Privacy Policy

PART A: GENERAL PRIVACY POLICY AND STATE PRIVACY RIGHTS

1. WHO WE ARE AND HOW TO CONTACT US

The business responsible for your personal information is Common Leaf, LLC d/b/a WODL, 532 Charles Dr, King of Prussia, Pennsylvania 19406. You may contact us about privacy matters at support@wodl.app or by mail at the address above, Attn: Privacy.

2. ELIGIBILITY; CHILDREN AND MINORS

The Services are intended only for adults who are at least 21 years of age and are not directed to children. We do not knowingly collect personal information from children under 13, and we do not knowingly sell personal information of, or process personal information for targeted advertising concerning, anyone under 21. If we learn that we have collected personal information from a person under 21, we will delete it and close the related account. If you believe a minor has provided us personal information, please contact us at the address in Section 1.

3. PERSONAL INFORMATION WE COLLECT

The table below describes the categories of personal information we collect, examples of each category, and the sources from which we collect it. Whether we collect a particular item depends on the features you use and the permissions you grant.

4. HOW WE COLLECT INFORMATION; DEVICE PERMISSIONS

We collect information (a) directly from you when you create an account, confirm your age, scan or submit products, write reviews or journal entries, post in the community, or contact us; (b) automatically when you use the Services, through our own systems and through software development kits and similar technologies provided by our service providers (see Section 8); and (c) from third parties, such as Apple and Google when you use their sign-in services.

The App asks for your permission before accessing your camera, photo library, microphone, location, or notifications. We request each permission when you first use a feature that needs it and explain why. You can grant, deny, or later revoke any permission in your device settings; if you do, the related feature may not work.

5. HOW WE USE PERSONAL INFORMATION

We use personal information for the following purposes:

• Provide the Services: create and maintain your account; authenticate you; operate barcode scanning and label reading; display product, strain, and batch information and dispensary menus and prices; save and display your journal entries and reviews; enable sharing and community features; and personalize your For You suggestions, which are calculated on your device using only your own reviews that you scored 7 or higher and the laboratory data for those products.
• WODL Pro: provide WODL Pro price tools, including local prices, price comparison, price history, and price alerts; verify your subscription status with Apple or Google through our service provider RevenueCat; and send acknowledgments, renewal reminders, and other notices about your subscription.
• Age-gating and eligibility: confirm that users meet our minimum age requirement.
• Safety, moderation, and security: review reported content, enforce our Terms of Service, detect and prevent fraud, spam, and abuse, and protect the security and integrity of the Services.
• Improve the Services: analyze use of the Services, diagnose crashes and errors, and develop and improve features, generally using de-identified or aggregated information where practical.
• Communications: send you service messages (such as account and security notices and changes to our terms) and, where permitted, marketing messages that you can opt out of at any time.
• Advertising: To show ads in the free App through Google AdMob, to limit how often you see them, to measure them, and to prevent ad fraud. Ads are personalized only with your permission (Section 8). We will not use consumer health data, precise location, your journal or review content, or other sensitive data to target advertising. WODL Pro subscribers see no ads.
• Industry insights: create de-identified and aggregated information as described in Section 6.
• Promotions: administer contests or promotions that you choose to enter
• Legal and compliance: comply with law, legal process, and requests from government authorities; establish, exercise, or defend legal claims; and maintain records of consents and requests.
• With your consent: for any other purpose disclosed to you at the time we request your consent.

We will not use personal information for a purpose that is materially different from the purposes described in this Privacy Policy without providing notice and, where required by law or app store policy, obtaining your consent.

Large language model training. We use paid artificial intelligence and text-recognition services, acting as our service providers, to read text from the product label photos you submit. Our artificial intelligence provider, OpenAI, receives that content through its paid API platform. Under OpenAI’s published data policies, OpenAI does not use content submitted through its API to train its models unless the customer opts in, and we have not opted in. OpenAI may keep abuse-monitoring logs that can include that content, generally for up to 30 days. Our backup text-recognition service, Google Cloud Vision, is also a paid service, and under Google’s published data policies, Google does not use the content we send to it to train its models. We also use a barcode-processing service provider, which deletes processed files after about one hour by default. We do not collect, use, or sell personal data for the purpose of training large language models.

