Consumer Health Data Privacy Policy

What this covers

Washington's My Health My Data Act (HB 1155, in force 2024) defines consumer health databroadly — it includes anything that could identify a person's past, present, or future physical or mental health. Cannabis purchases at a state-licensed retailer fall inside that definition. This policy is the HB 1155-specific notice. Our broader privacy practices for non-health data are essentially the same and live on this page too — there is no separate “general privacy” document to chase down.

• Account information

  Name, date of birth, phone, email, and government-ID details we are required to verify under WAC 314-55-079 to confirm you are 21 or older.

• Purchase history

  Cannabis products you have purchased, the date and store, the amount, and the budtender on the transaction. Required for WSLCB recordkeeping (WAC 314-55-083) and for our loyalty program.

• Loyalty + preferences

  Points balance, tier, favorite categories or strains you have told us about, and notes a budtender wrote down at your request (e.g. 'prefers indica, sensitive to THC over 20%').

• Online order details

  Items, pickup time, and the device you placed the order from. We use this to prepare your order and to verify the person picking up matches the account.

• Site analytics (de-identified)

  Pages you visit on this website, time on page, which device and browser you use. Aggregated and not tied to your account or identity.

• ✓Verify you are 21+ before any sale (WSLCB requirement, no exceptions).
• ✓Process your order, prepare it for pickup, and run point-of-sale.
• ✓Maintain your loyalty points balance and apply discounts you have earned.
• ✓Comply with WSLCB recordkeeping and traceability requirements.
• ✓Respond to questions you send us by email, phone, or text.
• ✓Send you order-status texts and — only if you opt in — promotional messages.
• ✓Improve the website by understanding which pages help customers and which do not.

• Washington State Liquor and Cannabis Board (WSLCB)

  Regulatory recordkeeping, traceability, and audit response. Required by RCW 69.50 and WAC 314-55. Not optional.

• Our point-of-sale system (Dutchie, then in-house POS)

  Stores transactions and inventory. Vendor is bound by a written data-processing agreement and may not use your information for its own purposes.

• Online-ordering provider (iHeartJane)

  Powers the /menu surface and accepts pickup orders. Receives only the data needed to fulfill the order. Bound by a written data-processing agreement.

• Payment processor (cash only — no card processor)

  Seattle Cannabis Co. is cash-only at the register. We do not pass card data to any processor because we do not accept cards.

• Text-message provider

  Sends order-ready texts and promotional texts you opt in to. Phone number only — no purchase details in the message body.

• Law enforcement

  Only when we receive a valid subpoena, warrant, or court order, or when required by Washington or federal law.

• Right to know

  You can request a copy of the consumer health data we hold about you, what categories we collected, why we collected it, and who we shared it with. Free, once per year.

• Right to delete

  You can ask us to delete your consumer health data. We will delete it everywhere we control it, and ask our service providers to do the same. We may keep records WSLCB requires us to keep (transaction history, age-verification logs).

• Right to withdraw consent

  You can withdraw consent at any time for anything that depends on consent — for example, marketing texts or saved budtender preferences. We honor withdrawals as fast as we can; in practice, within five business days.

• Right to appeal

  If we deny a request, you can appeal in writing to the email below. We will respond within 45 days. If we still deny, you may complain to the Washington State Attorney General at atg.wa.gov/file-complaint.

1. 1Email rainier@seattlecannabis.co with the subject line "Health Data Request"
2. 2Tell us your name, date of birth, and the email or phone on your account so we can verify you
3. 3Tell us what you want — "send me my data," "delete my data," "stop using my data for X"
4. 4We will respond within 45 days (extendable to 90 days for complex requests, with notice)

How long we keep it, how we secure it

We keep transaction and age-verification records for at least three years to satisfy WSLCB requirements (WAC 314-55-083). Loyalty and preference data we keep while your account is active and for one year after your last visit; after that we anonymize or delete it. Data is stored on encrypted infrastructure in the United States. Access is limited to staff who need it for their job — budtenders see what they need to ring up a sale, managers see audit trails, only admins can export bulk data, and every export is logged.

Changes to this policy

If we make a material change, we will update the effective date at the top and — for account holders — send a notice email. Non-material changes (typo fixes, link updates) we make without notice. The current version is always the one on this page.