Privacy Policy

Last Updated: October 20, 2025

1. Introduction

Welcome to Med Card Services LLC (“Med Card Services,” “we,” “our,” or “us”).

We own and operate several clinic brands that help patients connect with licensed healthcare providers for medical evaluations and related services. One of those brands is Get Canna Card LLC (“Get Canna Card”), which delivers telehealth evaluations and support for qualifying medical programs in Utah and other approved states.

Med Card Services acts as the managing company for all affiliated clinics. It provides administrative and communication support — including phone calls, text messaging, scheduling, and customer service — and maintains the technology systems that keep those services running securely. Each clinic brand operates under the same privacy and data-protection standards described in this Policy.

This Privacy Policy explains in clear terms:

what information we collect from you,
how we use and share it,
how we protect it, and
what rights you have over your data.

By using our websites, telehealth platforms, or messaging systems, you agree to this Privacy Policy. If you do not agree, please stop using our services and contact us if you have questions about your privacy choices.

2. Information We Collect

We collect only the information needed to provide and improve our services. The types of data we collect fall into these categories:

Personal Information

This includes basic details you share when creating an account, filling out an intake form, or contacting us — such as your name, date of birth, mailing address, phone number, and email address.

Health Information

When you use our telehealth or clinic services, you may provide medical history, symptoms, or other health-related details. This information may be considered Protected Health Information (PHI) under HIPAA.

Technical Data

We collect limited technical information automatically — like your device type, browser, IP address, and how you interact with our website. This helps us keep our systems secure and user-friendly.

Communications Data

We may collect information from your calls, text messages, chat sessions, or emails with our support team. This helps us respond to requests, verify identity, and ensure quality service.

Billing Information

If you make a payment, your billing details are processed securely by third-party payment vendors. We don’t store your full payment card number.

Cookies and Analytics

We use cookies and analytics tools (such as Google Analytics or Meta Pixel) to understand website performance and advertising reach. These tools do not access or store any health information.

3. How We Use Your Information

We use your information only for legitimate purposes related to your care, communication, and service experience. Specifically, we may use it to:

Deliver telehealth and clinic services.
This includes scheduling appointments, connecting you with licensed healthcare providers, and facilitating follow-ups.
Communicate with you.
We send text messages, emails, and phone notifications for appointment reminders, confirmations, and updates about your account or care. You can opt out of promotional messages anytime.
Coordinate with healthcare providers.
We share relevant information with independent, licensed healthcare professionals who conduct your evaluations. These providers are responsible for their own clinical records and privacy practices under HIPAA.
Process payments and forms.
We securely manage billing information and intake submissions through trusted third-party platforms.
Maintain and improve our systems.
Technical and analytics data help us troubleshoot, enhance performance, and protect against fraud or unauthorized access.
Comply with laws and regulations.
We use and disclose information as required by HIPAA, state privacy laws, and other legal obligations.

We never sell or rent your personal or health information. Any information shared with partners is done solely to provide services or fulfill legal requirements — never for external marketing or data resale.

4. HIPAA and Data Protection Practices

We take the privacy and security of your health information seriously. Some of the data we collect qualifies as Protected Health Information (PHI) under the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

Our Role Under HIPAA

Med Card Services LLC is the HIPAA-covered entity that manages administrative and communication systems for all affiliated clinic brands, including Get Canna Card LLC.
Independent, licensed healthcare professionals provide medical evaluations and are responsible for maintaining their own clinical records and HIPAA compliance.

Med Card Services facilitates secure communication between patients and these providers and protects all PHI that passes through its systems.

Business Associate Agreements (BAAs)

We work only with trusted technology partners who sign Business Associate Agreements with us, requiring them to safeguard PHI under HIPAA. This includes vendors such as:

Heally Inc. (telehealth technology platform)
Twilio Inc. (secure messaging and SMS provider)
Payment processors and hosting providers (for billing and secure data storage)

How We Protect Your PHI

We use multiple layers of protection, including:

Encrypted transmission and storage of health data
Role-based access controls and internal audit logs
Continuous monitoring of our systems for unauthorized access
Staff training on HIPAA and data security best practices

Your PHI is used or disclosed only for treatment, payment, healthcare operations, or as otherwise required by law. We will never use your PHI for marketing without your explicit written authorization.

