Privacy Policy

Introduction

Riverside Farm LLC ("Riverside Farm") operates as a Utah medical cannabis cultivator and brand. This Privacy Policy explains how we collect, use, disclose, and protect information when you visit riversidefarm.co, contact us, register for the patient portal, use pharmacy wholesale ordering or consignment tools, use facility visitor check-in, use authorized staff operations apps, or otherwise interact with our Services.

Riverside Farm sells medical cannabis products through licensed Utah pharmacies. We do not operate a retail dispensary on this website. Pharmacy partners handle patient purchases at their locations under separate policies.

We are generally not a HIPAA-covered entity for routine website, patient portal, pharmacy wholesale portal, visitor check-in, or staff operations app activities. We still apply strong administrative and technical safeguards, especially for Utah medical cannabis patient card numbers, patient account data, pharmacy compliance records, and facility visitor logs.

Information we collect

The information we collect depends on how you interact with us:

Patient portal users

• Name, email address, and account credentials.
• Utah medical cannabis patient card number and related verification details.
• Account status (pending, approved, or denied) and registration date.
• Strain votes, optional vote comments, and voting-cycle participation.
• Strain suggestions you submit (proposed strain name and description).
• Notification preferences (email, optional SMS, and categories such as strain updates, voting updates, and general news).
• Optional phone number if you enable SMS notifications.
• Communications you send us (email, forms, support requests).

Voting results shown on the Site are aggregated counts and do not publicly display your name or individual vote comments.

Pharmacy wholesale ordering users

• Business and contact information for licensed pharmacy accounts (pharmacy name, address, phone, and authorized user names and email addresses).
• Wholesale order details (products, quantities, pricing, discounts, delivery preferences or windows, additional notify emails, and order status).
• Pharmacy notify phone numbers used for operational delivery coordination.
• Regulatory and track-and-trace identifiers needed for lawful distribution (including MJ Platform facility or processing IDs associated with your pharmacy account).
• Staff sub-accounts created by a primary pharmacy account holder, including the sub-account holder’s name and email.
• Login timestamps, IP address, and browser user agent for pharmacy accounts (used for security and operational analytics; retention is configurable and old records are deleted automatically).
• Marketing asset download logs (which user downloaded which file, approximate time, and IP address) when you download brand or promotional assets from the pharmacy tools.

Pharmacy consignment & promotions users

Available only to participating pharmacy partners:

• Sales reports and uploads you submit (product sales, quantities, dates, and related POS or inventory export data).
• Inventory snapshots and facility-mapping information used to reconcile consignment stock.
• Promotion proposals, credit estimates, and related business correspondence.
• Credentials and connection settings you provide for authorized POS integrations (such as Dutchie API credentials) so we can retrieve sales or inventory data at your direction.
• QuickBooks-related mapping data (such as invoice numbers or sample flags tied to transfers) used for consignment settlement and reporting.
• Staff-uploaded audio used with OpenAI Whisper to generate draft invoice or consignment comments; transcription text may be stored with related records.
• Data retrieved from authorized third-party systems when you connect or authorize an integration.

Facility visitors

• Full name, age or age confirmation, email address, visit purpose, badge or escort information, and check-in and check-out times when you use facility visitor check-in.
• Tokens or identifiers used to complete checkout or send staff reminders related to your visit.

Authorized Riverside staff

Internal Ops, Facility, and related staff apps are limited to authorized Riverside employees and contractors:

• Account credentials and authentication factors, including passkeys (WebAuthn), time-based one-time passwords (TOTP), recovery codes, and pending two-factor authentication session cookies.
• Browser push subscription endpoints and related keys used to deliver operational notifications (orders, deliveries, visitor reminders, chemical spray alerts, and similar).
• Chemical or pesticide application log entries (applicator identity, product, location, times, and related safety information such as REI).
• Operational records needed to fulfill pharmacy orders, deliveries, and facility workflows.

