Privacy Policy

This Policy applies to:

• Organization owners — the licensed business entity that registers an iCannaWorld workspace.
• Employees and team members — individuals added to an organization's workspace by the owner.
• Patients / customers — individuals whose records are entered into the platform by a dispensary operator.

iCannaWorld acts as a data processor for patient and employee records on behalf of the licensed business (the data controller). The business is responsible for ensuring it has the legal basis to collect and store those records under applicable law.

2a. Account and Organization Data

When you register an organization, we collect:

• Business name, address, and business type
• Cannabis and business licence numbers and document URLs
• Owner's name, email address, and password (hashed)
• Billing and subscription information (processed by our payment provider)

2b. Employee and Team Data

• Full name, email address, assigned role, and location
• Login timestamps and session metadata
• Actions performed within the platform (audit log)

2c. Operational / Business Data

Data entered by your team in the course of normal operations:

• Dispensary: product catalogue, inventory lots, sales transactions, supplier records, transfers
• Farm / Cultivator: grow rooms, plant batches, harvest records, storage and tag balances, farm sales
• Processor: raw material lots, production batches, lab results, finished goods, labels, wholesale orders
• Exchange listings, purchase orders, and connection records between organisations

2d. Patient / Customer Records

Dispensaries may enter medical patient records including:

• Patient name, phone number, and email address
• Government-issued ID URL and medical recommendation document URL
• Recommendation expiry date and purchase history

These records are stored on behalf of and at the direction of the dispensary operator. Patients should contact the dispensary directly regarding their personal data.

2e. Technical and Usage Data

• IP address, browser type, and device identifiers
• Pages visited, feature interactions, and error logs
• Authentication tokens and session cookies

• Provide, operate, and maintain the iCanna Core platform
• Authenticate users and enforce role-based access controls
• Generate reports, inventory snapshots, and compliance documents
• Facilitate exchange connections and purchase orders between licensed operators
• Send transactional emails (invitations, password resets)
• Maintain audit trails required for regulatory compliance
• Detect fraud, security incidents, and unauthorized access
• Improve the platform through aggregated, anonymized usage analytics

We do not sell your personal data to third parties. We do not use patient or business data for advertising purposes.

We process personal data on the following legal bases:

• Contract performance — to deliver the services you have subscribed to
• Legitimate interests — security monitoring, fraud prevention, platform improvement
• Legal obligation — audit logs and records required by applicable cannabis regulations
• Consent — where you have explicitly provided it (e.g. marketing communications)

We share data with the following categories of trusted sub-processors:

• Supabase — database hosting, authentication, and real-time infrastructure
• Vercel — application hosting and edge delivery
• Payment processor — subscription billing (credit card data is never stored by iCannaWorld)

We may also disclose data when required by law, court order, or regulatory authority, including the Cannabis Licensing Authority (CLA) or other applicable bodies.

Data shared between licensed operators through the iCanna Exchange (purchase orders, connection requests) is shared only with the specific counterparty organization and only the information necessary to facilitate the transaction.

• Active accounts: data is retained for as long as the organization subscription is active
• After cancellation: data is retained for 90 days to allow recovery, then permanently deleted
• Audit logs: retained for a minimum of 3 years in accordance with regulatory requirements
• Compliance reports: retained for a minimum of 5 years

We implement industry-standard measures to protect your data:

• All data is encrypted in transit (TLS 1.2+) and at rest (AES-256)
• Row Level Security (RLS) enforced at the database level — organizations cannot access each other's data
• Role-based access controls within each organization
• Audit logging of all sensitive actions
• Passwords are hashed using industry-standard algorithms; we never store plaintext passwords

No method of transmission over the internet or electronic storage is 100% secure. In the event of a data breach that affects your personal data, we will notify affected users as required by applicable law.

iCanna Core uses only essential cookies required to operate the platform:

• Authentication cookies — to maintain your logged-in session
• CSRF tokens — to protect against cross-site request forgery

We do not use advertising cookies, third-party tracking pixels, or behavioural profiling cookies.

Depending on your jurisdiction, you may have the right to:

• Access — request a copy of personal data we hold about you
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of personal data, subject to legal retention obligations
• Portability — receive your data in a machine-readable format
• Objection — object to processing based on legitimate interests
• Withdrawal of consent — where processing is based on consent

To exercise any of these rights, contact us at privacy@icannaworld.com. We will respond within 30 days.

Patient records held by a dispensary are controlled by that dispensary. Patients should contact their dispensary directly for access, correction, or deletion requests.

iCanna Core is a business platform intended for licensed commercial operators and their employees. It is not directed at or intended for use by individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected such data, contact us immediately at privacy@icannaworld.com.

iCannaWorld operates primarily in Jamaica and the wider Caribbean. Your data may be stored and processed in data centres located in the United States (Supabase and Vercel infrastructure). We ensure appropriate safeguards are in place for any cross-border transfers in accordance with applicable data protection law.

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page and, for material changes, notify active organization owners by email. Continued use of the platform after changes are posted constitutes acceptance of the updated Policy.

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact: