Privacy Notice

1. About GMCS

Georgia Medical Cannabis Society is a patient-led 501(c)(3) nonprofit educational organization.

GMCS provides medical cannabis education, patient-navigation support, provider education, research awareness, community programming, nonpartisan public-policy education, advocacy training, and access to informational resources.

GMCS is not a dispensary, cannabis retailer, healthcare provider, law firm, government agency, political party, candidate campaign, or medical-record service. GMCS does not sell, manufacture, prescribe, recommend, or distribute cannabis products.

2. Personal Information

"Personal information" means information that identifies, relates to, describes, or could reasonably be linked with an individual.

Personal information does not include information that has been irreversibly anonymized so that it can no longer reasonably identify an individual.

Pseudonymized information may remain personal information when it can be linked back to an individual through additional information.

3. Information We Collect

We collect information based on how you interact with GMCS.

A. Free GMCS Community Account Information

When an adult creates a Free GMCS Community Account, we may collect: First and last name, Preferred name, Email address, Password credentials processed through our authentication system (passwords are intended to be stored only in a protected, non-readable form, and GMCS personnel should not have access to a user's readable password), Optional phone number, City, Georgia county or "Outside Georgia", State, ZIP code, Optional organization or affiliation, Primary audience category, Preferred contact method, Selected interests, Communication preferences, Account registration date, Email-verification status, Account status, Last login date, Last activity date, Registration source, Referral or campaign source when available, Account role and access level, Adult account-eligibility confirmation, Privacy Notice and Terms of Use versions accepted.

Free GMCS Community Accounts are intended for adults age 18 or older. GMCS generally uses an adult-eligibility attestation instead of collecting an exact date of birth. Creating a Free GMCS Community Account does not make a person a voting member, board member, executive officer, owner, or legal corporate member of GMCS.

B. Email-Only Resource Requests

Visitors may request certain educational or advocacy resources by email without creating a password-based account. For an email-only resource request, we may collect: First name, Email address, Requested resource, Optional last name, Optional city/county/state/ZIP, Optional audience category, Optional organization, Optional educational or advocacy interests, Adult eligibility confirmation, Privacy Notice acceptance, Separate communication choices, Date and source of the request.

Requesting a resource does not automatically subscribe you to optional marketing or fundraising messages. The email used to deliver the requested resource is considered a transactional communication. Newsletters, legislative alerts, event announcements, fundraising messages, podcast updates, or other optional communications require separate affirmative consent.

C. Communication Preferences and Consent Records

We may collect and maintain records showing whether you requested: General GMCS newsletters, Patient education, Caregiver resources, Legislative and advocacy alerts, Event and workshop announcements, Masterclass information, Compassion in Practice information, Research opportunities, Volunteer opportunities, GMCS-TV and podcast announcements, Fundraising and mission-support updates, Partnership and community information, Text messages when separately authorized.

Consent records may include: Consent category, Whether consent was granted or withdrawn, Date and time, Account ID or anonymous consent identifier, Source form or page, Privacy Notice version, Terms of Use version, Cookie-consent version, Communication category, Withdrawal date, Latest active preference, Prior preference history.

We may preserve consent history where reasonably necessary to document your choices, honor withdrawals, and meet compliance obligations.

D. Events, Workshops, and Programs

When you register for an event, workshop, Masterclass, community forum, research-information session, webinar, or other GMCS program, we may collect: Name, Email address, Optional phone number, Organization or professional role, County or service area, Event or program selected, Registration date, Attendance status, Participation status, Virtual/in-person/hybrid participation, Accessibility request voluntarily submitted, Dietary or logistical information when relevant, Program completion status, Materials or recordings made available, Certificate status when applicable and verified, Communications associated with the registration.

If an event is jointly operated with another organization, the registration page will identify that organization and explain whether registration information will be shared. GMCS will not automatically provide event-registration information to another organization for that organization's independent marketing unless the registrant is informed and any required permission is obtained.

E. Advocacy and Legislative Interests

When you use the GMCS Advocacy Hub, Bill Tracker, resource library, Pressure Play Workshop, Pressure Squad, or related tools, we may collect: Resources viewed/requested/downloaded/emailed/saved, Advocacy topics selected, Legislative-alert preferences, Workshop interest or registration, Volunteer interest, Public-comment or training requests, General region or county, Resource referral source, Date of engagement, Account conversion status.

GMCS does not require visitors to disclose political-party affiliation or candidate preference to access general advocacy education.

F. Helpful Organizations and Partnership Information

When someone recommends an organization, requests a correction to a directory listing, or expresses interest in partnering with GMCS, we may collect: Submitter's name, Submitter's email, Optional phone number, Organization name, Organization website, Role or relationship to the organization, Service category, Geographic area, Population served, Proposed collaboration, Sponsorship or program interest, Information included in the message, Consent to be contacted.

Organization submissions are reviewed before publication. Submission does not guarantee inclusion, endorsement, sponsorship, or partnership.

G. Volunteer, Scholarship, and Support Requests

When you volunteer, request scholarship or sponsored access, request account assistance, or contact GMCS for support, we may collect: Name, Email address, Optional phone number, Account identifier, Request category, Request reference number, Program or event involved, Information included in your request, Date submitted, Request status, Communications regarding the request, Resolution date, Authorized internal administrative notes.

Please do not include diagnoses, treatment information, medical cannabis card information, Social Security numbers, government identification, or other unnecessary sensitive information in general support forms.

H. Donations, Payments, and Merchandise

When you donate, register for a paid event, purchase merchandise, or pay a program fee, payment information is generally processed by an outside payment provider. GMCS does not intend to directly store complete payment-card numbers, card security codes, or online banking credentials.

GMCS may receive: Donor or purchaser name, Contact information, Transaction identifier, Donation or purchase amount, Transaction date, Payment status, Membership or program associated with the payment, Information required to issue a receipt, Shipping information for merchandise, Refund or cancellation status.

GMCS does not publicly disclose donor names, contact information, or donation amounts without permission, except when required by law. Charitable donations, paid supporter memberships, event registrations, sponsorships, and merchandise purchases are separate transactions and may receive different tax treatment.

I. Communications

When you contact GMCS by email, form, website chat, telephone, or another approved method, we may collect: Your name, Email address, Optional phone number, Organization, Subject of your request, Message contents, Attachments you choose to provide, Date and time, Follow-up communications, Support or inquiry status.

J. Information Collected Automatically

When you use the website, we may automatically receive limited technical information, including: IP address, Browser type, Operating system, Device type, Referring page, Pages requested, Date and time of access, Security and authentication events, Session duration, Error and performance data, Cookie and consent settings, General geographic region derived from network information.

We use this information for website operation, security, troubleshooting, fraud prevention, accessibility, and analytics when the required consent has been provided. We seek to avoid collecting technical information that is not reasonably necessary for these purposes.

4. Sensitive and Medical Information

GMCS is an educational and patient-navigation organization. General website forms and Community Accounts are not medical-record portals.

Please do not submit the following through general website forms: Diagnoses, Medical records, Treatment records, Prescription information, Medical cannabis card numbers, Social Security numbers, Government identification, Insurance information, Detailed health histories, Complete payment-card numbers.

GMCS does not provide medical or legal advice through general website communications. Information submitted through a general contact, account, advocacy, volunteer, event, or resource form should not be treated as a confidential communication with a physician, attorney, pharmacist, or other licensed professional.

If GMCS later operates a service specifically designed to collect sensitive health information, that service will require a separate legal, security, consent, vendor, retention, and breach-notification review before collection begins.