Website visitors

• Information you submit through contact forms, email, or other voluntary communications.
• Age-gate verification status stored in a cookie (and/or browser session storage) after you confirm you meet the minimum age required to view the Site.
• Optional device geolocation when you use the pharmacy locator “near me” or similar features (location is requested by your browser and used to show nearby pharmacies; we do not require geolocation to browse the Site).
• We do not receive your in-store pharmacy purchase history through this website unless you separately provide it to us or law/regulation requires a specific report.

Information collected automatically

• IP address, browser type, device identifiers, and pages viewed.
• Log data for security, fraud prevention, rate limiting, and troubleshooting.
• Cookie and similar technologies data (see Cookies & Tracking below).
• IP address and request metadata sent to third-party services that load map tiles, geocoding, or web fonts in your browser (such as Mapbox, OpenStreetMap-related services, and Google Fonts).

How we use your information

We use information to:

• Operate and improve our website, age gate, pharmacy locator, patient portal, pharmacy ordering tools, consignment features, facility visitor check-in, and staff operations apps.
• Verify Utah medical cannabis patient eligibility before approving portal accounts.
• Provide patient portal features (catalog, voting, results, strain suggestions, grow/batch tracking, dashboard, and notifications).
• Send optional email or SMS updates about voting, strains, and grow milestones according to your notification preferences.
• Process and fulfill wholesale pharmacy orders, manage delivery preferences and notify contacts, manage accounts, and communicate about orders.
• Sync order, inventory, and payment-status metadata with MJ Platform or other track-and-trace systems as needed for lawful distribution.
• Generate consignment reports, reconcile inventory, map invoices (including QuickBooks mappings), calculate promotions and credits, and support pharmacy partner analytics.
• Retrieve sales or inventory data from Dutchie or similar POS systems when you authorize a connection.
• Transcribe staff audio via OpenAI Whisper into draft comments for consignment or invoice workflows.
• Log marketing asset downloads for security, license compliance, and internal analytics.
• Maintain facility visitor logs for safety, security, and compliance; notify staff about open visits when push is enabled.
• Authenticate staff with passkeys, TOTP, or push approval; deliver operational push notifications; and maintain chemical application and facility records.
• Show map-based pharmacy locations and optional nearby results when you grant location permission.
• Enforce age verification for Site access where the age gate is enabled.
• Monitor portal usage for security, support, and internal business analytics (aggregated where practical).
• Communicate with you about your account (approvals, security, service messages, and operational notices).
• Comply with Utah medical cannabis laws, Utah Admin. Code R384-201 and related rules, and other legal obligations.
• Protect the security and integrity of our systems and users.

We do not sell your personal information. We do not use patient card numbers or patient portal activity for unrelated third-party marketing.

Sharing of information

We may share information in these situations:

• Service providers: hosting, email, maps, fonts, security, backups, analytics, AI transcription, POS/accounting integrations, and IT vendors under confidentiality or contractual obligations (see Service providers below).
• Licensed pharmacies and supply chain partners: as needed for lawful distribution, order fulfillment, consignment settlement, compliance, recalls, or product safety—not for unrelated marketing of your patient card number.
• Authorized integrations: MJ Platform track-and-trace, Dutchie POS, QuickBooks mappings, or other inventory platforms when you or your pharmacy authorize a connection for reporting or compliance.
• Browser push services: when staff subscribe to push notifications, subscription endpoints are handled by the browser’s push service to deliver messages.
• Legal and regulatory requirements: Utah Department of Health and Human Services, law enforcement, courts, or auditors when required by law or valid legal process.
• Business transfers: merger, acquisition, or asset sale, with notice where required.
• With your direction: when you ask us to or consent to a specific disclosure.