Notice of Privacy Practices

Med Card Services maintains a formal Notice of Privacy Practices (NPP) that provides additional details about how your Protected Health Information (PHI) may be used and disclosed under HIPAA. You may request a copy of our NPP at any time by emailing privacy@getcannacard.com.

5. Mobile Phone & Messaging Policy (A2P Compliance)

When you provide your phone number and consent to receive messages, you’re authorizing Med Card Services and its affiliated clinics (including Get Canna Card) to communicate with you by SMS, MMS, or automated text. These communications are essential for delivering care and staying connected.

What You May Receive

Appointment confirmations and reminders
Account or verification messages
Updates about your telehealth session
Occasional educational or promotional messages (only if you’ve opted in)

Your Choices

Opt Out Anytime: Reply STOP to any text to unsubscribe from promotional or nonessential messages.
Need Help? Reply HELP for assistance.
After opting out, you’ll still receive messages required for your ongoing care or account (e.g., appointment notices).

Message Frequency & Costs

Message frequency varies based on your interactions. Standard message and data rates may apply, depending on your carrier.

How We Handle Your Mobile Data

We do not share mobile numbers, consent data, or opt-in records with third parties for marketing purposes.
Messaging is delivered securely through Twilio, our A2P-compliant provider.
Twilio is under a Business Associate Agreement (BAA) and follows strict confidentiality and HIPAA security standards.
All messages are logged in compliance with A2P 10DLC and HIPAA requirements.

A2P 10DLC Registration Disclosure

Our messaging system is registered with the Twilio A2P 10DLC program for verified business communications in compliance with carrier and FCC regulations. This registration helps ensure that all text messages you receive from Med Card Services or its affiliated clinics, including Utah Canna, are properly identified, authenticated, and delivered through trusted channels.

6. How We Share Information

We only share your information when it’s necessary to provide care, process transactions, or meet legal obligations. We never sell or rent your personal or health data.

With Licensed Healthcare Providers

We share relevant details with the independent, licensed healthcare professionals who perform your telehealth consultations or in-person evaluations. These providers maintain their own medical records and privacy practices, as required by HIPAA.

Within Med Card Services and Affiliated Clinics

Because Med Card Services manages communications and administrative support for several clinic brands (including Get Canna Card), some patient data may be shared internally between affiliated clinics.

This is done only when necessary for:

Scheduling, intake, and follow-up coordination
Ensuring continuity of care if you visit another affiliated clinic
Centralized customer support or compliance review

All internal sharing follows the same privacy and security standards outlined in this Policy and does not constitute third-party disclosure.

With Trusted Service Providers

We work with select partners who help us deliver secure and efficient care:

Heally Inc. – telehealth technology and electronic forms
Twilio Inc. – HIPAA-compliant SMS and communication services
Payment processors – for secure billing and refunds
Analytics and hosting providers – for website performance and security

Each partner is contractually required to protect your data, use it only for authorized purposes, and comply with HIPAA and applicable laws.

When Required by Law

We may disclose information if required to do so by law — such as responding to valid subpoenas, public health reporting, or regulatory obligations. We will only share the minimum information necessary to comply.

7. Data Security and Retention

We use strong technical and administrative safeguards to protect your information from loss, misuse, or unauthorized access. While no system is completely immune to risk, we take every reasonable step to keep your data safe.

Our Security Practices

Encryption: All sensitive information, including PHI and payment data, is encrypted during transmission and storage.
Access Controls: Only authorized team members and healthcare partners have access to PHI, and access is limited to the minimum necessary for their role.
Audit Logging: We maintain logs of all access to systems containing PHI to meet HIPAA compliance and to ensure transparency and accountability.
Secure Systems: All platforms used for telehealth, messaging, and data storage are HIPAA-compliant and regularly monitored for security vulnerabilities.
Staff Training: Our employees receive regular training on HIPAA and data protection requirements.