5. How We Use Information

We may use information to: Create and maintain your account, Verify your email address, Authenticate sign-ins, Provide password-reset and security notices, Personalize your account dashboard, Save selected resources and preferences, Deliver requested educational materials, Register you for events and programs, Administer attendance and participation, Provide advocacy education and alerts, Respond to questions and support requests, Process volunteer and partnership inquiries, Review scholarship and sponsored-access requests, Send communications you requested, Manage donations/receipts/registrations/purchases, Maintain communication and consent records, Protect accounts/the website/GMCS systems, Detect fraud/misuse/unauthorized access, Troubleshoot technical issues, Improve accessibility and website performance, Understand aggregate engagement with GMCS resources, Maintain nonprofit/financial/tax/administrative records, Enforce our Terms of Use, Comply with legal obligations, Establish/exercise/defend legal rights, Protect the rights/safety/property of GMCS/users/others, Carry out another purpose disclosed when information is collected.

We do not use optional marketing consent as a condition for access to essential public patient, safety, legal-navigation, or civic information.

6. Cookies and Similar Technologies

GMCS uses cookies, local storage, and similar technologies to operate the website, remember choices, protect accounts, and measure website activity when permission has been provided.

A. Strictly Necessary

These technologies are required for: Authentication, Account security, Session management, Form protection, Accessibility functions, Consent storage, Website operation. Strictly Necessary technologies cannot be disabled through the GMCS preference center because the website may not function properly without them.

B. Functional

Functional technologies may support: Remembered display choices, Optional embedded content, Enhanced website tools, Nonessential personalization. Functional technologies remain disabled unless selected when consent is required.

C. Analytics

Analytics technologies help GMCS understand general website traffic, performance, page usage, and technical issues. The website may use GoDaddy platform analytics, including C2 or SCC services, when the visitor enables the Analytics category. Analytics technologies remain disabled until the required consent is provided.

D. Marketing

Marketing technologies may be used for advertising attribution, audience building, retargeting, or similar activities. GMCS does not currently activate marketing technologies unless they are specifically disclosed and the visitor provides the required consent.

You may: Accept all optional technologies, Reject nonessential technologies, Select individual categories, Change your choices, Withdraw consent.

Use the Cookie Preferences link in the website footer to review or change your choices.

Where supported, GMCS may recognize Global Privacy Control or similar browser privacy signals. A recognized opt-out signal will not be used to activate Marketing technologies.

Changing preferences stops future application-controlled tracking. Information previously transmitted to a third party may remain subject to that third party's retention and privacy practices.

7. Transactional and Optional Emails

GMCS distinguishes essential account communications from optional communications.

Essential transactional messages may include: Email verification, Welcome messages, Password reset, Password-change notices, Account-security alerts, Email-address change notices, Event or program confirmations, Support-request acknowledgments, Account deactivation or deletion notices, Donation or transaction receipts.

You generally cannot opt out of essential messages required to operate or secure an account or complete a requested transaction.

Optional messages may include: Newsletters, Patient education, Legislative alerts, Event announcements, Program announcements, Research opportunities, Volunteer opportunities, Podcast and media updates, Fundraising messages, Partner information.

You may unsubscribe from optional communications or adjust individual preferences through your GMCS account, an email preference link, or by contacting us. Unsubscribing from optional communications will not prevent essential account or transaction messages.

8. Text Message Communications

This section applies only if GMCS activates text-message communications. GMCS will obtain separate consent before sending optional automated or marketing text messages when required. Providing a mobile number or consenting to text messages will not be a condition of creating a free account, making a donation, purchasing merchandise, receiving essential public information, or obtaining a requested resource. Message frequency may vary. Message and data rates may apply. Recipients may withdraw consent through any reasonable method, including replying STOP when that function is supported, using an available communication preference control, or contacting [email protected].

9. Service Providers

GMCS may use service providers to operate portions of the website and its programs. Depending on the feature you use, providers may include: GoDaddy and Airo for website hosting/development/infrastructure/platform services, Authentication and database infrastructure providers, Resend for transactional email delivery, MailerLite for optional newsletters and marketing communications, Givebutter or another approved provider for donations and fundraising, Shopify or another approved provider for merchandise and order processing, Event/calendar/video/form/security/accessibility/technical-support services.

We disclose only the information reasonably necessary for a provider to perform services on our behalf. Service providers may maintain their own privacy notices that apply when you interact directly with their services. The providers and features used by GMCS may change. We will update this Notice when a material change affects how personal information is handled.

10. When We Disclose Information

We may disclose personal information in the following circumstances.

A. Service Providers

We may disclose information to providers performing hosting, authentication, transactional email, optional email marketing, payment processing, fundraising, merchandise fulfillment, event administration, security, analytics, or technical-support services.

B. Events and Programs

When an event or program is jointly administered, the registration form will identify the participating organization and explain whether information will be shared.

C. Legal Requirements

We may access, preserve, or disclose information when reasonably necessary to: Comply with applicable law, Respond to a lawful subpoena/court order/governmental request, Protect the rights/property/safety of GMCS/users/others, Investigate fraud/abuse/threats/security incidents, Enforce agreements or policies, Establish/exercise/defend legal claims.

D. Organizational Restructuring

If GMCS undergoes an organizational restructuring, combination, dissolution, or transfer of programs or assets, information may be transferred as reasonably necessary, subject to applicable law and protections consistent with this Notice.

E. With Your Direction or Permission

We may disclose information when you direct us to do so or provide permission.

11. No Sale of Personal Information

GMCS does not sell personal information.

GMCS does not currently share personal information for cross-context behavioral advertising. GMCS does not provide member, patient, donor, volunteer, resource-request, or contact lists to advertisers for their independent marketing. If these practices change, we will update this Notice and provide any choices required by applicable law before activating the new practice.

12. Research Opportunities

GMCS may provide information about research, surveys, clinical education, or participation opportunities. Requesting research information does not enroll you in a research study. Participation in a study may require: Separate eligibility review, Separate informed consent, Separate privacy information, Direct interaction with the organization conducting the study. GMCS will identify the responsible research organization when that information is available.

13. Public Content and Patient Stories

GMCS does not automatically publish information submitted through general forms, account pages, support requests, partnership inquiries, or resource requests. A patient story, testimonial, photograph, video, quotation, biography, or other personal content will not be published by GMCS without appropriate permission.

Any public-submission feature will explain before submission: What will be public, How the person will be identified, Whether the submission may be edited, How permission may be withdrawn when applicable, Whether removal from third-party sharing platforms can be guaranteed.

14. Children and Account Eligibility

GMCS public educational resources may be viewed by people of different ages, including patients, caregivers, parents, guardians, and families.

Free GMCS Community Accounts and email-only resource requests are intended for adults age 18 or older. Individuals under age 18 should not create an account or submit personal information. They should ask a parent, guardian, caregiver, or other authorized adult for assistance.

We do not knowingly collect personal information online from children under age 13. If we learn that a child under age 13 submitted personal information, we will take reasonable steps to delete it unless retention is required by law or necessary to protect safety.

A parent or guardian who believes a child provided personal information may contact [email protected].

15. No Professional or Confidential Relationship

Using the GMCS website, creating an account, submitting a form, receiving educational material, using a provider or organization directory, or communicating with GMCS does not create: A physician-patient relationship, An attorney-client relationship, A pharmacist-patient relationship, A healthcare-provider relationship, A fiduciary relationship, A confidential professional relationship, A guarantee of representation/certification/treatment/access/eligibility/legal protection.

GMCS website forms, general email addresses, resource requests, advocacy forms, account messages, and website chat functions are not intended for confidential medical or legal communications.

Do not use the website to send emergency information, urgent medical concerns, diagnoses, medical records, prescription information, legal deadlines, threats of harm, or information requiring immediate professional attention.

For a medical or safety emergency, call 911 or contact an appropriate licensed professional.

