Privacy Policy
Last updated: April 23, 2026
Summary
medcardpr.com ('we') operates an intermediary service for Puerto Rico medical cannabis card applications. This policy explains what information we collect, how we use it, and your rights regarding your data.
Information we collect
We collect the information you provide in the application form: full legal name, date of birth, phone number, email address, Social Security Number, a photo of your government-issued ID, and for residents, a photo of yourself. For tourists, we also collect your confirmation of US citizenship and, when provided, your arrival date in Puerto Rico. We collect the qualifying medical conditions you indicate. We log which payment method you select and when you confirm payment.
How your information is stored
Your Social Security Number is encrypted with AES-256-GCM before being stored in our database. No one, including our hosting provider, can read it without our encryption key. Photos are stored in a private storage bucket accessed only through signed URLs that expire in 1 hour. Our admin panel requires authentication.
How we use your information
We use your information solely to: (1) provide application, coordination, and referral services; (2) share your intake information with an independent licensed physician's office for telehealth scheduling and evaluation when you authorize us to do so; (3) communicate with you about the status of your application; and (4) send renewal reminders before your license expires. We do not sell your information to third parties under any circumstances.
Sharing information with third parties
We share your information with: (1) the certifying physician evaluating your application; (2) the Puerto Rico Department of Health when required to issue your card; (3) our technical service providers (Supabase for the database, Vercel for hosting, Resend for email) who act solely under our instructions and are subject to their own privacy policies.
Data retention
We retain your application data for as long as your card is active, plus 7 years after its expiration (consistent with medical record retention requirements). After that period, we permanently delete your information. You may request earlier deletion by contacting us.
Your rights
You may request access to your information, corrections, or deletion by emailing us at [email protected]. We will respond within 30 days.
Security
We implement reasonable technical and organizational measures to protect your information, including encryption of sensitive data, private photo storage, admin authentication, and HTTPS-only connections. However, no system is 100% secure. We will notify you without undue delay if we discover a data breach affecting your information.
Minors
Our services are directed to individuals 21 years of age or older. We do not knowingly collect information from minors. If you believe a minor has provided us with information, contact us to have it removed.
Changes to this policy
We may update this privacy policy occasionally. The current version will always be available on this page with the last updated date at the top.
Contact
For questions about this policy or your data: [email protected]