Data Retention

We retain your information only as long as needed to provide services and comply with legal obligations:

Medical records are stored for at least seven (7) years, or longer if required by law.
Account or contact information not part of a medical record may be deleted upon verified request, unless retention is required for compliance or auditing.
When information is no longer needed, it is securely deleted or de-identified according to HIPAA standards.

Retention of Non-Medical Data

In addition to medical and account records, we may retain limited non-medical information — such as customer service notes, website analytics data, or text-message delivery logs — for operational, auditing, or legal-compliance purposes. Such data is typically stored for no longer than 24 months unless a longer period is required by law or to resolve an active support or compliance matter. After that period, the data is securely deleted or de-identified.

Breach Notification

If a data breach occurs that may compromise your personal or health information, we will notify you promptly as required by HIPAA and applicable state laws. Notifications will be sent via email, SMS, or postal mail, depending on your contact preferences.

8. Your Privacy Rights

Depending on where you live and the type of information we hold, you may have specific rights regarding your personal and health data. We respect and honor those rights in accordance with HIPAA, state privacy laws (such as the CCPA), and international data protection rules (like the GDPR).

Your Rights Under HIPAA

If your information qualifies as Protected Health Information (PHI) under HIPAA, you have the right to:

Access and receive a copy of your medical or telehealth records.
Request corrections if any information is inaccurate or incomplete.
Request restrictions on how we use or share your PHI (for example, limiting disclosures to certain providers).
Receive a list of disclosures we’ve made of your PHI, as permitted by law.
File a complaint if you believe your privacy rights have been violated — either with us at privacy@getcannacard.com or directly with the U.S. Department of Health and Human Services (HHS).
We will never retaliate against anyone for filing a privacy complaint.

Your Rights Under the CCPA (California Residents)

If you’re a California resident, you also have the right to:

Know what personal data we collect, use, or share.
Request deletion of your personal data, subject to legal and medical record-keeping requirements.
Opt out of data sale (we do not sell personal data).
Receive equal service even if you exercise your privacy rights.
To exercise these rights, email us at privacy@getcannacard.com. We’ll verify your request and respond within the timeframe required by law.

Your Rights Under the GDPR (EEA/UK Residents)

If you live in the European Economic Area (EEA) or the United Kingdom, you have the right to:

Access, correct, or delete your personal data.
Restrict or object to how your data is processed.
Request data portability (a copy of your data in a structured format).
Withdraw consent for data processing at any time.
All requests can be submitted by email at privacy@getcannacard.com. We’ll review and respond in accordance with GDPR timelines.

Verification of Requests

To protect your privacy and maintain security, we verify your identity before processing any data-access, correction, or deletion request submitted under HIPAA, CCPA, or GDPR. Verification may include confirming details such as your name, email address, or recent transaction history. We will not fulfill a request if we cannot reasonably confirm your identity or authorization to make it.

9. Cookies, Tracking, and Analytics

We use cookies and similar technologies to make our websites and online services work smoothly, understand how they’re used, and improve your overall experience.

What Cookies Do

Cookies are small data files stored on your device when you visit our site. They help us:

Keep your session active when you log in or fill out a form.
Remember your preferences, such as language or location.
Understand how visitors use our website so we can make improvements.
Measure the effectiveness of our marketing campaigns.

You can adjust your browser settings to block or delete cookies at any time. However, doing so may affect how some parts of the site function.

Analytics and Advertising Tools

We use third-party analytics and advertising platforms, including Google Analytics and Meta Pixel, to gather insights about how people find and interact with our site.

These tools collect limited technical information, such as device type, IP address, and browsing behavior. They do not collect or access any medical or health information.

You can learn more about how Google and Meta handle data or opt out of tracking through their respective privacy controls:

Advertising and Remarketing

We may use cookies, pixels, and analytics data to display ads that are more relevant to your interests on third-party websites, search engines, and social platforms such as Google and Meta. These tools use de-identified technical data (e.g., browser type, device ID, or page visits) to measure advertising effectiveness and reach similar audiences. No personal or health information is shared with these advertising partners. You can opt out of personalized ads by adjusting your browser settings or visiting the ad-preference pages of these platforms.

