Cura Vida Cannabis Clinics
Legal Document

Personal Data Processing Policy

Effective Date: April 23, 2026 · Cura Vida Cannabis Clinics, Costa Rica

CURA VIDA CLINICS COSTA RICA LLC (CVCC), legal entity number 3-102-877646, is the company responsible for the processing of personal data in accordance with Law No. 8968 on the Protection of the Person Regarding the Processing of their Personal Data and its Regulations (Executive Decree No. 37554-JP). This Policy regulates the use, protection, and processing of all databases created or managed by CVCC, guaranteeing the rights of privacy and confidentiality of every data subject.

Clause One: Identification of the Responsible Party

  • Responsible party: CURA VIDA CLINICS COSTA RICA LLC SOCIEDAD DE RESPONSABILIDAD LIMITADA, legal entity identification number 3-102-877646, registered in the Registry of Legal Entities, volume 2023, entry 333699.
  • Contact email: robert@curavidacannabisclinics.com

Clause Two: Object

  • This Policy aims to regulate the use of CVCC personal data, as well as the protection and processing measures for databases created or managed by CVCC.
  • CVCC guarantees the rights of privacy and confidentiality in the processing of personal data, governed by the principles of informational self-determination, quality of information, transparency and confidentiality.

Clause Three: Scope of Application

  • CVCC's automated or manual databases, and to any subsequent use of this data.
  • Databases and files containing information about all clients and/or patients, medical professionals, suppliers, business partners and collaborators.
  • CVCC representatives, management and collaborators who, due to their functions, participate in the processing of databases with personal information.
  • Any data subject whose data is processed by CVCC.

Clause Four: Definitions

  • Database: Any file, record or other structured set of personal data, public or private, subject to automated or manual processing.
  • Internal database: Personal data used for CVCC's own purposes; cannot be distributed or disseminated to third parties.
  • Commercialize: To sell, trade, share, exchange or in any way alienate for profit personal data contained in databases.
  • Personal data: Any data or information relating to an identified or identifiable natural person.
  • Unrestricted personal data: Data contained in publicly accessible databases as provided by special laws.
  • Restricted access personal data: Data that, although part of public records, is not unrestricted; processing only permitted for public purposes or with express informed consent.
  • Sensitive data: Information relating to racial/ethnic origin, political opinions, religious beliefs, socioeconomic status, biomedical/genetic data, health, sexual orientation, union membership, etc. Processing is permitted only when necessary to safeguard vital interests, when voluntarily made public by the data subject, when required for medical diagnosis or healthcare by a professional subject to professional secrecy, or under any other applicable provision of Law No. 8968.
  • Duty of confidentiality: Obligation to maintain professional secrecy even after the relationship with the database has ended.
  • Data subject: Natural person who owns the personal data.
  • Transfer of personal data: Action by which, with prior express authorization, the responsible party transfers data to a third party.
  • Processing of personal data: Any operation or set of operations performed on personal data, automated or manual.

Clause Five: Principles of Data Processing

  • Legality, transparency, and fairness: All processing of personal data must be lawful and fair.
  • Purpose limitation: Personal data should only be collected for specific, explicit and legitimate purposes.
  • Data minimization: Processing must be adequate, relevant and limited to what is necessary.
  • Accuracy: Data must be accurate and, where necessary, kept up to date.
  • Storage limitation: Retention must be limited to the fulfillment of the purposes pursued by the processing.
  • Integrity and confidentiality: Personal data must be processed guaranteeing appropriate security and confidentiality.
  • Informed Consent: Always required; must be express, free, unequivocal, informed and specific, given in writing or digital media.

Clause Six: Rights of Data Subjects

  • Informational self-determination: The fundamental right to know what is on record, the purpose of its use, and to demand rectification, updating, supplementation or deletion.
  • Access to personal data: Information must be stored so that the right of access by the data subject is fully guaranteed.
  • Rectification, updating or deletion: Available when personal data has been processed in violation of Law No. 8968.
  • Revocation of informed consent: May be revoked in writing at any time, without retroactive effect.
  • Decide on the transfer of personal data: Express written authorization required.
  • File complaint with PRODHAB: After exhausting CVCC's internal process, the data subject may file a complaint with the Agency for the Protection of Personal Data.
  • Voluntary provision of sensitive data: No one is obliged to provide sensitive data.
  • Right to be forgotten: Retention shall not exceed ten years from the date of termination of the processing purpose.

Clause Seven: Exercise of Rights

  • The exercise of any right does not exclude the possibility of exercising others.
  • Rights may be exercised by the data subject (proving their identity), their successors, their authorized representative or proxy, or public/administrative entities in the exercise of their legal functions or by judicial order.

Clause Eight: Exceptions

  • Principles and rights may be limited for: CVCC security; prevention, prosecution, investigation, detention and suppression of criminal offenses; operation of databases for statistical, historical, or scientific research; proper provision of public services; or any other applicable provision of Law No. 8968.
  • Informed consent is not required when data must be delivered by constitutional or legal provision, there is a judicial order, the data is unrestricted, or in cases of medical or health emergency.

Clause Nine: Processing of Personal Data

  • CVCC's functions as a company dedicated to health services through legal access to medicinal cannabis under Law No. 10113.
  • Reporting on changes to CVCC services and evaluating the quality of service.
  • Clinical Evaluation: Assessing eligibility for cannabinoid-based therapy based on medical history and current condition.
  • Prescription Generation: Issuing valid prescriptions through the Ministry of Health's Official Digital Prescription System, transmitting only minimum required data.
  • Continuity of Care: Any authorized CVCC physician can access your medical record.
  • Legal Compliance: Complying with all record-keeping obligations required by the College of Physicians and Surgeons and the Ministry of Health.

Clause Ten: Security and Protection of Data

  • The person responsible for security must adopt the necessary technical and organizational measures to guarantee the security of personal data and prevent its alteration, accidental or unlawful destruction, loss, unauthorized processing or access.
  • These measures must include the most appropriate physical and logical security mechanisms in accordance with current technological development.

Clause Eleven: Internal Use and Transfer of Personal Data

  • Internal use: The internal use of personal data by CVCC personnel other than the database administrator is not considered a transfer.
  • Transfer of personal data requires unambiguous consent of the data subject unless otherwise provided by law; the receiving party may not distribute, disseminate, or commercialize the data.
  • Ministry of Health: CVCC transmits prescription data sharing only the minimum fields necessary to validate prescriptions.
  • Authorized Pharmacies: Data shared strictly limited to what the pharmacy needs to fill the order.
  • International Data Transfer: CVCC uses the Juno Electronic Medical Records (EMR) platform, hosted on secure servers in Canada, managed by an authorized third-party provider, for the exclusive storage and processing of all sensitive health data and clinical notes.

Clause Twelve: Application Processing

  • Requests regarding rights of access, rectification, modification, revocation or deletion are processed per Law No. 8968.
  • The applicant must demonstrate they are authorized to exercise the right. Response deadline is ten business days from receipt of the request.
  • If information is insufficient, the administrator may request clarification once within five business days. The data subject has five business days to respond.
  • All requests should be sent to: robert@curavidacannabisclinics.com

Clause Thirteen: Final Provisions

  • Cases not covered by this Policy will be resolved by applying CVCC's internal regulations and, where applicable and compatible with its purpose, by national legislation on the protection of personal data.

Questions or Concerns?

If you have questions about this Personal Data Processing Policy, wish to exercise your data rights, or need to report a concern, please contact our Data Privacy Officer:

robert@curavidacannabisclinics.com +506 7050-9772

Last updated: April 23, 2026 · © 2026 Cura Vida Cannabis Clinics