6. INDUSTRY INSIGHTS: DE-IDENTIFIED AND AGGREGATED INFORMATION

WODL’s mission includes helping growers, processors, laboratories, manufacturers, distributors, and accessory providers understand how consumers experience cannabis products. We pursue that mission in a privacy-protective way:

(a) De-identified and aggregated information. We may combine information from many users and remove or transform identifiers so that the resulting information does not identify, and cannot reasonably be used to infer information about or be linked to, any individual or device (“De-identified Information”). Examples include aggregate product ratings, the frequency with which users report particular effects for a product or batch, and trends across products. We may share or license De-identified Information to industry participants and others. When we do, we (i) take reasonable technical and organizational measures to ensure that the information cannot be associated with an individual; (ii) maintain and use the information in de-identified form and do not attempt to re-identify it, except as permitted by law to test our de-identification methods; and (iii) contractually prohibit recipients from attempting to re-identify it.

(b) Identifiable information only with your opt-in consent. We will not share information that identifies you, or any consumer health data or other sensitive data about you, with industry participants for their own purposes unless you first give your separate, express, opt-in consent through a request that describes the categories of information, the purpose, the categories of recipients, and how you can withdraw your consent. Declining or withdrawing consent will not affect your ability to use the core features of the Services.

(c) No sale of personally identifiable consumer health data. We do not sell personally identifiable consumer health data. We would do so only with a valid signed authorization that meets the requirements of applicable law. See Part B.

(d) Your public reviews. Reviews and other content you choose to make public are visible to everyone who uses the Services, including industry participants. Please see Section 7(c).

7. HOW WE DISCLOSE PERSONAL INFORMATION

We disclose personal information only as described below. We require service providers and other recipients of personal information to protect it in a manner consistent with this Privacy Policy and with at least the same or equal level of protection.

(a) Service providers and processors that perform services on our behalf under written contracts that restrict their use of personal information, such as cloud hosting, database, authentication, crash reporting and analytics, email delivery, customer support, and content moderation providers. These include the artificial intelligence, text-recognition, and barcode-processing services that process the product label and barcode images you submit (see Section 5); the providers of the technologies described in Section 8.1; and RevenueCat, which tracks WODL Pro subscription status for us and receives your WODL user ID, purchase receipts from Apple or Google, and the plan you purchased, but not your name, email address, or advertising identifier.

(b) Sign-in providers (Apple and Google) as necessary to authenticate you when you choose to use their sign-in services.

(c) Other users and the public. Your username, profile, public reviews, ratings, and community posts are visible to other users and may be visible to the public. If you choose to include information about your health or other sensitive characteristics in content you make public, that information will be visible to others and may be shared outside the Services.

(d) Advertising partners. In the free App, Google (AdMob) receives your device’s advertising identifier (the Android Advertising ID, or Apple’s IDFA only if you allow tracking), IP address, general device information, app version, and ad interaction data (impressions and taps) so it can serve, measure, and, with your permission, personalize ads. Google’s use of this information is governed by Google’s Privacy Policy and its policies for AdMob. We do not disclose your name, email address, journal entries, reviews, health information, or precise location to advertising partners. No advertising data is collected while you have WODL Pro. See Section 8.

(e) Industry participants, only in de-identified or aggregated form, or with your opt-in consent, as described in Section 6.

(f) Legal and safety. Government authorities, courts, or other third parties when we believe in good faith that disclosure is required by law or legal process, or is necessary to protect the rights, property, or safety of WODL, our users, or others, including to respond to an emergency.

(g) Business transfers. A successor or acquirer in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our assets, subject to this Privacy Policy and applicable law. We will provide notice before personal information becomes subject to a materially different privacy policy.

(h) With your consent or at your direction.

NugNav, our dispensary menu and price data service, is operated by Common Leaf, LLC, the same company that operates WODL. NugNav is not a third party, and we do not have affiliates with which we share personal information.

