Last updated: August 25, 2026
PRIVACY POLICY
Effective Date: August 25, 2026
Indiva Cannabis respects your privacy. This Privacy Policy explains how Red White & Bloom Florida Inc., doing business as Indiva Cannabis (“Indiva,” “we,” “us,” or “our”), collects, uses, discloses, and protects information when you interact with our websites, online menus, accounts, pickup reservations, rewards program, communications, customer support, and dispensary services that link to this Policy (collectively, the “Services”).
This Policy does not apply to third-party websites or services that have their own privacy policies, or to employee and job-applicant information handled under separate notices.
1. Information We Collect
The information we collect depends on how you interact with us.
Information You Provide
We may collect:
Contact and identity information, such as name, mailing address, email address, telephone number, and date of birth.
Account information, such as username or email, password or authentication data, verification codes, account preferences, saved location, and communication choices.
Patient and caregiver information, such as MMUR patient or caregiver identification number, registry status, government-issued identification details, physician-certification or order information, route and allotment information, and other information needed to verify lawful eligibility and record a dispensation.
Order and transaction information, such as selected dispensary, products requested or purchased, prices, discounts, pickup details, transaction history, payment status, returns, exchanges, and product-quality matters.
Payment information. Payment credentials may be collected directly by an authorized payment provider. Indiva may receive limited information such as payment method, transaction status, amount, and a partial account or card identifier.
Rewards information, such as membership status, member identifier, points, qualifying spend, tier, rewards, redemptions, expiration dates, offers, birthday eligibility, and program activity.
Communications, such as messages sent through Contact or feedback forms, customer-support history, survey responses, and records of email or text preferences and consent.
Information you choose to provide, including feedback or information submitted in connection with a product, order, event, promotion, or other request.
Please do not submit private medical information, diagnosis details, or unrelated health records through a general Contact or feedback form.
If a feedback form is labeled anonymous, Indiva does not ask you to identify yourself and does not intentionally associate the substance of the response with your account. Standard website security logs may still contain an IP address, device data, and session information. Do not include your name, MMUR number, order details, diagnosis, or other identifying or medical information if you want the feedback itself to remain anonymous.
Information Collected Automatically
When you use the Services, we and our service providers may automatically collect:
IP address and approximate location derived from it;
browser, device, operating-system, language, and application information;
device or advertising identifiers;
pages viewed, links selected, searches, referring pages, session activity, and timestamps;
cart, menu, location-selection, and feature-interaction data;
cookie, pixel, tag, software-development-kit, and similar technology data; and
diagnostic, performance, security, fraud-prevention, and error information.
Location Information
If you enter a city or ZIP code, we use that information to locate nearby dispensaries. If you select “Use My Location” or enable device location permissions, we or our mapping provider may collect more precise location information to identify nearby stores. You may disable location access through your browser or device settings, although location-based features may not work properly.
In-Store Information
When you visit an Indiva location, we may collect transaction, identification, eligibility, customer-service, and security information. Indiva locations may use video surveillance and other security systems as permitted or required by law for safety, loss prevention, and regulatory compliance.
2. Sources of Information
We may collect information:
directly from you;
automatically from your browser, device, or use of the Services;
from the Florida Department of Health, the MMUR, and other government or regulatory sources as permitted by law;
from our point-of-sale, ordering, payment, rewards, customer-support, communications, analytics, security, and other service providers;
from an authorized caregiver or another person acting at your direction;
from Indiva affiliates or a predecessor program where accounts or records are lawfully transitioned; and
from publicly available sources or business partners, where permitted by law.
3. How We Use Information
We may use information to:
provide, operate, maintain, and secure the Services;
create, authenticate, service, and protect accounts;
verify age, identity, Florida patient or caregiver status, physician certification or order, route, allotment, and legal purchase eligibility;
prepare, review, fulfill, modify, cancel, and document pickup orders;
process payments, returns, exchanges, recalls, credits, and product-quality concerns;
administer Indiva Rewards, calculate points and tier status, apply rewards, provide program benefits, and investigate program errors or misuse;
identify nearby dispensaries and remember a selected location;
send requested transactional, account, security, order, recall, customer-service, and rewards-administration communications;
send promotional email, and any other promotional communication later permitted by applicable Florida law, only when you have made the separate choice or provided the consent required for that channel;
personalize content, menus, offers, and the user experience;
understand use of the Services, measure performance, conduct analytics, and improve products, stores, content, and operations;
advertise and measure campaigns as permitted by law and consistent with your choices;
prevent fraud, diversion, abuse, security incidents, and unlawful activity;
comply with Florida’s medical marijuana program, regulatory reporting, recordkeeping, tax, legal, and law-enforcement requirements;
establish, exercise, or defend legal claims and enforce our policies; and
complete a corporate transaction, such as a merger, acquisition, financing, reorganization, transfer, or sale of all or part of a business.
We may combine information collected from different sources for these purposes. We may also create aggregated or deidentified information that cannot reasonably be linked to you and use it for lawful business purposes.
4. How We Disclose Information
Nothing in this section authorizes patient records protected by Florida’s medical-marijuana confidentiality requirements to be made visible to anyone other than the qualified patient, the patient’s registered caregiver, and authorized Indiva employees, except to the extent applicable law expressly permits or requires. Indiva limits access to MMUR and patient records to the minimum technically and legally necessary and applies appropriate contractual, access-control, and security safeguards. Every disclosure category below is subject to these restrictions and applicable law.
We may disclose information to the following categories of recipients:
Affiliates
Subject to the patient-record restrictions above, we may disclose information to entities that control, are controlled by, or are under common control with Indiva for the purposes described in this Policy.
Service Providers
Subject to the patient-record restrictions above, we may disclose information to vendors that perform services on our behalf, including website hosting, cloud storage, content management, online ordering, point of sale, payments, rewards administration, mapping and geolocation, customer support, communications, data security, fraud prevention, COA hosting, professional services, and similar functions.
Where a service provider processes personal information on Indiva’s behalf, Indiva limits the provider to authorized purposes and applies contractual, access, security, and confidentiality requirements appropriate to the information and applicable law.
Advertising and Analytics Partners
Subject to your applicable choices, we may disclose limited non-sensitive cookie, browser, device, and website-interaction data to analytics or advertising partners for measurement, attribution, or advertising purposes permitted by law. Some partners may use that limited data under their own privacy policies, and the disclosure may be treated as a sale, sharing, or targeted advertising under an applicable privacy law. These partners are not permitted to receive the sensitive information identified in Section 5. Where required, you may opt out through the cookie or privacy controls described in Section 6.
Regulators and Government Authorities
We may disclose information to the Florida Department of Health, OMMU, MMUR, law-enforcement agencies, courts, regulators, and other government authorities when required or permitted by law. This includes information needed to verify eligibility, record dispensations, comply with inspections or reporting, respond to legal process, address safety or diversion, and protect rights and public safety.
Professional Advisers
Subject to the patient-record restrictions above, we may disclose information to attorneys, accountants, auditors, insurers, consultants, and other advisers who help us operate, comply with law, and protect our rights.
Business Transactions
Information may be disclosed or transferred as part of a proposed or completed merger, acquisition, financing, reorganization, bankruptcy, receivership, sale of assets, change of control, or similar transaction, subject to the patient-record restrictions above and all other applicable law.
At Your Direction or With Your Consent
We may disclose information to a person or service you direct us to use, or for another purpose described when the information is collected and to which you consent.
Protection and Legal Compliance
We may disclose information when we reasonably believe it is necessary to comply with law, enforce agreements, investigate fraud or misuse, protect an account or the Services, prevent harm, respond to an emergency, or protect the rights, property, safety, or security of Indiva, our patients, caregivers, employees, or others.
5. Sensitive and Medical-Marijuana Information
Patient or caregiver status, government identification information, MMUR information, medical diagnosis information, identifiable cannabis order history, information known to concern a child, and precise geolocation may be sensitive. We use and disclose this information only for the operational, safety, legal, regulatory, and other purposes described in this Policy.
Indiva does not sell sensitive data—including patient or caregiver status, MMUR information, medical diagnosis information, identifiable cannabis order history, known-child data, or precise geolocation—for money or other valuable consideration. Indiva does not disclose this sensitive data for targeted advertising. Analytics and advertising providers are not permitted to receive patient or caregiver status, allotment information, account credentials, MMUR information, or identifiable cannabis order details.
Indiva’s handling of medical-marijuana-related information does not necessarily make all information subject to the Health Insurance Portability and Accountability Act (“HIPAA”). We protect information under the laws and requirements that apply to Indiva and do not represent that every record covered by this Policy is protected health information under HIPAA.
6. Cookies, Analytics, and Advertising Technologies
The Services may use cookies and similar technologies for:
Strictly necessary purposes, such as security, authentication, shopping-cart operation, location selection, network management, and core functionality;
Functional purposes, such as remembering preferences and improving usability;
Analytics purposes, such as understanding traffic, feature use, errors, and performance; and
Advertising purposes, such as measuring campaigns or presenting more relevant messages, where permitted by law.
Your browser may allow you to block or delete cookies. The Services may also provide cookie or privacy controls where required. Disabling necessary cookies may prevent account, ordering, location, or other features from working.
Depending on applicable law, limited disclosures of non-sensitive cookie or device data may be treated as a “sale,” “sharing,” or targeted advertising, even when no money is exchanged. Where applicable, Indiva provides the required notice and choice through the cookie or privacy controls made available on the Services or through the Contact page. Analytics and advertising tools are not permitted to receive the sensitive information identified in Section 5.
7. Communication Choices
You may opt out of promotional emails at any time by selecting the unsubscribe link in the email. We will process requests within the period required by law.
Indiva does not use promotional SMS unless that channel is permitted by applicable Florida law or rule, approved by the Florida Department of Health where required, covered by any necessary Indiva-specific variance, and supported by separate legally sufficient consent. If promotional SMS is lawfully introduced, this Policy and the applicable consent disclosure will be updated before messages are sent.
If you separately request or consent to automated nonpromotional texts concerning an order, pickup, account, security issue, product safety or recall, customer-service request, or Rewards administration, message and data rates may apply. You may reply STOP or use another reasonable method described in the message or on our Contact page to revoke consent. A request to stop promotional communications does not necessarily stop a nonpromotional message that is legally permitted and necessary for a requested service, safety matter, or transaction; you may separately ask us to stop optional automated nonpromotional texts.
Marketing opt-outs do not stop communications necessary for an order, account, security issue, password reset, recall, product-safety matter, customer-service request, or other nonpromotional purpose.
You may also adjust certain account and device preferences through your account, browser, or device settings.
8. Data Retention
We retain information for as long as reasonably necessary for the purposes described in this Policy, including providing Services, maintaining an account, administering Rewards, completing transactions, resolving disputes, preventing fraud, enforcing agreements, and satisfying legal, regulatory, tax, audit, and recordkeeping obligations.
Retention periods vary by the type of information and the reason it was collected. Cannabis transaction, MMUR, security, surveillance, recall, product-quality, and regulatory records may need to be retained even after an account is closed or a deletion request is submitted.
When information is no longer required, we take reasonable steps to delete, destroy, deidentify, or securely dispose of it in accordance with applicable requirements.
9. Data Security
We use reasonable administrative, technical, and physical safeguards designed to protect personal information. No security system or Internet transmission is completely secure, however, and we cannot guarantee that information will never be accessed, used, or disclosed without authorization.
You can help protect your information by using a unique password, safeguarding verification codes, signing out of shared devices, and notifying us promptly if you suspect unauthorized account activity.
10. Your Privacy Choices and Requests
Depending on applicable law and subject to exceptions, you may request that Indiva:
confirm whether we process your personal information;
provide access to or a copy of certain personal information;
correct inaccurate information;
delete certain information;
provide certain information in a portable format; or
honor an applicable opt-out right relating to targeted advertising, sale, or sharing.
You may submit a request through the Contact Us page and select Other, Loyalty/Account, or the category most closely related to the request. Submit only the basic contact details and description needed to route the request. If verification is required, Indiva will follow up through a separate process rather than asking you to place private medical information in the general form. You may also mail a request to the address in the Contact section below.
We may ask for information reasonably necessary to verify your identity, authority, and request. An authorized agent may be required to provide written authorization and may be subject to additional verification. We will not discriminate against you for exercising an applicable privacy right, although some information is necessary to provide requested Services.
We may deny or limit a request when permitted or required by law—for example, when information must be retained for MMUR, transaction, security, fraud-prevention, recall, legal, or regulatory purposes; when deletion would affect another person’s rights; or when we cannot reasonably verify the request. If applicable law provides an appeal right, you may request review by replying to our decision or submitting a new Contact request that identifies the original request and asks for review.
11. Children and Minor Patients
The consumer website and account features are not directed to children under 18, and Indiva does not knowingly allow a person under 18 to create a consumer or Rewards account.
A qualified Florida patient under 18 must act through an authorized registered caregiver. A caregiver may provide information concerning a minor patient when required to verify lawful eligibility, complete a permitted transaction, comply with the MMUR, or meet another legal requirement. We handle that information for those limited purposes and as required by law.
If you believe a minor has directly submitted personal information through the consumer website without proper authorization, contact us so we can evaluate and take appropriate action.
12. Third-Party Websites and Services
The Services may link to or integrate with third-party websites and services. Their privacy practices are governed by their own policies, not this Policy. We encourage you to review those policies before providing information.
13. Changes to This Policy
We may update this Policy to reflect changes in our practices, technology, Services, or legal obligations. The revised Policy will be posted with an updated Effective Date. We will provide additional notice of material changes when required by law. We will not use an updated Policy to retroactively authorize materially different processing. Where consent is required, we will obtain it before the new processing begins.
14. Contact Us
Questions, privacy requests, or concerns about this Policy may be submitted through the Contact Us page or mailed to:
Indiva Cannabis
Attn: Privacy
6135 W Sitka St, 2nd Floor
Tampa, FL 33634
Please do not include a diagnosis, detailed medical history, or other unnecessary private medical information in a general privacy request.