may be subject to other GTI/RISE privacy policies and notices, including the GTI Privacy Policy, also available at www.gtigrows.com. In the event of a conflict between this Notice and any other applicable privacy policy or notice, this Notice will control with respect to your medical information.

Note that some states have laws that offer greater protection for medical information than is offered by federal law, and some types of sensitive medical information, such as HIV information, genetic information, alcohol and/or substance abuse records and mental health records, may be subject to additional confidentiality protections under state or federal law. If you would like additional information about state law protections in your state, or additional use or disclosure restrictions that may apply to sensitive medical information, you may contact GTI/RISE’s Headquarters using the information in Part VI, below.

II.  Permissible Uses and Disclosures Without Your Written Authorization

In most situations (as described in Section III below), we must obtain your written authorization in order to use and/or disclose your medical information. Certain uses and disclosures permitted or required by law or under emergency circumstances may be made without your acknowledgement or authorization. We do not need any type of authorization from you for the following uses and disclosures:

  • Uses and Disclosures for Treatment Purposes. We may use your medical information for treatment purposes, such as contacting you to discuss dosing information. We may also disclose medical information to your other health care providers when such medical information is required for them to treat you.
  • Payment. We may need to use or disclose information in your medical record to obtain payment for our services—for example, we may use your medical information to bill you for products if you do not pay in cash.
  • Health Care Operations. We may use or disclose your medical information for our health care operations or those of your other health care providers. Health care operations include activities such as quality assessment and improvement activities, reviewing the quality and competence of health care professionals, compliance activities, transferring or receiving medical information in connection with the purchase or sale of a dispensary, and creating de-identified data (which no longer identifies individual patients), which may be used or disclosed for analytics, business planning, or other purposes.
  • Disclosure to Relatives, Close Friends, and Caregivers. We may use or disclose medical information to a family member, other relative, or your designated caregivers as identified by you when you are present for, or otherwise give permission prior to, the disclosure. If you object to such uses or disclosures, please notify the store manager on duty.
  • Health Oversight Activities. We may disclose medical information to oversight agencies for certain activities including audits, investigations, inspections or licensure.
  • Judicial and Administrative Proceedings. We may disclose medical information in the course of a judicial or administrative proceeding in response to a legal order. subpoena or other lawful process.
  • Law Enforcement Officials. We may disclose medical information to the police or other law enforcement officials, as required or permitted by law or in compliance with a court order, a grand jury or administrative subpoena.
  • Health or Safety. We may use or disclose medical information to prevent or lessen a serious and imminent threat to a person or the public’s health or safety.
  • As Required by Law. We may use and disclose medical information when required to do so by any other law not already referred to in the preceding categories.

III.  Use and Disclosures Requiring Your Written Authorization

For any purpose other than those described in Section II, we may only use or disclose medical information when you provide us your authorization. If you authorize us to use or disclose information about you, you may revoke that authorization by delivering a written statement to the manager on duty at any time, or you may send your statement to GTI/RISE’s Headquarters using the information in Part VI, below. You understand that we are unable to “take back” any disclosures that we have already made with your authorization and that we are required to keep any records of the services that we provided to you.

IV.  Your Individual Rights

  • Right to Request Additional Restrictions. You may request restrictions on our use and disclosure of medical information to individuals (such as a family member, other relative, close personal friend or any other person identified by you) involved with your care or with payment related to your care. All requests for such restrictions must be made in writing and delivered to the manager on duty or addressed to GTI/RISE’s Headquarters using the information in Part VI, below. While all requests for additional restrictions will be considered carefully, we are not required to agree to a requested restriction.
  • Right to Receive Confidential Communications. You may request to receive written medical information by other means of communication or at alternative locations and can expect to be accommodated for any reasonable request. For more information, you may contact the manager on duty, or you may contact GTI/RISE’s Headquarters using the information in Part VI, below.
  • Right to Inspect Your Medical Information. You may request access to your medical information, including your purchase history. Some requests may need to be delivered in writing. For more information, you may contact the manager on duty, or you may contact GTI/RISE’s Headquarters using the information in Part VI, below.
  • Right to Revoke Your Authorization. As described above, you may revoke your authorization, except to the extent that we have taken action in reliance upon it.
  • Right to Amend Your Records. You have the right to request that we amend medical information maintained in your patient profile. If you desire to amend your records, please submit a request in writing to the manager on duty, or you may contact GTI/RISE’s Headquarters using the information in Part VI, below. All requests for amendments must be in writing. We will comply with your request unless we believe that the information that would be amended is accurate and complete or other special circumstances apply.
  • Right to Receive Notification of Breach. You have the right to receive notification if your unsecured medical information is breached.
  • Right to Receive Paper Copy of this Notice. You may obtain a paper copy of this Notice, even if you agreed to receive such notice electronically. To request a paper copy of this Notice, you may contact the manager on duty, or you may contact GTI/RISE’s Headquarters using the information in Part VI, below.

V.  Effective Date and Duration of This Notice

Effective Date. This Notice is effective on April 1, 2022 and applies to all medical information we maintain, including information created or received prior to the effective date.

Right to Change Terms of this Notice. We may change the terms of this Notice at any time. If we change this Notice, we may make the new notice terms effective for all medical information that we maintain, including any information created or received prior to issuing the new Notice. If we change this Notice, we will post the revised notice on our website and in the dispensaries. You may also obtain any revised notice by contacting the manager at the Dispensary or GTI/RISE’s Headquarters using the information in Part VI, below.

VI.  Questions or Complaints

If you desire further information about your privacy rights, are concerned that we have violated your privacy rights or disagree with a decision that we made about access to medical information, you may contact the manager on duty, or you may contact GTI/RISE’s Headquarters at:

GTI/RISE

325 W. Huron St.

Chicago, IL 60654,

1-888-423-0783.

Illinois residents who believe a violation of their privacy rights has occurred may contact the Illinois Department of Financial and Professional Regulation at FPR@[email protected] and the Illinois Department of Public Health at [email protected].