DataBud - Cannabis Product Intelligence Platform

1. Who We Are

DataBud is operated by Raindrop, LLC, a company registered in Puerto Rico, doing business as DataBud. References to "we," "us," and "DataBud" in this policy mean Raindrop, LLC. We are the entity responsible for the consumer health data described in this policy.

Contact for consumer health data inquiries: privacy@databud.ai

2. What We Mean by "Consumer Health Data"

"Consumer health data" means personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. For DataBud specifically, the consumer health data we collect includes:

Self-reported feedback you submit after using a cannabis product, including mind, body, and mood ratings, intensity, timing, and other experience descriptors;
Optional, user-controlled data you choose to import from health and fitness applications or wearable devices (for example, Apple Health), only when you have separately enabled that integration;
Inferences we generate from the above to provide personalized, preference-based informational guidance (for example, "you tended to report better sleep after products with X chemistry"); and
The product chemistry data linked to your reports through the QR scan, only to the extent that data is associated with you in our systems.

Information about your cannabis purchases is collected and held by the licensed cannabis operator that sold you the product, not by DataBud. We do not receive your purchase records.

3. How We Collect Consumer Health Data

We collect consumer health data only:

Directly from you, when you scan a QR code on a cannabis product and submit feedback through the DataBud platform;
From you, through any optional account features you choose to use; and
From third-party sources you have separately authorized (such as Apple Health), only when you actively enable the connection.

We do not buy consumer health data from data brokers, and we do not infer consumer health data from third-party tracking or advertising data.

4. Your Opt-In Consent

We will not collect consumer health data from you without your separate, opt-in consent. Acceptance of our DataBud Terms and Conditions or DataBud Privacy Policy alone is not consent to collect consumer health data.

Before you submit consumer health data, we will present you with a specific consent prompt that describes (a) the categories of consumer health data we will collect, (b) the purposes of collection, and (c) the categories of third parties (if any) with whom the data may be shared. Your consent must be given through a clear affirmative action; we do not rely on pre-checked boxes, browse-wrap, or bundled agreements.

You may withdraw your consent at any time. Withdrawing consent stops further collection but does not by itself delete data we have already collected; to request deletion, see Section 7 below.

5. How We Use Your Consumer Health Data

We use consumer health data only for purposes you have consented to, which include:

Providing the DataBud Services to you, including generating personalized informational guidance based on your own history;
Improving the DataBud platform and its underlying models, using only de-identified or aggregated data after the de-identification standards described in Section 6;
Performing internal research and product development, again using only de-identified or aggregated data;
Complying with legal obligations, responding to lawful requests from public authorities, or protecting the safety of any person; and
Other purposes you separately consent to in advance.

We do not use consumer health data to make decisions that produce legal or similarly significant effects on you. We do not use consumer health data for targeted advertising, and we do not allow third parties to use consumer health data collected through DataBud for their own targeted advertising.

6. How We Share Consumer Health Data

We do not sell your consumer health data. Under RCW 19.373, the sale of consumer health data requires a separate, written, signed authorization from the consumer. We do not seek that authorization and do not currently sell consumer health data.

We share consumer health data only as follows:

Service Providers (Processors): With service providers (such as cloud hosting, analytics infrastructure, and customer support tools) that process the data on our behalf and only for the purposes for which we engage them. These providers are bound by written contracts that prohibit them from using the data for their own purposes;
De-Identified or Aggregated Insights with Licensed Cannabis Operators: We may share de-identified, aggregated insights derived from consumer health data with licensed cannabis operators (for example, "users who reported X also reported Y"). Before sharing, the data is de-identified using technical and organizational safeguards reasonably designed to ensure it cannot be used to identify you, and the recipient is contractually prohibited from attempting to re-identify it;
Legal Compliance: When we believe in good faith that disclosure is required by law, regulation, legal process, or enforceable governmental request, or is necessary to protect the safety of any person or the rights of DataBud;
Business Transfers, with a Carve-Out: In connection with a merger, acquisition, financing, or sale of assets, business records may transfer to the acquirer. However, we will not transfer identifiable consumer health data as part of such a transaction without first obtaining your separate signed authorization where required by RCW 19.373 or comparable law, or, where allowed by applicable law, providing notice and an opportunity to delete the data before transfer; and
With Your Consent: In any other situation where we have your separate, specific, opt-in consent.

We do not share identifiable consumer health data with advertising networks. We do not allow advertising pixels, session-replay tools, or behavioral retargeting tags on pages where consumer health data is collected or displayed.

Licensed cannabis operators never receive identifiable consumer health data. Operators that participate in DataBud receive only de-identified, aggregated insights, and are contractually prohibited from attempting to re-identify any individual or to combine the insights they receive with other data for that purpose. This commitment is unconditional.