8. ADVERTISING, SDKS, AND TRACKING TECHNOLOGIES

8.1 Technologies we use. The App uses software development kits (“SDKs”) provided by third parties for sign-in and authentication, subscription management, push notifications, maps, label text reading, crash reporting, and analytics. These are Firebase Analytics, Firebase Crashlytics (crash reports), Firebase Authentication, Firebase Cloud Messaging (push notifications), Google Maps, Google Sign-In, and ML Kit (which reads label text on your device), each provided by Google; Sign in with Apple, provided by Apple; and RevenueCat, provided by RevenueCat, Inc., for subscription management; and, in the free App, the Google Mobile Ads SDK (AdMob) and Google’s User Messaging Platform, provided by Google, to show ads and collect your ad consent choices. If you dictate a voice note, the App uses your device’s built-in Apple or Google speech-to-text service. The App does not set cookies. The Google Mobile Ads SDK uses your device’s advertising identifier as described in Sections 7(d) and 8.2. Firebase Analytics does not collect the advertising identifier and is not used for advertising. The Site does not use analytics, tracking technologies, or cookies for visitors, and images on the Site are delivered by Cloudinary, an image hosting service. The Site’s administrative area, which only WODL staff use, sets login cookies and uses Google reCAPTCHA on its login page. If you submit a contact form on the Site, we store your submission and use Akismet, a spam-filtering service provided by Automattic, to screen it for spam. We do not use session-recording technologies that capture the content of your journal entries, messages, or other communications for third parties without your prior consent.

8.2 Tracking across apps and websites. In the free App, Google AdMob may collect information about your use of the App together with your activity in other apps and websites to personalize ads, but only if you allow it: on iOS through Apple’s App Tracking Transparency prompt (Section 8.3), and, where the law requires consent (for example in the EEA, the UK, and some U.S. states), through the consent message shown before ads load. If you do not allow it, ads are non-personalized. The Site does not allow third-party tracking.

8.3 App Tracking Transparency (iOS). On iOS, we will not track you across apps and websites owned by other companies, or access your device’s advertising identifier for that purpose, unless you grant permission through Apple’s App Tracking Transparency prompt. You can change your choice at any time in your device settings.

8.4 Advertising choices. You can limit personalized advertising on Android by opening your device settings and selecting the option to delete or reset your advertising ID or to opt out of ads personalization, and on iOS by declining or revoking tracking permission in your device settings. Where Google’s consent tools require it, you can also use the “Ad privacy choices” option in Profile. The exact menu names vary by device and operating system version.

8.5 Do Not Track. Some web browsers transmit “Do Not Track” signals. Because there is no common industry standard for responding to these signals, neither the App nor the Site responds to Do Not Track signals. The Site does not use analytics or tracking technologies, the App uses Firebase Analytics as described in Section 8.1, and the free App uses the Google Mobile Ads SDK as described in Section 8.1. Our handling of Global Privacy Control signals is described in Section 8.6.

8.6 Global Privacy Control. Neither the App nor the Site currently responds to Global Privacy Control (“GPC”) signals or other opt-out preference signals. Where the law requires it, you can opt out of personalized ads in the App with the “Ad privacy choices” option in Profile (shown where Google’s consent tools require it), by declining tracking on iOS, or by deleting or resetting your advertising ID on Android. We are putting in place the technical means to treat a GPC signal or other legally recognized opt-out preference signal sent by your browser or device as a valid request to opt out of the sale or sharing of your personal information and of targeted advertising for that browser or device and, if we know who you are, for your account, on the Site and, where applicable, in the App, as required by applicable law.

9. DATA RETENTION

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements. The criteria we use include the nature and sensitivity of the information, the purpose for which it was collected, and legal requirements. Our general retention periods are:

10. DATA SECURITY AND BREACH NOTIFICATION

We maintain reasonable administrative, technical, and physical safeguards designed to protect personal information, including encryption of data in transit; storing account passwords only in hashed form; limits on repeated login attempts; access controls that keep administrative and staff tools behind separate logins and an additional password layer; encrypted connections to our databases; ending all active sessions when an account is deleted; and removing query data from the logs of requests to our App servers. Some of our stored data, including our menu database, its backups, and our backup file storage, is also encrypted at rest. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a security breach affects your personal information, we will notify you and, where required, regulators and consumer reporting agencies, as required by applicable law, including the Pennsylvania Breach of Personal Information Notification Act.

