Privacy Policy · homegrown

1. The floor

Four commitments sit under everything else on this page. They are enforced in code, not just in prose.

No individual patient data is ever exposed to a dispensary, cultivator, or any other licensee. Licensees see aggregates only.
Aggregates are suppressed below a cohort of 5. Any county, persona, product, or demand figure derived from fewer than 5 people is withheld entirely, not shown as zero, not rounded, not shown.
We never store your card number or an image of your medical card. Verification confirms eligibility and records a true/false result and a timestamp. The document itself is discarded once checked.
There is a real delete path. You can erase your account and personal data from within the product, not just by asking.

2. Who we are

homegrown is an independent Kentucky software platform serving certified patients, caregivers, and licensees under KRS Chapter 218B. homegrown is not a cannabis operator: we do not sell, price, hold, or move cannabis, and your payment card never touches our systems. The licensed dispensary is merchant of record on every transaction.

3. Information you provide

Account details: name, email, ZIP code, optional phone, and role.
Age confirmation: to activate a homegrown account you affirmatively confirm that you are 18 years of age or older, and we store that confirmation with its date and the policy version. homegrown is intended for adults age 18 or older. We do not need or store a date of birth to activate an account, and we do not verify your age against any document or outside record. Separate patient-interest and intake forms may ask for a date of birth for their own stated purpose, which is described on those forms.
Verification: we check your medical-card status and store only the outcome (verified yes/no), the issuing state, the expiration date, and the time of the check. We do not retain the card number or any uploaded image.
Profile and activity content: avatar, bio, follows, collections, journal entries, and feedback you submit.
Order requests you send to a licensed dispensary, and their response.
Homepage email updates: if you sign up for updates on our homepage, we store only your email address, your confirmation that you are 18 years of age or older, and the time of that confirmation. This signup is intended for adults 18 or older. We do not ask for a date of birth, medical-card status, registry number, or health information, and you can unsubscribe at any time.

4. Information collected automatically

Device and browser information for security and fraud prevention.
Page views and feature usage, used to improve the pilot.
Server logs (IP address, user agent, timestamp), retained up to 90 days.
Sign-in events, including an approximate city/region derived from your IP. We do not use device GPS and do not derive a street-level address. City-level data appears only in aggregate, owner-only analytics.
Kentucky county, derived from the ZIP code you provide, used only in cohort-suppressed aggregates.

5. What a dispensary sees

When you send an order request, the receiving dispensary sees what it needs to serve you and meet its own legal obligations: the requested items, your name, your verification status, and contact details for that order. It does not receive your browsing history, your education activity, your journal, your saved products, or any request you sent to a different store.

Everything else a licensee sees about patients is aggregate and suppressed below a cohort of 5. There is no screen, export, or API in this product that hands a licensee an individual patient's behavior.

6. How we use information

Operate your account and the verification workflow.
Route order requests to the dispensary you chose.
Provide education, follows, collections, and notifications.
Investigate abuse and protect the integrity of the directory.
Produce cohort-suppressed aggregate analytics for the pilot.

We do not sell personal information, and we do not use patient data to sell placement or ranking.

7. Sharing

We share data only with: (a) the licensed dispensary you chose, for the order you sent it; (b) infrastructure providers under contractual confidentiality (hosting, database, email delivery, mapping, geolocation); (c) law enforcement when required by valid legal process; and (d) successors in a merger or acquisition, subject to this Policy.

To translate an IP address into an approximate city, we send the IP address; and nothing else; to a third-party geolocation provider at sign-in.

8. Retention and deletion

Verification artifacts: discarded at the moment of the check; only the boolean and timestamp remain.
Server logs: up to 90 days.
Account and profile data: for as long as your account exists.
Deletion: use the delete control in your account settings, or write to privacy@homegrownky.com. We erase your account, profile, journal, collections, and request history within 30 days. Records a licensee must keep under Kentucky law live in that licensee's systems, not ours, and we cannot delete them for you.

9. Your choices

Edit your profile, unfollow accounts, and clear collections at any time.
Request a copy of your data at privacy@homegrownky.com.
Opt out of non-essential email through the unsubscribe link in those messages.

10. Children

homegrown is intended only for Kentucky residents 18 or older. We do not knowingly collect information from anyone under 18 and will delete it promptly if we learn we have.

11. Security

We use encrypted transport (TLS), encryption at rest, row-level security on user data, and restricted administrative access. No system is perfectly secure; use a strong, unique password.

12. Changes and contact

We may update this Policy. Material changes will be announced in-app or by email at least 7 days before they take effect. Questions: privacy@homegrownky.com.