7. Your Rights

If you are a Washington resident, or your consumer health data was collected in Washington, you have the following rights under RCW 19.373:

Right to Confirm and Access: You may confirm whether we are collecting, sharing, or selling your consumer health data, and request a list of all third parties with whom we have shared your consumer health data, including an active email address or other online means of contact for each.
Right to Withdraw Consent: You may withdraw consent for the collection and sharing of your consumer health data at any time;
Right to Delete: You may request deletion of your consumer health data. We will honor the request and pass it along to our service providers and any affiliates or other entities with whom we have shared the data.

Residents of other states may have similar rights under their state's laws (for example, the Connecticut Data Privacy Act and the Nevada Health Privacy Law). We will honor verifiable requests under those laws to the extent they apply.

To exercise any right, contact us at privacy@databud.ai with your request and a means by which we can verify your identity. We will respond within forty-five (45) days, or longer where extended response time is permitted by law (with notice to you). We will not charge a fee for verifiable consumer requests unless the request is manifestly unfounded or excessive.

We will not retaliate against you for exercising any right under this policy.

8. Right to Appeal

If we deny your request, you may appeal our decision by contacting privacy@databud.ai with the word "Appeal" in the subject line and explaining the basis for your appeal. We will respond to your appeal within forty-five (45) days. If we deny the appeal, we will provide you with information on how to file a complaint with the Washington State Attorney General (atg.wa.gov) or, where applicable, your state's attorney general.

9. Data Retention

We retain consumer health data only as long as reasonably necessary to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. Specifically:

Active account data: Retained for as long as your account is active, plus a reasonable wind-down period after closure or inactivity;
Identifiable feedback records: Retained for the duration of your active use of the Services, then de-identified or deleted within a reasonable period after account closure unless retention is required by law;
De-identified, aggregated insights: May be retained indefinitely, since they are no longer linked or reasonably linkable to you; and
Records related to legal claims, regulatory inquiries, or sweepstakes administration: Retained for the period required by applicable law (for sweepstakes, generally not less than four (4) years).

If you request deletion under Section 7, we will complete deletion within thirty (30) days, except where law requires us to retain specific records.

10. Security

We implement reasonable administrative, technical, and physical safeguards designed to protect consumer health data against unauthorized access, disclosure, alteration, and destruction. These include encryption in transit, access controls, and contractual restrictions on service providers. No method of transmission or storage is completely secure; however, we work to apply current industry-standard practices appropriate for the sensitivity of the data.

We will notify affected individuals and regulators of any data security incident involving consumer health data in accordance with applicable law.

11. International Transfers

Raindrop, LLC is based in Puerto Rico, and we use service providers located in the United States and elsewhere. By using the Services, you understand that consumer health data may be transferred to, stored in, and processed in the United States, Puerto Rico, and other jurisdictions. We use contractual and technical safeguards to ensure that transferred data remains protected at a level consistent with this policy.

12. No Geofencing of Health Care Facilities

Consistent with RCW 19.373.040, DataBud does not implement geofences around any in-person health care service location for the purpose of identifying consumers seeking health services, tracking their movements, or sending them advertising or promotional content related to consumer health data.

13. Children

DataBud is not directed to and may not be used by minors. We do not knowingly collect consumer health data from anyone below the legal cannabis consumption age in their jurisdiction (and in no event below 21 years of age in the United States). If we learn that we have inadvertently collected consumer health data from such a person, we will delete it.

14. Governing Law and Jurisdiction

This policy is governed by the laws of the Commonwealth of Puerto Rico, without regard to its conflict of law principles. Except as set forth in the carve-out below, claims arising from this policy will be brought exclusively in the courts located in San Juan, Puerto Rico.

Carve-Out for Washington Residents

Notwithstanding the foregoing, if you are a Washington resident or your consumer health data was collected in Washington, you may bring claims arising under Washington law (including the Washington My Health My Data Act, RCW Chapter 19.373, and the Washington Consumer Protection Act, RCW Chapter 19.86) in a Washington state or federal court of competent jurisdiction, and those claims will be governed by Washington law. Nothing in this policy waives any non-waivable right under Washington law.

15. Changes to This Policy

We may update this policy from time to time. When we make material changes, we will provide notice through the Services or by other reasonable means and will update the "Last Updated" date above. Material changes affecting how we treat previously collected consumer health data will not be applied retroactively without your separate consent or as required by law.

16. Contact Us

To exercise your rights, ask questions about this policy, or report a concern, contact:

Raindrop, LLC (dba DataBud)

Attn: Privacy Officer

151 Calle de San Francisco

San Juan, PR 00901

privacy@databud.ai

(844) 328-2283

Washington residents may also file a complaint with the Washington State Attorney General at atg.wa.gov.