Privacy Notice

Cannavec (cannavec.ai) is operated by Million Media Ltd. We are the data controller for the personal data described in this notice, which means we decide how and why it is processed.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR). This notice should be read alongside our Terms and Conditions.

When you create a Cannavec account we collect and store:

• Your email address and, if you provide it, your full name and organisation name.
• Your account role, subscription tier, and subscription status.
• The date you last signed in.
• If you subscribe to a paid tier, your Stripe customer and subscription identifiers. We do not receive or store your card number — that stays with Stripe.
• If you belong to an organisation account, your membership of that organisation and your role within it.

API keys. If you generate an API key, we store a cryptographic hash of it, a short non-secret prefix so you can identify it in the dashboard, the name you gave it, and when it was last used. We cannot recover the full key from what we store — if you lose it you must generate a new one.

Lawful basis: performance of our contract with you (UK GDPR Article 6(1)(b)), and our legitimate interests in securing the Service and preventing abuse (Article 6(1)(f)).

Chat history. When you use the dashboard chatbot, your conversations — the messages you send and the responses you receive — are stored against your account so the history is there when you come back. Only you and, where strictly necessary, authorised Cannavec staff can access them. A conversation is only saved once you actually send a message.

Safety review records. Cannavec runs automated safety checks on chat interactions. Where a message matches a clinical red flag — for example, indications that the user may be under 18, pregnant, or describing a cardiac condition — or where a response looks like it may have strayed into individual treatment advice, we record the message, the response, and the reason it was flagged, so a human can review whether our safeguards worked.

Because you may have described a health condition, these records can amount to special category data concerning health. We rely on your explicit consent (Article 9(2)(a)) to hold them, given when you accept these terms and choose to use the chatbot. You can withdraw that consent at any time by emailing us, and you do not have to use the chatbot to use the rest of the Service.

These records are accessible only to Cannavec staff carrying out safety review. They are not used for marketing, not used to train AI models, and not shared with anyone outside the processors listed in section 6.

If you complete the Free Eligibility Check, we collect:

• Your name, email address, mobile number, age, gender, and UK postcode.
• The condition you are hoping to treat and any detail you provide about it.
• Your answers to the eligibility questions — prior treatments, personal and family mental health history, pregnancy or breastfeeding status, and current medications.
• Your booking time preference, if you give one.
• The eligibility verdict our system produced from your answers.

This is special category data concerning health. We process it on the basis of your explicit consent (Article 9(2)(a)), which you give by ticking the consent box before submitting the check. You can withdraw consent at any time, though we may not be able to undo a referral already passed to a clinic.

What we do with it. Your submission is written to a secure Airtable base that we manage, and passed to the medical cannabis clinic you consented to be contacted by, so they can call you back and arrange a consultation. That is the only purpose. We do not use these details for marketing, do not sell them, and do not use them to train AI models.

Automated processing. The eligibility verdict is generated automatically from your answers. It is an indication only — it does not decide whether you receive treatment, and a clinician always makes that decision. If you would like the verdict explained or reviewed by a person, email us and we will arrange it.

• Rate limiting. To stop abuse of our free endpoints we count requests. For signed-in users this is counted against your account; for anonymous visitors we store a hashed version of your IP address, not the address itself.
• API usage. We log which endpoints your account or API key calls and when, so we can enforce subscription limits and bill accurately.
• Travel tool queries. If you use the travel skill we log the route you asked about — origin, destination, method, and duration — to monitor use of the tool.
• Server logs. Our hosting provider retains standard web logs, including IP address and browser type, for security and abuse prevention.

Lawful basis: our legitimate interests in keeping the Service secure, available, and correctly billed (Article 6(1)(f)).

We do not sell your personal data, and we do not share it with third parties for their own marketing purposes. We use the following processors, each under a written data processing agreement, acting only on our instructions:

Medical cannabis clinics. If you complete the Free Eligibility Check, your submission is passed to the clinic you consented to be contacted by. That clinic is a separate data controller and handles your data under its own privacy notice.

We may also disclose personal data where we are required to by law, by a court, or by a regulator, or where it is necessary to establish, exercise, or defend legal claims.

Some of our processors are based outside the United Kingdom, including in the United States. Where personal data is transferred outside the UK, we rely on the UK Government's adequacy regulations where they apply, or on the International Data Transfer Agreement or the UK Addendum to the European Commission's Standard Contractual Clauses, together with any additional safeguards required. You can ask us for details of the safeguards applying to a particular transfer.

If you delete your account from your dashboard, we delete your profile and your chat history, and revoke your API keys, immediately. Safety review records are kept for the period above but the link to your identity is removed, so what remains cannot be traced back to you.

Service emails. We send account confirmations, security notices, billing receipts, and notices about changes to our terms. These are necessary to provide the Service and you cannot opt out of them while you hold an account.

Newsletters and product announcements. When you create an account, your email address is added to our Cannavec mailing list, as set out in section 20 of our Terms and Conditions. We rely on our legitimate interests (UK GDPR Article 6(1)(f)) in marketing our own services to our own customers as the lawful basis for this.

You can opt out at any time. Every marketing email carries a one-click unsubscribe link, and you can also opt out — including before you have received anything — by emailing plantz@cannavec.ai. Opting out is free, takes effect promptly, and does not affect your service emails, your subscription, or your access to the Service.

Your email address is shared with Brevo solely so it can deliver our emails to you. We do not sell, rent, or pass your email address to any other organisation for marketing.

We use only strictly necessary cookies — those required to keep you signed in and to apply rate limits. Under PECR these do not require consent, because the Service cannot work without them.

We do not use analytics, advertising, or tracking cookies. If we introduce any non-essential cookie in future, we will ask for your prior consent and you will be able to withdraw it at any time. Continuing to browse the site is not treated as consent.

Under UK GDPR you have the right to:

• Access — obtain a copy of the personal data we hold about you.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — ask us to delete your data, in the circumstances the law allows.
• Restriction — ask us to limit how we use your data while a concern is resolved.
• Portability — receive data you gave us in a portable format, or have it sent to another provider.
• Object — object to processing carried out on the basis of our legitimate interests.
• Withdraw consent — at any time, where we rely on consent. This does not affect processing carried out before you withdrew it.

To exercise any of these rights, email plantz@cannavec.ai. We will respond within one month. We do not charge for this, unless a request is manifestly unfounded or excessive.

You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk or on 0303 123 1113. We would appreciate the chance to address your concern first.

We take appropriate technical and organisational measures to protect your data, including encryption in transit, hashed storage of API keys and IP addresses, database-level access controls that restrict sensitive tables to server-side access only, and limiting staff access to what each role needs.

No system is completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and tell you directly where the law requires it.

The Service is not directed at children and you must be at least 18 to use it. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this notice to reflect changes in the Service, our processors, or the law. We will update the "Last updated" date above, and where a change materially affects how we use your data we will notify registered users by email before it takes effect.

For any question about this notice or about your data: