Washington Consumer Health Data Privacy Policy
Last Updated: May 13, 2026
This Washington Consumer Health Data Privacy Policy (“Consumer Health Data Privacy Policy”) describes how Lumen Holdings LLC and its affiliates, (“Lux Pot Shop” or “Company” or “we” or “our” or “us”) treats certain Personal Information, that constitutes ‘consumer health data’ under Washington State’s My Health My Data Act (“MHMDA”), that is collected or provided in connection with an end user’s (“you” or “your” or “user”) use of Lux Pot Shop’s service, website, www.luxpotshop.com, and any other website, social media pages, or other digital medium owned or operated by Lux Pot Shop (“Consumer Health Data”).
This Consumer Health Data Privacy Policy also applies to any Consumer Health Data collected, stored, or used by us, such as information you provide us through the above mediums, in person, by email, mail, or telephonic communications (collectively, the “Site”). The information in this Consumer Health Data Privacy Policy is intended to fulfill the requirements of the My Health My Data Act.
This Consumer Health Data Privacy Policy is supplemental or our Privacy Policy and Terms and Conditions. In the event of a conflict between the Consumer Health Data Privacy Policy and any other policy or terms, this Consumer Health Data Privacy Policy prevails with respect to any consumer health data.
The information provided in this Consumer Health Data Privacy Policy is designed to inform you of what Consumer Health Data we collect, why we collect such information, how we use the information we collect, and the choices we offer, including how to access and update information.
Please read this Consumer Health Data Privacy Policy carefully, and if you do not agree with the Washington Consumer Health Data Privacy Policy, you should not use Lux Pot Shop to obtain medical cannabis products.
Our Collection and Use of Health Data
The service may offer functions that allow users to review and/or select medical cannabis products for purchase at one of our locations. During the use of the service, we may collect Personal Information from you that may identify your past, present, or future physical or mental health status and be subject to the MHMDA.
The Company only collects and processes Consumer Health Data from you for the purpose of providing the functions specified above. Similarly, the Company shares such Consumer Health Data with its affiliates and service providers solely for the purposes of the functions specified above.
We may collect the following categories of health data from you:
- Individual health conditions, treatment, diseases, or diagnosis.
- Social, psychological, behavioral, and medical interventions.
- Health-related surgeries or procedures.
- Use or purchase of prescribed medication.
- Diagnoses or diagnostic testing, treatment, or medication.
- Data that identifies a consumer seeking health care services.
- Information derived or extrapolated from non-health information that is associated with the categories of data listed above, or otherwise identifies the consumer associated with categories of data listed above.
We may collect the following health data to deliver services that you requested, such as recommendations on products or information on how to obtain a medical recognition card, including:
- Personal identification details (name, phone number, email, address, medical recognition card number, effective & expiration dates, authorizing healthcare provider name, designated provider ID name, card number, effective & expiration dates)
We collect Consumer Health Data from the following sources:
- You
- Your device
- Our affiliates and service providers, who provide us with information about consumers who are viewing our content across websites or applications, interacting with our promotions, benefits or other programs.
You can choose not to provide certain information to us, but it may delay or prevent us from providing our services to you.
Categories of Health Data Shared
We share the following categories of health data with third parties:
- Data that identifies a consumer seeking health care services, such as analytics data processed by our analytics service provider.
Categories of Third Parties That May Receive Your Health Data
In order to provide the services that you have requested, we may disclose Consumer Health Data to:
- Our service providers and vendors, such as payment processors, website hosts, legal counsel, and various customer, tech, and operational support.
- Law enforcement agencies, regulatory bodies, courts, or other public authorities, to comply with our legal and regulatory obligations, to respond to requests from governmental authorities, to protect our rights, to defend against legal claims, or as otherwise required by law.
- Third parties with whom you have granted consent for us to share your health data, such as a medical provider that issued you a medical recognition card.
We instruct these third parties, including processors, service providers, and contractors, to only use Consumer Health Data as permitted by our contracts with them and consistent with applicable law.
Your Rights
Under Washington’s My Health My Data Act, consumers have the right (i) to confirm the specific categories of Consumer Health Data that we are processing, and to access such data; (ii) to receive a list of all third parties and affiliates with whom we have shared or sold your Consumer Health Data and an active email address or other online mechanism that you may use to contact these third parties; (iii) to withdraw consent from our collection and sharing of your Consumer Health Data; and (iv) to have your Consumer Health Data deleted upon request. Consumers may exercise any of these rights up to twice per year.
To exercise these rights, you may submit a verifiable consumer request to us by using the contact information provided at the bottom of this page. Only you, or a person that you authorize to act on your behalf, may make a verifiable consumer request related to your information. Your verifiable consumer request must provide sufficient information that allows us to reasonably verify that you are the person about whom we collected Consumer Health Data or an authorized representative, and describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it. We cannot respond to your request or provide you with information if we cannot verify your identity or authority to make the request. Making a verifiable consumer request does not require you to create an account with us. We will only use Consumer Health Data provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.
We make our best efforts to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to ninety (90) days from the day that we received your request), we will inform you of the reason and extension period in writing.
The above rights are not absolute, and in some instances, we may decline your request as permitted by law. If your request to exercise a right is denied, you may appeal that decision by contacting us using the information at the bottom of this page. If your appeal is unsuccessful, you can raise a concern or lodge a complaint with the Washington State Attorney General at www.atg.wa.gov/file-complaint.
Note that we may retain some of your Consumer Health Data even after your request has been processed, to the extent necessary to comply with our legal obligations or as necessary to provide the Service to you.
If you have any questions regarding this Consumer Health Data Policy or our data processing practices, please contact us at the address below:
[email protected]
Lumen Holdings LLC
4912 17th Ave NW
Seattle, WA, 98107