16. Account and Password Responsibility

You are responsible for: Providing accurate account information, Maintaining the confidentiality of your password, Using a unique password, Protecting access to your email account and device, Signing out of shared or public devices, Promptly notifying GMCS of suspected unauthorized account activity, Not allowing another person to use your account without authorization.

GMCS may suspend, restrict, or deactivate an account when reasonably necessary to investigate suspected fraud, misuse, security threats, unauthorized access, violations of the Terms of Use, or risks to GMCS or other users. GMCS will never ask you to provide your password by email, telephone, text message, website chat, or general contact form.

17. Your Privacy Choices

Subject to applicable law and appropriate identity verification, you may request to: Access personal information associated with your account, Correct inaccurate information, Update your profile, Change communication preferences, Withdraw optional marketing consent, Request account deactivation, Request account deletion, Request a portable copy of certain account information, Ask about categories of information disclosed, Request review of a privacy-related decision, Change cookie preferences.

You may submit a privacy request through the My GMCS Account security page or by emailing [email protected]. General questions that do not involve privacy rights or account data may be sent to [email protected]. We may need to verify your identity before completing a request. We may deny or limit a request where permitted by law, including when information must be retained for security, fraud prevention, consent documentation, audit records, financial or tax records, legal obligations, dispute resolution, or protection of another person's rights. Authorized agents may submit requests where permitted by law, subject to verification of their authority.

18. Privacy-Request Verification and Abuse Prevention

Before fulfilling a request to access, correct, export, deactivate, or delete personal information, GMCS may take reasonable steps to verify: The identity of the requester, Ownership or control of the applicable account or email address, The authority of a parent/guardian/caregiver/representative/authorized agent, The scope and authenticity of the request.

GMCS may request additional information when reasonably necessary to prevent fraud, unauthorized disclosure, identity theft, account takeover, or interference with another person's rights. GMCS will not provide account information when identity or authority cannot be reasonably verified.

19. Account Deactivation and Deletion

Deactivating an account may prevent future sign-in while preserving records needed to process the request, maintain security, document consent, and meet legal or administrative obligations. Deleting an account may involve deleting, anonymizing, or restricting personal information.

Some information may be retained after account deletion, including: Consent history, Security records, Audit records, Transaction and donation records, Tax and accounting records, Records needed to prevent fraud or misuse, Information required by law, Records needed to resolve disputes.

GMCS will not retain information longer than reasonably necessary for the applicable purpose.

20. Data Retention

We retain information for as long as reasonably necessary to: Maintain an active account, Provide requested services and resources, Administer events and programs, Respect communication preferences, Document consent and withdrawals, Maintain security and audit records, Complete transactions, Maintain nonprofit/tax/donation/accounting records, Meet legal obligations, Resolve disputes, Enforce agreements.

Retention periods vary by record type. When information is no longer reasonably necessary, we may delete it, anonymize it, or restrict further use, subject to backup schedules and legal requirements. GMCS is developing and maintaining documented retention practices appropriate to its accounts, consent records, communications, events, programs, financial records, audit records, and legal obligations. Exact retention periods will be added when formally approved.

21. Security

GMCS uses reasonable administrative, technical, and organizational measures intended to protect personal information. These measures may include: Account authentication, Email verification, Role-based access, Server-side authorization, Encryption in transit, Restricted administrator access, Audit logging, Security monitoring, Secure secret storage, Rate limiting, Token expiration, Single-use verification and password-reset links, Data minimization, Staff access controls, Incident-review procedures.

No website, database, email system, transmission method, or storage system can be guaranteed to be completely secure. If you believe your account or personal information may have been compromised, contact [email protected] promptly. Do not include your password, complete payment card number, Social Security number, government identification, medical records, or other unnecessary sensitive information in your report.

22. Security Incidents and Required Notices

GMCS maintains procedures for identifying, investigating, containing, documenting, and responding to suspected unauthorized access, disclosure, alteration, loss, or destruction of personal information.

