HIPAA Notice of Privacy Practices
Last Updated: September 2025
This Notice describes how health information about you may be used and disclosed, and how you can get access to this information. Please review it carefully.
Our Privacy Commitment
In the normal course of doing business, Verano Holdings, Inc., which includes its cannabis dispensary locations, including Zen Leaf Cannabis Dispensary and MÜV™ (collectively, “Verano”, “our”, us”, or “we”) we create, obtain and/or maintain records about you and the services we provide to you. This includes when your order any of our products from our website, located at www.verano.com (the “Website”). In some instances, we may act as a covered healthcare provider or business associate in connection with medical cannabis dispensation to patients subject to HIPAA protections. When we act in either capacity, the information we collect is called Protected Health Information (“PHI”). We take our obligation to keep your PHI secure and confidential very seriously. We are required by state and federal law to protect the privacy of your PHI and to provide you with this Notice about how we safeguard and use it, and notify you following a breach of your health information. When we use or give out (“disclose”) your PHI, we are bound by the terms of this Notice. This Notice applies to all electronic or paper records we create, obtain and/or maintain that contain your PHI.
How We Use Information We Collect About You
We will use and disclose your PHI to provide, coordinate, or manage our services and products. For example, your protected health information may be provided to a physician to whom you have been referred to ensure that the physician has the necessary information to diagnose or treat you. Your protected health information will be used, as needed, to obtain payment for your health care services.
How We Protect Your Privacy
We understand the importance of protecting your PHI. We maintain technical, physical and administrative safeguards to ensure the privacy of your PHI.
Permitted Uses and Disclosures of Your PHI
- We may use or disclose, as needed, your protected health information in order to support the business activities, including the dispensation of product to you, and in order to call your name while you are in the dispensary lobby/reception area.
- We may use or disclose your protected health information, as necessary, to contact you, to discuss product alternatives or other health-related benefits and services that may be of interest to you.
- We may use or disclose your protected health information under certain circumstances without your authorization as required and permitted by law, including but not limited to requests for your protected health information related to: public health issues, communicable diseases, health oversight, abuse or neglect, food and drug administration requirements, legal proceedings, law enforcement, subpoena, coroners, funeral directors, organ donation, research, criminal activity, military activity and national security, workers’ compensation, inmates, and other required uses and disclosures.
- Under the law, we must make disclosures to you upon your request. Under the law, we must also disclose your protected health information when required by the Secretary of the Department of Health and Human Services to investigate or determine our compliance with the requirements under 45 CFR Section 164.500 et seq.
Your Rights With Respect To Your PHI
You have the following rights regarding the PHI we maintain about you.
Right to Inspect and Copy – Subject to some restrictions, you may inspect and copy PHI that may be used to make decisions about you. If we maintain such records electronically, you have the right to request such records in electronic format. You may also have the records sent to a third party, including requesting that we share your PHI. If you request copies, we may charge reasonable expenses incurred with copying and mailing the records. Under limited circumstances, we may deny you access to a portion of your records.
Right to Amend – If you believe PHI about you is incorrect or incomplete, you may ask us to amend the information. You must provide a reason supporting your request to amend. We may deny the request in some instances. If we determine that the PHI is inaccurate, we will correct it if permitted by law.
Right to an Accounting of Disclosures – You have the right to request an accounting of disclosures of your PHI. If you request an accounting more than once during any 12-month period, we may charge you a reasonable fee for each accounting report after the first one.
Right to Request Restrictions – You have the right to request a restriction or limitation on the PHI we use and disclose about you for treatment, payment or operations. You may also request your PHI not be disclosed to family members or friends who may be involved in your care or paying for your care. Your request must be in writing; state the restrictions you are requesting and state to whom the restriction applies. We are not required to agree to your request. If we do agree, we will comply with your request unless the restricted information is needed to provide you with emergency treatment.
Confidential Communications – You may ask that we communicate with you in an alternate way or at an alternate location to protect the confidentiality of your PHI. Your request must state an alternate method or location you would like us to use to communicate your PHI to you.
Right to Be Notified – You have the right to be notified following a breach of unsecured PHI if your PHI is affected.
Right to a Paper Copy of This Notice – You have the right to request a paper copy of this Notice at any time. For information about how to obtain a copy of this Notice and answers to frequently asked questions, please [email protected]. Even if we agreed to provide this Notice electronically, you are still entitled to a paper copy. You may obtain a copy of this Notice from our website at: www.verano.com.
How to Exercise Your Risks to Ask Questions –
Contact: Verano Legal
Email: [email protected]
Address: Verano, 224 W. Hill Street, Suite 400, Chicago, IL 60610
Right to File a Complaint – If you believe we violated your privacy rights, you may address a written complaint to our Privacy Office at the contact below. You may also file a complaint with the Secretary of the U.S. Dept. of Health and Human Services, Office for Civil Rights. You will not face retaliation for filing a complaint.
Written complaints, revocation of authorization to use or disclose PHI, requests for a copy of your PHI, amendment to your PHI, an accounting of disclosures, restrictions on your PHI or confidential communications may be mailed to: Verano, 224 W. Hill Street, Suite 400, Chicago, IL 60610.
For certain types of requests, you must provide written documentation if applicable. Certain preference edits and forms are available on our website. For help, contact [email protected].
We Reserve the Right to Revise this Notice – A revised Notice will be effective for PHI we already have about you, as well as any PHI we may receive in the future. We will communicate revisions to this Notice through our website www.verano.com.
Special Notice for Substance Use Disorder (SUD) Records (If Applicable)
If we create, receive, or maintain records that are protected under 42 C.F.R. Part 2 (SUD treatment records), those records have additional privacy protections. We will provide the required Part 2 notice and will not use or disclose those records unless permitted by Part 2 or with your written consent, subject to limited exceptions.
State Addendum: Medical Cannabis Privacy and Registry Confidentiality
We comply with state medical cannabis privacy laws that may provide additional protections. Key state provisions include confidentiality of patient registry information and limited permitted disclosures:
Florida: Medical Marijuana Use Registry information is confidential and exempt from public records; access is limited to entities specified by law.
Illinois: Information held by state agencies for program administration is confidential, exempt from FOIA, and disclosure is restricted; breaches can carry penalties.
New Jersey: Medicinal Cannabis Program laws include confidentiality protections for patient information and program records maintained by the state.
Nevada: The Division has duties concerning confidentiality of registry information; certain information is not subject to subpoena, discovery, or inspection.
Arizona” Records maintained by the Department under the AMMA are confidential and exempt from public records; limited disclosure provisions apply.
Connecticut: Program statutes and regulations include confidentiality of registry information and rules for dispensary record handling and transfers.
This Notice is intended for use in both web and in‑store postings. It is written in plain language to satisfy HIPAA content and availability requirements for health care providers with direct treatment relationships.