10. Data Use Outside the U.S. and International Transfers

Our services are primarily intended for users within the United States, where Med Card Services and its affiliated clinics operate. However, because we use secure cloud-based systems, your information may be stored or processed on servers located outside your state or in other countries.

International Transfers

If you access our services from outside the U.S. (for example, while traveling), your information may be transferred to and processed in the United States. The data protection laws here may differ from those in your home country.

We ensure that any such transfer meets appropriate legal and security requirements. When required by law, we use safeguards such as data processing agreements, standard contractual clauses, and Business Associate Agreements to protect your information wherever it is handled.

Your Consent

By using our services, you consent to the transfer, storage, and processing of your information in the United States in accordance with this Privacy Policy and applicable law.

11. Children’s Privacy

Our services are intended for adults aged 18 and older. We do not knowingly collect, use, or store personal information from anyone under 18, and we never knowingly collect information from children under 13.

If you are a parent or guardian and believe that your child has provided personal or health information to us, please contact us right away at privacy@getcannacard.com.
Once verified, we will delete that information in accordance with applicable laws.

If we learn that we have inadvertently collected data from a minor without verified parental consent, we will take immediate steps to remove it from our systems.

Links to Other Websites

Our websites may contain links to external websites or online services operated by other organizations. We are not responsible for the privacy practices, security, or content of those external sites. We encourage you to review their privacy policies before providing any personal or health information. Any data you provide to those sites is governed by their respective policies, not ours.

12. Updates to This Policy

We may occasionally update this Privacy Policy to reflect changes in our services, technology, or legal requirements. When we make updates, we’ll revise the “Last Updated” date at the top of the page.

If we make a material change—something that affects how we use or share your information—we’ll notify you in advance through one or more of the following methods:

Posting a prominent notice on our website,
Sending you an email, or
Sending a text message if you’ve opted in to SMS communications.

Your continued use of our websites or telehealth services after any update means you accept the revised Privacy Policy. We encourage you to review it periodically to stay informed about how we protect your information.

Consent to This Policy

By using our websites, telehealth platforms, or communication systems, you consent to the terms of this Privacy Policy, including our collection, use, and disclosure of information as described above. If you do not agree, please discontinue use of our services and contact us with any questions about your privacy choices.

13. Contact Information and Complaints

We welcome questions, feedback, or concerns about this Privacy Policy or our data practices.

Contact Us

If you’d like to reach our privacy team, please contact:

Med Card Services LLC
Attn: Privacy Officer
📧 Email: privacy@getcannacard.com
📍 Address: 339 E 3900 S, Suite 110, Salt Lake City, UT 84107, USA
🌐 Website: www.getcannacard.com

HIPAA Privacy Complaints

If you believe your privacy rights under HIPAA have been violated, you may file a complaint directly with us at the email above or with the U.S. Department of Health and Human Services, Office for Civil Rights (OCR).

You can learn more or submit a complaint at:
👉 https://www.hhs.gov/hipaa/filing-a-complaint

We will never retaliate against anyone for filing a complaint or raising a privacy concern.

14. Our Commitment to Your Privacy

Your trust means everything to us.

We understand that your personal and health information is private, and we treat it with the same care and respect we’d want for our own. Every process we design—from encrypted telehealth sessions to secure text messaging—is built around protecting your confidentiality.

We follow all applicable privacy and healthcare laws, including HIPAA, and continually update our practices to meet or exceed industry standards.

If you ever have questions about how your data is used, stored, or shared, we’re here to help. Reach out anytime at privacy@getcannacard.com.

Acknowledgment and Consent

By continuing to use our websites, telehealth platforms, or communication systems, you acknowledge that you have read and understood this Privacy Policy and consent to our collection, use, and disclosure of information as described herein. You also consent to receiving necessary communications related to your care, account, and services, in accordance with HIPAA and A2P 10DLC compliance requirements.

Thank you for trusting Med Card Services and our family of clinics — including Get Canna Card — with your care.