You must be at least 21 years old to enter this site.
New Mexico law requires you to be 21 years of age or older to purchase cannabis products. By clicking “Yes, I’m 21+”, you acknowledge you are 21+ and agree to our Terms of Service, Privacy Policy, and Cookie Policy. Cannabis products are for use only by adults 21 and older. Keep out of reach of children.
Vireo Health, Inc. Privacy Notice
Last updated: 09.14.26
This privacy notice (“Notice”) is designed to help you understand how we collect information about you, how we use it, how we share it, and how you can exercise your privacy rights with respect to that information.
Table of Contents
What This Notice Covers
What Personal Information We Collect
How We Use Your Personal Information
How We Use Cookies and Similar Technologies
Disclosure of Your Personal Information
Additional Disclosures Related to Collection, Use, and Disclosure of Personal Information for Residents of certain U.S. States
Data Retention
Your Privacy Rights
Exercising Your Privacy Rights
Privacy Rights under Financial and Insurance Privacy Laws
Data Security
Minors and Children
Third-Party Links
Changes to this Notice
Additional Information for Residents of the UK and EU
Contact Details
To submit a privacy rights request, contact us using one of the methods listed in the “Contact Details” section below.
What This Notice Covers
This Notice describes how Vireo Health, Inc. and Vireo Health, Inc. affiliates that provide products and services directly to consumers, including, but not limited to, Vireo Growth, Deep Roots Harvest, Proper Brands, WholesomeCo, Eaze, Everest, EveryDay Weed, Green Goods, Green Dragon, LivWell, R. Greenleaf, Schwazze, Standing Akimbo, Star Buds, and any Vireo Health subsidiaries that do not otherwise publish a separate privacy notice (collectively, “Vireo,” “we,” “us,” or “our”), collect, use, and disclose your Personal Information. That includes Personal Information we collect through or in connection with:
This Notice applies to all Sites operated by Vireo affiliates engaged in the cultivation, manufacture, distribution, dispensing, or delivery of cannabis products in the United States. Vireo and its affiliates only provide cannabis products in the United States.
This Notice does not apply to information collected or controlled by a third party, including any third-party apps or websites (including third-party websites you may access through our Sites or Mobile Apps. We encourage you to review the privacy policies of any business you interact with.
This Notice also does not apply to workforce members, such as job applicants, employees, retirees, or contractors.
Our privacy practices may vary among the jurisdictions in which we operate to reflect local practices and legal requirements, which we may explain through jurisdiction-specific addenda to this Notice. In the event of any conflict or inconsistency between the jurisdiction-specific addendum that applies to you and the main body of this Notice, the terms of such addendum will govern and prevail.
Note Regarding HIPAA: Vireo is not a “covered entity” or “business associate” as defined under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). While we collect health-related information in connection with state medical cannabis programs, our handling of that information is governed by this Notice and applicable state privacy and medical cannabis confidentiality laws, not HIPAA. However, we are committed to protecting your health information with safeguards that meet or exceed those required by applicable law.
What Personal Information We Collect
We collect a variety of Personal Information in connection with offering our Sites and our products, including so we can personalize your experience and focus on what interests you most. “Personal Information” generally means any information that identifies, relates to, describes, is reasonably capable of being associated with you or could reasonably be linked with you, directly or indirectly. Personal Information does not include publicly available information or information that is deidentified or anonymized consistent with applicable privacy laws.
Depending on how you interact with our Sites and Mobile Apps and, in some instances, with our Partners, we may collect the following categories of personal information about you:
How We Collect Personal Information
Directly from You
We collect Personal Information directly from your use or interaction with our Sites, the Mobile Apps, or through services operated by our Partners, and information you directly provide to us. This may include:
Automatically from Your Use of the Sites or Mobile Apps
When you download, access, or use our Sites or Mobile Apps, we automatically collect certain Personal Information from your device or browser. We may also collect certain Personal Information about you through your use of services provided by our Partners. This may include information such as identifiers, device and location information, usage information, transaction and account information, or call tracking information as described above. This includes information collected through technologies such as cookies, pixels, log files, web beacons, and other storage technologies (collectively, “Cookies and Similar Technologies”).