Service providers

Depending on which Services you use, we may rely on the following categories of providers (names may change as we update tooling):

• Email delivery: Brevo (Sendinblue) or similar transactional email providers to send account, order, and operational messages.
• Maps & geocoding: Mapbox and/or OpenStreetMap-related services (including Nominatim or Leaflet-based tooling) for pharmacy locator tiles, geocoding, and related map features.
• Fonts: Google Fonts loaded in the browser for Site typography.
• Track-and-trace: MJ Platform and related regulatory systems for inventory, sales orders, and compliance metadata.
• POS / inventory: Dutchie (or other POS platforms you authorize) for consignment sales and inventory sync.
• Accounting mapping: QuickBooks-related invoice mapping used in consignment and settlement workflows.
• AI transcription: OpenAI Whisper for optional staff audio-to-text on consignment or invoice comments.
• Browser push: Web Push / VAPID delivery through the browser vendor’s push service for staff operational alerts.
• Hosting & backups: Website hosting, infrastructure, and backup providers that process Site data under our instructions.

These providers process information only as needed to provide their services to us. Their own privacy practices may also apply when your browser connects to them directly (for example, map tiles or fonts).

Data security & retention

We use administrative, technical, and physical safeguards appropriate to the sensitivity of the data we hold, including HTTPS with HSTS where configured, Secure / HttpOnly / SameSite cookie attributes on authentication and security cookies, access controls for staff, rate limiting on login and sensitive endpoints, and two-factor authentication or passkeys for authorized Riverside staff. We do not publish public user directories. No method of transmission or storage is 100% secure.

We retain information while your account is active and as needed for compliance, consignment settlement, order records, facility visitor logs, dispute resolution, and enforcement of our agreements. Pharmacy login activity is retained for a limited period (typically up to twelve months unless configured otherwise) and then deleted automatically. Marketing asset download logs and staff authentication artifacts are retained as needed for security and operations. When you request deletion, we will remove or anonymize data where we are not legally required to retain it.

Your privacy rights

Depending on applicable law and your relationship with us (patient, pharmacy contact, facility visitor, staff member, or website visitor), you may request:

• Access to personal information we hold about you.
• Correction of inaccurate information.
• Deletion of information you provided, subject to legal exceptions.
• A portable copy of certain information you previously provided.

Utah residents may also exercise rights under the Utah Consumer Privacy Act (UCPA), including opting out of sale (we do not sell data) and certain targeted advertising. Submit requests to info@riversidefarm.co. We may need to verify your identity before responding.

Cookies & tracking

We use cookies and similar technologies to keep you signed in, remember preferences, measure site performance, and protect against abuse on our website, patient portal, pharmacy tools, and staff apps. You can control cookies through your browser settings. Disabling cookies may prevent login, age verification persistence, or portal features from working.

• Age gate: a verification cookie (and/or session storage) records that you confirmed you meet the Site’s minimum age so the gate does not reappear on every visit.
• Authentication: session and login cookies keep patients, pharmacy users, and staff signed in; staff two-factor flows may use a short-lived pending-authentication cookie.
• Security: cookies and related signals help prevent abuse, support CSRF/nonce checks, and maintain secure sessions (including Secure, HttpOnly, and SameSite attributes where applied).

Pharmacy portal login activity may be logged separately for security and operational analytics as described above. We do not knowingly use cookies to sell personal information.

Children’s privacy

Our Services are directed to Utah medical cannabis patients who meet minimum age requirements under state law, and to adult website visitors subject to our age gate. We do not knowingly collect personal information from children who are not eligible for a medical cannabis patient card or who fail the age gate. If you believe we have collected information from an ineligible minor, contact us and we will delete it promptly.

Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top reflects the latest version. Material changes may be noted on the Site. Continued use after changes take effect means you accept the updated Policy.

Utah compliance notes

Utah regulates medical cannabis under the Utah Medical Cannabis Act and rules such as Utah Admin. Code R384-201. Consistent with those frameworks we:

• Support medical use only—not recreational use.
• Verify patient card status before granting portal access.
• Limit pharmacy and patient data use to lawful cultivation, distribution, consignment settlement, patient engagement, facility safety, and compliance purposes.
• Use track-and-trace and pharmacy partner systems only as needed for regulated operations.
• Honor applicable UCPA rights for Utah consumers.
• Apply voluntary best practices for patient-related and visitor data even when HIPAA does not apply to a given activity.

Contact us

Questions about this Privacy Policy or your data: info@riversidefarm.co

Riverside Farm LLC · Utah, United States