If an incident occurs, GMCS may: Secure affected systems, Preserve relevant records, Investigate the nature and scope of the incident, Engage hosting/security/legal/insurance/forensic professionals, Reset credentials or restrict affected accounts, Contact affected service providers, Notify law enforcement or regulators when appropriate, Provide legally required notices to affected individuals.

The timing, content, and recipients of any notice will be determined by the facts of the incident and applicable law. GMCS does not promise that every suspected event will constitute a legally reportable breach or that every investigation will result in individual notification.

23. Electronic Communication Security

Email, text messages, website forms, website chat, and internet communications may not always be secure. Although GMCS uses reasonable safeguards, visitors should not send highly sensitive information through ordinary email, text messages, chat, or general website forms.

GMCS is not responsible for the security of information while it is under the control of: The visitor's email provider, The visitor's mobile carrier, The visitor's device, A public or shared network, An independent third-party platform, An unauthorized person who obtained access to the visitor's account or device.

24. Information Provided Voluntarily

Information provided voluntarily through a message, attachment, free-text field, testimonial submission, patient story, event form, or support request may contain information GMCS did not request. Providing unsolicited sensitive information does not expand GMCS's services, create a professional relationship, or require GMCS to use the information for the purpose intended by the sender. GMCS may delete, restrict, redact, or decline to process information that is unnecessary, excessive, unsafe, unlawful, or outside the scope of GMCS's services.

25. Third-Party Links and Services

The website may link to: Government agencies, Healthcare providers, Certifying providers, Licensed access locations, Helpful organizations, Research organizations, Donation platforms, Merchandise platforms, Video and social-media platforms, Event and registration services.

GMCS does not control the privacy, security, accuracy, availability, or practices of independent third parties. A link, directory listing, referral link, resource listing, or sponsored listing does not constitute medical advice, legal advice, certification, endorsement, or a guarantee of service. Review the privacy notice and terms of any third-party service before providing personal information.

26. State-Specific and Other Privacy Rights

Privacy rights vary by jurisdiction and may depend on where a person lives, the type of information involved, and whether a particular law applies to GMCS. GMCS will honor privacy rights required by applicable law after completing reasonable identity verification. Nothing in this Notice is intended to provide rights that do not apply under governing law or to limit rights that cannot lawfully be waived.

27. International Visitors

GMCS is based in the United States, and its website and services are primarily intended for individuals located in the United States. Information may be processed and stored in the United States or in another location where a service provider operates. If you access the website from another country, local privacy laws may provide additional rights. Contact us with questions about an applicable privacy right.

28. Notice Purpose and Limitations

This Privacy Notice describes GMCS's current information practices and is intended to provide transparency. It is not intended to create contractual rights beyond those required by applicable law. Nothing in this Notice limits any right or obligation that cannot lawfully be limited. If this Privacy Notice conflicts with a legally required notice for a specific program, transaction, study, or service, the more specific notice will govern that activity.

29. Changes to This Privacy Notice

We may update this Privacy Notice to reflect changes in website features, programs, information practices, service providers, security measures, or legal requirements. We will post the revised Notice on the website and update the "Last Updated" date. If a change materially affects how we use personal information, we may provide additional notice through the website, account portal, or email, as appropriate. A material change will not automatically convert an earlier rejection of optional marketing into consent.

30. Contact GMCS

For privacy questions, privacy rights requests, consent withdrawals, account data requests, suspected child data concerns, cookie preference concerns, or suspected unauthorized access to personal information, contact:

Georgia Medical Cannabis Society

Privacy and Compliance

Email: [email protected]

For general organizational questions:

Email: [email protected]

For partnership and organizational collaboration inquiries:

Email: [email protected]

When contacting GMCS, please do not send passwords, diagnoses, medical records, Social Security numbers, complete payment card numbers, government identification, medical cannabis card numbers, or other unnecessary sensitive information.