Automatically from Cookies and Similar Technologies
We and our business partners and service providers, such as analytics providers and social media platforms, may also use Cookies and Similar Technologies to collect information about your activities over time and across third-party websites, applications, and other online services (sometimes referred to as “behavioral tracking”). For example, we may track what pages you view, or information you enter into the website. For more details about how we use these technologies and your choices, please see the “How We Use Cookies and Similar Technologies” section below.
From Non-Affiliated Third Parties
We may also obtain Personal Information about you from third-party sources. These sources can include our service providers, business partners, analytics providers, social media platforms, data brokers, or publicly available sources.
Information We Generate
Based on the information we collect, we or our Partners may also generate additional insights or inferences about you, such as inferences regarding your preferences, interests, predispositions, and sentiments.
How We Use Your Personal Information
We use the information we collect about you, or that you provide to us, including Personal Information, for the following purposes:
We have grown in part through acquisitions of other companies and brands. If you were a customer, patient, or user of an acquired business prior to its acquisition by or integration with us, this section describes how we handle personal information we obtained as a result of that acquisition ("Legacy Data"). We will use and disclose your Legacy Data consistent with the privacy notice or policy in effect at the acquired business or brand at the time the Legacy Data was originally collected from you (the "Original Notice"). We may integrate Legacy Data into our systems, combine it with other personal information we hold about you, and apply our data security, retention, and access practices described elsewhere in this Notice to that data. Integration of Legacy Data into our systems does not, by itself, expand the purposes for which that data may be used beyond what was disclosed in the original notice you received at the time of collection of your data, if applicable, except as permitted by applicable law or as separately disclosed and consented to.
If we intend to use Legacy Data for a materially different purpose than disclosed in the original notice (for example, to support marketing across other Vireo brands, to include it in a group-wide loyalty program, or to share it with a broader set of Vireo affiliates than previously disclosed) we will, to the extent required by applicable law, provide notice and will honor any applicable opt-out or consent requirements under the law of your state of residence.
How We Use Cookies and Similar Technologies
When you interact with our Sites or Mobile Apps, we may use a variety of technologies to automatically collect information about you. These include:
These Cookies and Similar Technologies may be deployed by us directly, our business partners, or third-party analytics or advertising providers, either on our behalf or for their own purposes. They may be used to deliver information to you or about you and to connect information about you across different sources, websites, devices, and applications.
The Cookies we use on our Sites generally fall into four categories:
You can control how certain Cookies function on our Sites by using our “Manage Cookies” tool, available at any time through the link in the footer of our Sites.
With this tool, you can:
To learn more about cookies generally, visit www.allaboutcookies.org.
You can also learn more and opt-out of tracking by some of our third-party partners by visiting:
iOS and Android operating systems also provide options to limit tracking or reset your advertising identifications.
Your email provider may also have settings which allow you to prevent the automatic download of images, including web beacons, which prevents the automatic connection to the web servers that host those images.
In addition, depending on your state of residence, you may have the right to opt out of our use of cookies and tracking technologies for targeted advertising or from the “sale” or “sharing” of your Personal Information for purposes of cross-context behavioral advertising under applicable U.S. state privacy laws. For more details, please see the “Your Privacy Rights” and “Exercising Your Privacy Rights” sections below.
We have implemented a cookie preference center to ensure your cookie preferences are honored. We have tools in place to detect and honor requests made using the Global Privacy Control (“GPC”) signal as requests to opt-out of the sale or sharing of Personal Information to the extent required by applicable law. The GPC sends signals to the websites you visit indicating your choice to opt-out from certain types of data processing. We endeavor to honor these requests with respect to any Personal Information connected to the GPC opt-out request based on the information made available by GPC. We may not be able to tie a GPC request to all Personal Information we have about you. If you wish to exercise your rights to opt out of the sale or sharing of your Personal Information under applicable state privacy laws, we recommend configuring your browser to send an opt-out signal via GPC, submitting your cookie preferences via our cookie preference center, and by submitting a request using one of the methods outlined in the “Exercising Your Privacy Rights” section of the notice below. We do not currently support the capability to respond to web browser “do not track” signals.
For more information about your rights, please see the “Your Privacy Rights” section below.
Disclosure of Your Personal Information
We may share your Personal Information with people and businesses that help operate and carry out our business, as well as when we are otherwise legally permitted or required to do so. Note, patient and caregiver information submitted through a state medical cannabis registry is also subject to the confidentiality requirements of the applicable state's medical cannabis program statute. Where those requirements are more protective than this Notice, or impose restrictions on disclosure beyond what is described here, the state program's requirements control.
We share Personal Information with the following categories of recipients where permitted by law:
Additional Disclosures Related to Collection, Use, and Disclosure of Personal Information for Residents of certain U.S. States
The Personal Information we collect about you includes information within the below categories of data. Note that the “category” of data listed below refers to the category of Personal Information as defined under California law and represents the categories of Personal Information that we have collected, and how it has been shared, over the past 12 months. Inclusion of a category in the list below indicates only that we may collect some information within that category. We do not necessarily collect all information listed in a particular category, nor do we necessarily collect all categories of information for all individuals. While the categories are as defined under California law, the disclosures below also apply to residents of other states as well.
We have disclosed Personal Information in each of the categories listed below to our affiliates and subsidiaries, Partners, service providers, and other third parties, as well as to government entities where required, for our business purposes within the past 12 months. Please note that we have not necessarily disclosed every type of information listed in a given category. In addition, we have shared Internet or other electronic network activity information (as described below) with advertising and marketing partners for purposes of targeted advertising.
Category
Source
Purpose
Identifiers such as real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol (“IP”) address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.
Other information about you or information that identifies, relates to, describes, or is capable of being associated with you, including, but not limited to, name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health information.
Characteristics of protected classifications under California or federal law, such as familial status, disability, sex, national origin, religion, color, race, sexual orientation, gender identity and gender expression, marital status, veteran status, medical condition, ancestry, source of income, age, or genetic information).
Commercial information such as records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding your interaction with an internet website application, or advertisement.
Automatically when you interact with our Sites or Mobile Apps.
Geolocation Data
Automatically when you interact with our Sites or Mobile Apps.
Sensory Data, including audio, electronic, visual, thermal, olfactory, or similar information.
Inferences (defined as “the derivation of information, data, assumptions or conclusions from facts, evidence or another source of information or data”) drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, predispositions, behaviour, attitudes, intelligence, abilities, and aptitudes.
In addition to the categories of Personal Information above, we also collect the following categories of Sensitive Personal Information to the extent permissible under applicable law:
Category
Source
Purpose for Collection
Your Social Security, driver's license, state identification card, or passport number.
Directly from you when you provide it to us.
Your account log-in, financial account, debit card, or debit card number in combination with any required security or access code, password, or credentials allowing access to an account.
Directly from you when you provide it to us.
Your precise geolocation.
Automatically when you interact with our services or the Site.
Personal information collected and analyzed concerning your health.
Directly from you when you provide it to us; from state medical cannabis registries or healthcare providers at your direction.
Sale of Personal Information and Sharing for Purposes of Cross-Context Behavioral Advertising (for Residents of California and Certain Other US States)
We do not sell or share your Personal Information, however, some of the ways that we disclose Personal Information for advertising, including online and offline Personal Information, to third parties constitutes a “sale” of Personal Information or “sharing” for cross context behavioral advertising under applicable privacy law. Cross-context behavioral advertising, or “targeted advertising”, is advertising customized based on predictions generated over time from your visits across different websites, devices, and mobile applications. In the preceding 12 months, we have shared the following categories of Personal Information identified in the chart above for advertising purposes:
We do not share the following categories of Personal Information for purposes of cross-context behavioral advertising: Sensitive Personal Information, including health information, medical cannabis patient status, qualifying conditions, or information derived from state medical cannabis registries. We do not sell or share information that would identify you as a medical cannabis patient to advertising networks or other third parties for marketing purposes.
For information on Cookies and Similar Technologies and how to modify your Cookie Settings, including how to opt-out, please see section on “How We Use Cookies and Similar Technologies” and “Your Privacy Rights.”
For more information on your right to opt out of the sale of your Personal Information or sharing for purposes of targeted advertising, please see the “Your Privacy Rights” section below. For more information on how to exercise your privacy rights, please see the “Exercising Your Privacy Rights” section below.