11. YOUR CHOICES AND CONTROLS

• Account deletion: You can delete your account within the App by selecting “Delete account” in your profile or in the App’s settings and confirming, through our account deletion web page at https://api.wodl.app/delete-account, or by contacting us.
• Edit or delete content: You can edit or delete journal entries, reviews, and posts in the App.
• Device permissions: You can revoke camera, photo, microphone, location, notification, and tracking permissions in your device settings.
• Withdraw consent: You can turn off push notifications with the “Push notifications” switch in the App’s notification settings; turn off location access with the “Location access” switch in the App’s settings, which opens your device settings, or directly in your device settings; and turn off camera, photo, and microphone access in your device settings. The App does not currently offer a setting to opt out of analytics. You can withdraw any other consent you have given (including for consumer health data or sensitive data) by contacting us, and you can withdraw all of your consents by deleting your account. Withdrawal does not affect processing that occurred before withdrawal.
• Marketing communications: You can unsubscribe from marketing emails by using the link in the email, and you can turn off push notifications in the App’s notification settings or in your device settings. We may still send service messages.

12. YOUR PRIVACY RIGHTS

12.1 Rights available to you. Depending on where you live, and subject to verification and legal exceptions, you may have the right to: (a) confirm whether we process your personal information and access it; (b) know the categories of personal information we collect, the sources, our purposes, and the categories of third parties to which we disclose it; (c) correct inaccurate personal information; (d) delete personal information; (e) obtain a portable copy of your personal information; (f) opt out of the sale of personal information, targeted advertising (including “sharing” for cross-context behavioral advertising), and profiling in furtherance of decisions that produce legal or similarly significant effects; (g) limit the use of sensitive personal information or withdraw consent to its processing; and (h) not be discriminated against for exercising these rights. We extend these rights to all users located in the United States, regardless of state of residence.

12.2 How to submit a request. You may submit a request by emailing support@wodl.app with the subject line “Privacy Request,” or by mail to the address in Section 1. You can opt out of personalized ads as described in Sections 8.4 and 8.6. We will add a “Your Privacy Choices” or “Do Not Sell or Share My Personal Information” link or in-app setting, and you will also be able to use a GPC signal as described in Section 8.6.

12.3 Verification. To protect your information, we will verify your identity before fulfilling a request to access, correct, or delete, generally by asking you to submit the request while logged in to your account or to confirm control of the email address associated with your account. We will not require more information than is reasonably necessary to process a request to opt out.

12.4 Authorized agents. You may designate an authorized agent to make a request on your behalf where permitted by law. We may require the agent to provide proof of your written permission and may require you to verify your identity directly with us.

12.5 Response timing. We will respond within the time required by applicable law (for example, within 45 days for requests under the Washington My Health My Data Act), and we will notify you if an extension permitted by law is needed.

12.6 Appeals. If we decline to take action on your request, you may appeal by emailing support@wodl.app with the subject line “Privacy Request Appeal” within a reasonable period after receiving our decision. We will respond to your appeal in writing within the time required by applicable law and explain our reasons. If your appeal is denied, you may contact the Attorney General of your state.

13. STATE-SPECIFIC DISCLOSURES

13.1 California

(a) California Online Privacy Protection Act. This Privacy Policy describes the categories of personally identifiable information we collect and the categories of third parties with which we may share it (Sections 3 and 7); the process for reviewing and requesting changes to your information (Sections 11 and 12); how we notify you of material changes (Section 15); the effective date (top of this Privacy Policy); how we respond to Do Not Track signals (Section 8.5); and whether other parties may collect personally identifiable information about your online activities over time and across different websites when you use the Services (Section 8.2).

(b) California Consumer Privacy Act. We provide this subsection (b) voluntarily, whether or not WODL meets the definition of a “business” under Cal. Civ. Code § 1798.140(d), and California residents may exercise the rights it describes.

In the preceding 12 months, we collected the following categories of personal information, from the sources described in Section 3, for the business and commercial purposes described in Section 5, and disclosed them for a business purpose to the categories of recipients described in Section 7: identifiers (such as email address, user ID, device identifiers, and IP address); commercial information (such as your WODL Pro plan and subscription status); internet or other electronic network activity information (such as app interactions, in-app search history, and crash and performance data); geolocation data (approximate and, with permission, precise); audio, electronic, visual, or similar information (photos); inferences drawn from the foregoing; and sensitive personal information, consisting of account log-in credentials, precise geolocation, the contents of in-app messages between users (where WODL is not the intended recipient), and personal information collected and analyzed concerning your health. We do not ask for other sensitive personal information, but if you choose to include information about your health or other sensitive characteristics in reviews, posts, or other content you make public, that information will be visible to others.

Notice at collection. This Section 13.1(b), together with Sections 3 (categories of personal information we collect, including sensitive personal information), 5 (purposes for which we collect and use it), 9 (how long we keep it), and the sale and sharing disclosures below, is our notice at collection under the CCPA (11 CCR § 7012). We make this notice and this Privacy Policy available before or at the time we collect personal information through a link to https://wodl.app/privacy in the privacy policy field of the App’s Apple App Store and Google Play listings, within the App (including on the sign-up and sign-in screens and in the App’s profile or settings menu), and in the footer of the Site.

Sale and sharing. In the preceding 12 months, we have not sold or shared (for cross-context behavioral advertising) personal information. We do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age.

Sensitive personal information. We use and disclose sensitive personal information only for purposes permitted under 11 CCR § 7027(m), such as providing the Services you request (including personalizing the For You suggestions you choose to view) and ensuring security and integrity, and we do not use it for advertising. We therefore do not offer a right to limit.

Your California rights. California residents have the rights described in Section 12, including the right to know, delete, and correct; to opt out of sale and sharing; to limit the use and disclosure of sensitive personal information; to opt out of, and to access information about, automated decision-making technology where applicable; and not to be retaliated against for exercising these rights. We use your own reviews that you scored 7 or higher, and the laboratory data for those products, to personalize For You suggestions on your device, but we do not use automated decision-making technology to make significant decisions about you, such as decisions about financial or lending services, housing, education, employment, or health care services. Requests may be submitted, verified, and made through authorized agents as described in Section 12. Our handling of opt-out preference signals is described in Section 8.6.

Financial incentives. We do not currently offer financial incentives in exchange for personal information. If we offer a promotion that awards entries, prizes, or other benefits for writing reviews or submitting other content, that promotion may be a financial incentive under California law. Before you opt in, the official rules for that promotion will include a Notice of Financial Incentive that summarizes the material terms, identifies the categories of personal information involved, explains how to opt in and how to withdraw at any time, and provides a good-faith estimate of the value of the personal information and how we calculated it. We will not include you in such a program without your opt-in consent.

Shine the Light. We do not disclose personal information to third parties for their own direct marketing purposes .

13.2 Connecticut

Connecticut residents have the rights described in Section 12, including the right to appeal described in Section 12.6. We process sensitive data (including consumer health data) only with your consent, and we do not sell sensitive data or consumer health data without your consent. We do not process personal data for targeted advertising or sell personal data of consumers we know are under 18. You may opt out of targeted advertising and sale through the methods in Section 12.2, including, once available, through an opt-out preference signal as described in Section 8.6. Whether we collect, use, or sell personal data for the purpose of training large language models is disclosed in Section 5. A link to this Privacy Policy, labeled with the word “privacy,” is available on the App’s app store download pages and within the App.

13.3 Texas

Texas residents have the rights described in Section 12 and may appeal as described in Section 12.6. We will not sell sensitive personal data without your prior consent. You may opt out of sale and targeted advertising through an authorized agent or through a browser setting, browser extension, or global device setting where applicable.

13.4 Nevada

Nevada residents may submit a request directing us not to sell covered information that we have collected or will collect about them by emailing our designated request address at support@wodl.app with the subject line “Nevada Do Not Sell Request.” We will respond within 60 days. We do not currently sell covered information as defined under Nevada law. Nevada residents should also review Part B regarding consumer health data.

13.5 Washington

Washington residents should review Part B, which is our Consumer Health Data Privacy Policy under the Washington My Health My Data Act, chapter 19.373 RCW.

13.6 Delaware and Other States

Residents of Delaware and of other states with consumer privacy laws may exercise the rights described in Section 12. This Privacy Policy is intended to provide the disclosures required by the Delaware Online Privacy and Protection Act, including how we respond to Do Not Track signals (Section 8.5) and whether third parties may collect personally identifiable information about your online activities over time and across different websites (Section 8.2).

13.7 Pennsylvania

WODL is located in Pennsylvania. In the event of a breach of security involving your personal information, including a username or email address in combination with a password or security question and answer that would permit access to your account, we will provide notice as required by Pennsylvania law. We do not intercept or allow third parties to intercept the contents of your communications through the Services except with your consent or as otherwise permitted by law.

14. INTERNATIONAL USERS

The Services are operated from the United States and are intended for users located in the United States. If you access the Services from outside the United States, your information will be transferred to, stored in, and processed in the United States, where privacy laws may differ from those in your jurisdiction.

15. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. We will post the updated version with a new “Last Updated” date. If we make material changes, including any change in how we use or disclose consumer health data or sensitive data, we will notify you in the App or by email before the change takes effect. If a change is materially adverse to you with respect to how we collect, use, or disclose personal information we previously collected, we will notify you directly and will not apply the change to that previously collected information unless and until you give us your new, affirmative consent. A change is materially adverse if it would reasonably affect your decision to provide your personal information to us. Where required by law or app store policy, we will also obtain your consent before applying any other material change to information we previously collected.

16. CONTACT US

Common Leaf, LLC d/b/a WODL Attn: Privacy 532 Charles Dr, King of Prussia, PA 19406 Email: support@wodl.app

PART B: CONSUMER HEALTH DATA PRIVACY POLICY

(Washington My Health My Data Act, ch. 19.373 RCW; Nevada, NRS 603A.400 to 603A.550; and Other Applicable Laws)

Last Updated: 11 NOV 2026

Effective Date: 11 NOV 2026

This Consumer Health Data Privacy Policy supplements Part A and applies to “consumer health data” as defined under the Washington My Health My Data Act, chapter 19.373 RCW (the “Washington Act”), Nevada law (NRS 603A.400 to 603A.550), and other applicable state laws governing consumer health data, including Connecticut law. It applies to consumers who are residents of those states and, for the Washington Act, to any natural person whose consumer health data is collected in Washington. We apply the protections in this Part B to all users in the United States. A link to this Part B is available on the App’s app store download pages, within the App, and on the Site’s homepage.

B1. WHAT IS CONSUMER HEALTH DATA

“Consumer health data” generally means personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. Information about cannabis products alone may not be consumer health data, but information you provide in the App can become consumer health data, for example if it describes a symptom, condition, or treatment, or if health status is inferred from it.

B2. CATEGORIES OF CONSUMER HEALTH DATA WE COLLECT

• Health conditions, symptoms, or reasons for use that you choose to enter in journal entries, reviews, or other fields.
• Effects you report experiencing after using a product, to the extent they reveal physical or mental health status (for example, effects on pain, sleep, or anxiety).
• Medical-patient status, such as whether you are a registered medical marijuana patient.
• Information about your use or purchase of medication or products, to the extent it identifies your health status.
• Inferences about your health status derived from the information above or from non-health information, such as your ratings and product history. We do not use these inferences for advertising. Your For You suggestions are calculated on your device using only your own reviews that you scored 7 or higher and the laboratory data for those products (such as terpene, THC, and minor cannabinoid content), and they do not use the effects you report.
• Precise location information, only if you grant location permission, to the extent it could reasonably indicate an attempt to acquire or receive health services or supplies. Your device’s location, rounded to about 11 meters, is collected only while the App is open, is used to sort stores by distance and compare nearby prices, and is sent to our servers only to calculate distances; it is not stored or shared.

B3. PURPOSES FOR WHICH WE COLLECT AND USE CONSUMER HEALTH DATA

We collect and use consumer health data to: (a) provide the journal, review, and product-tracking features that you request, including saving and displaying your entries to you; (b) display your reviews to other users if you choose to make them public; (c) personalize your For You suggestions; (d) create De-identified Information as described in Section 6 of Part A; (e) maintain the security and integrity of the Services; and (f) comply with law. We do not use consumer health data for targeted advertising.

B4. SOURCES OF CONSUMER HEALTH DATA

We collect consumer health data directly from you when you enter it in the App, from your device if you grant location permission, and through inferences we derive from information you provide.

B5. CONSUMER HEALTH DATA WE SHARE AND WITH WHOM

We share consumer health data only as necessary to provide the Services you request or with your separate consent. The categories of consumer health data we share are: the categories described in Section B2, to the extent our hosting and service providers process them to run the App, and any health-related content you choose to post publicly. The categories of third parties with which we share consumer health data are: (a) service providers and processors, such as cloud hosting and database providers, that process the data on our behalf under contract to run the App; and (b) other users and the public, when you choose to post health-related content publicly, such as in a review. We do not share consumer health data with any other recipients. The specific affiliates with which we share consumer health data are: We have no affiliates with which we share consumer health data. NugNav, our dispensary menu data service, is operated by Common Leaf, LLC itself and is not an affiliate or a third party. We do not share consumer health data with advertising networks or with industry participants in identifiable form without your separate consent.

B6. CONSENT

We collect consumer health data only with your consent for a specified purpose or to the extent necessary to provide a product or service that you have requested. We share consumer health data only with your consent, which we will obtain separately from your consent to collection, or to the extent necessary to provide a product or service that you have requested. Each consent request will clearly describe the categories of consumer health data involved, the purpose of the collection or sharing, the categories of entities with which the data will be shared, and how you can withdraw consent. Accepting our Terms of Service is not consent to collect or share consumer health data. You may withdraw your consent at any time as described in Section B9.

B7. NO SALE WITHOUT SIGNED AUTHORIZATION

We do not sell or offer to sell consumer health data. We would sell consumer health data only after obtaining a valid authorization signed by you that is separate and distinct from your consent to collection and sharing, that identifies the purchaser and its contact information, that meets all other requirements of applicable law, and that expires one year after you sign it. You may revoke an authorization at any time. We will not condition the provision of the Services on your signing an authorization, and we will retain copies of signed authorizations for six years.

B8. NO GEOFENCING OF HEALTH CARE FACILITIES

We do not implement any virtual boundary (geofence) around any entity that provides in-person health care services to identify or track consumers seeking health care services, to collect consumer health data, or to send notifications, messages, or advertisements related to consumer health data or health care services.

B9. YOUR CONSUMER HEALTH DATA RIGHTS

Subject to verification and legal exceptions, you have the right to:

• confirm whether we are collecting, sharing, or selling your consumer health data and access that data, including a list of all third parties and affiliates with which we have shared or sold your consumer health data and an active email address or other online mechanism you may use to contact them;
• withdraw your consent to our collection and sharing of your consumer health data; and
• have your consumer health data deleted. When we delete your consumer health data, we will delete it from our records, including from archived or backup systems (any delay for backup systems will not exceed six months after we authenticate your request), and will notify all affiliates, processors, contractors, and other third parties with which we shared it of your deletion request.

To exercise these rights, email support@wodl.app with the subject line “Consumer Health Data Request.” We will not require you to create a new account to make a request, but we may ask you to submit it through your existing account and may request additional information reasonably necessary to authenticate you. We will respond without undue delay and in all cases within 45 days after receipt; we may extend that period once by an additional 45 days when reasonably necessary, in which case we will inform you of the extension and the reason within the initial 45-day period. Information provided in response to your requests is free of charge up to twice annually. If we decline to act on your request, you may appeal by emailing support@wodl.app with the subject line “Consumer Health Data Appeal” within a reasonable period after receiving our decision; we will inform you in writing within 45 days after receiving your appeal of any action taken or not taken and the reasons. If your appeal is denied, you may submit a complaint to the Washington State Attorney General (for Washington consumers) or to the Attorney General of your state. We will not discriminate against you for exercising these rights.

B10. CONTACT

Questions about this Consumer Health Data Privacy Policy may be directed to Common Leaf, LLC d/b/a WODL, Attn: Privacy, 532 Charles Dr, King of Prussia, PA 19406, or support@wodl.app.