Notice of Financial Incentive
We offer financial incentives in the form of promotions, Reward Programs, and our Referral Program (collectively, the “Promotional Offer”) to consumers in exchange for voluntarily sharing certain Personal Information with us through our Sites or Mobile Apps. We offer Promotional Offers to understand and improve your satisfaction, experience, and relationship with us. You may opt-in to the Promotional Offers by sharing a referral code, signing up via a referral code, creating a Rewards Program profile, or as otherwise specified on our Sites. When you enter a Promotional Offer, we may collect Personal Information about you, including your name, phone number, email address, and birthday.
You may withdraw from participating in a Promotional Offer at any time as defined under the terms of the relevant Promotional Offer or, if undefined, through your Alpine Wallet or by emailing us at privacy@vireohealth.com. Requests must include “Promotional Offer Opt-Out Request” in the email subject line and include your name, email address and telephone number associated with your submission to the Promotional Offer. Incomplete information will delay or possibly prevent our ability to honor your request. Please note that if you withdraw from a Promotional Offer, or submit a request to delete your Personal Information, your participation in that Promotional Offer will be terminated, which means, generally, that you will no longer be eligible for the benefits described in each such Promotional Offer, subject to the applicable Promotional Offer terms.
We do not generally assign specific monetary or other value to the Personal Information you submit and our Promotional Offers change continually. In conducting Promotional Offers, we assess that the value of the Personal Information collected and used under each Promotional Offer is reasonably equivalent to the total value of the costs of conducting each Promotional Offer and the benefits or rewards provided to winners in each such Promotional Offers, based upon a practical and good-faith effort to assess on an aggregate basis for all collected information: (1) the type of Personal Information collected, (2) the use of such information by us in connection with our marketing activities, and (3) the number of individuals enrolled in respective Promotional Offers. These values can change over time. We reserve the right to add financial incentives to this Notice of Financial Incentives or to terminate the Promotional Offer at any time at our sole discretion.
Data Retention
Except as otherwise permitted or required by applicable law, we retain Personal Information in the categories set forth above only for as long as we have a legitimate business need to provide our services to consumers and our Partners.
To determine the appropriate retention period, we consider various criteria, including applicable law, whether the Personal Information continues to be necessary to provide our services; the amount, nature, and sensitivity of the Personal Information; the potential risk of harm to consumers from unauthorized use or disclosure; and the purposes for which we collect the Personal Information.
We continually review and enhance our retention practices in order to protect consumers while providing our services.
Your Privacy Rights
Depending on your state of residency, and the type of data collected, you may have rights with respect to your Personal Information, subject to certain exemptions provided by law. We may choose to extend these rights to you even if we are not required to under applicable law.
We will not discriminate or retaliate against you for exercising any of the above rights.
Data solely retained for data backup purposes is principally excluded from these rights until it is restored to an active system or next accessed or used for a sale, disclosure, or commercial purpose. These rights also do not apply to pseudonymous data if the information necessary to identify the individual is kept separately and is subject to controls that prevent access to the information. Pseudonymous data is Personal Information that can no longer be attributed to a specific individual without the use of additional information, if the additional information is kept separately and is subject measures to ensure that Personal Information is not attributed to the specific individual.
We may retain and are unable to delete certain personal information where required by state cannabis regulatory or track-and-trace reporting obligations, notwithstanding a deletion request.
Exercising Your Privacy Rights
To submit a privacy rights request, submit a request at the link below or contact us using one of the methods listed in the “Contact Details” section below.
If you provided your minor child’s personal information while acting as a registered caregiver, you may subject a privacy rights request on behalf of your minor child.
You also may designate an authorized agent to make a request on your behalf. If you are submitting a request through an authorized agent, the authorized agent must provide us with your signed written permission stating that the agent is authorized to make the request on your behalf. Alternatively, your authorized agent may provide evidence of having power of attorney or acting as a conservator for you. We may also request that any authorized agents verify their identity and, where permitted by law, may reach out to you directly to confirm that you have provided the agent with your permission to submit the request on your behalf.
When you exercise these rights and submit a request to us, we may verify your identity where required by law by asking you for the following pieces of information: your relationship with us, first and last name, email address, telephone number, and postal address.
We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you. Making a verifiable consumer request does not require you to create an account with us. We will use the Personal Information you provide to us when submitting a consumer request only to verify the requestor’s identity or authority to make the request.
Depending on your jurisdiction, we generally have between 45 and 90 days to respond to your request.
There may be circumstances where we will not be able to honor your request, in which case, we will notify you. For example, if you request deletion, we may need to retain certain Personal Information to comply with our legal obligations or other permitted purposes. Additionally, if you continue to interact with our Sites, the Mobile Apps, and our services after you request deletion, this may result in us receiving your Personal Information despite having honored your previous request to delete. Depending on your jurisdiction, you may have the right to appeal this decision or to contact your Attorney General if you have concerns about the results of the appeal.
Please note that depending on your jurisdiction, we may only be obligated to respond, free of cost, to Personal Information requests from the same consumer up to two times in a 12-month period. Depending on your jurisdiction, after you have exceeded the applicable number of requests, we have the right to charge a reasonable fee for fulfilling the request. In addition, under the applicable state privacy law, and for the protection of your Personal Information, we may be limited in what Personal Information we can disclose.
Depending on your jurisdiction, we may maintain your rights requests for at least 2 years. This information will not be used for any other purpose except to review compliance processes; it will not be shared except as necessary to comply with a legal obligation.
How to Withdraw Your Consent
Where we rely on your consent, you may withdraw it at any time by adjusting your preferences or contacting us at privacy@vireohealth.com. Withdrawing your consent will not affect processing that occurred before your request and may limit our ability to provide certain services where the information is necessary.
Data Security
The security of your information is important to us. We have implemented reasonable security measures to protect the information, including without limitation, use of firewalls, encryption, cybersecurity controls, application controls and monitoring. No method of electronic storage or transmission over the Internet is 100% secure. While we strive to use commercially reasonable means to protect your information, we cannot guarantee complete security.
Minors and Children
The Sites and the Mobile Apps are intended for general adult audiences. Specifically, to access our cannabis-related Sites you must be at least 21 years of age or 18 years of age with a valid medical marijuana patient, caregiver or guardian card where permitted by applicable law. We do not knowingly collect, store, use, sell, or share the Personal Information of children who are under 18 years of age. If you believe we have collected such information, please contact us immediately at privacy@vireohealth.com.
Notwithstanding the foregoing, some states in which we operate permit individuals under the age of 18 to become registered medical cannabis patients through that state's official patient registry, provided the minor is represented at all times by a parent or legal guardian acting as a registered caregiver. Where we receive Personal Information about a minor patient in this context, including information submitted by a parent or legal guardian to register the minor as a patient, verify caregiver status, or complete a purchase on the minor patient's behalf, we:
All communications, notices, and account access relating to a minor patient's registration or purchases are directed to the minor's parent or legal guardian, not the minor directly. If we become aware that we have collected Personal Information from an individual under the applicable age described above other than in connection with a lawful state medical cannabis minor-patient program as described here, we will take steps to delete that information as soon as reasonably practicable. If you believe a minor has provided us with Personal Information other than as permitted above, please contact us at privacy@vireohealth.com so we can investigate and address it.
Third-Party Links
Our Sites may include links to third-party websites, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control third-party websites and are not responsible for their privacy notice. If you submit Personal Information to any third-party websites or service providers, your information is governed by their privacy policies. When you leave our Sites, we encourage you to read the privacy notice on every website you visit.
Changes to this Notice
We reserve the right to change this Notice at any time in our sole discretion. If we make changes, we will post the revised notice here, so that you can see what information we gather, how we might use that information and in what circumstances we may disclose it. If we make a material change to this Notice, i.e. a change notifying you of materially different collection, processing, or transfer, we will notify of such change as required by law. By continuing to use our services after notice is provided, you accept and agree to this Notice as modified.
Contact Details
If you have any questions about this Notice, the ways we collect and use your Personal Information, or you would like to exercise your privacy rights, you may contact us at:
Email: privacy@vireohealth.com
Mail: Vireo Health, Inc., 207 South 9th St., Minneapolis, MN 55402, Attn: Legal Department
