Privacy Policy

Privacy Policy

Effective Date: [PENDING COUNSEL SIGN-OFF] Last Updated: May 27, 2026

This Privacy Policy explains how Miracle Leaf Franchising, LLC and its affiliated Miracle Leaf® branded clinics ("Miracle Leaf®," "we," "our," "us") collect, use, share, and protect information from visitors to mymiracleleaf.com (the "Site") and from prospective patients who submit contact or appointment-request forms.

This Privacy Policy is intended to comply with Florida law, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), and applicable consumer-privacy statutes in Georgia, Texas, and other states where Miracle Leaf® clinics operate. It does not create a HIPAA-protected relationship; see the HIPAA Notice section below.

Information We Collect

We collect information you provide directly through the Site, including:

• Contact and appointment-request form data: your name, mobile phone number, email address (optional), the Miracle Leaf® clinic location you selected, the page you submitted from, your stated request or message, and whether you authorized a return call.
• Communications: records of calls, texts, and emails you exchange with us or with a Miracle Leaf® clinic in response to your inquiry.
• Optional information: any additional information you choose to share in the message field of a form.

We also collect limited information automatically when you visit the Site:

• Device and usage information: IP address, browser type, operating system, referring URL, pages viewed, time spent on each page, and similar standard log data.
• Cookies and analytics identifiers: small text files placed on your device by us and by analytics providers. The Site uses Google Analytics 4 (measurement ID G-TDWN1PX83Q) to understand aggregate site usage. We do not use cross-site advertising trackers.

We do not knowingly collect information from children under 18.

How We Use Information

We use the information described above to:

• Route your contact or appointment-request submission to the Miracle Leaf® clinic location you selected, so that clinic can respond to you.
• Schedule, confirm, reschedule, or cancel certification appointments and recertification visits.
• Send transactional communications (appointment confirmations, reminders, follow-up after a visit).
• Improve the Site, troubleshoot technical issues, and analyze aggregate usage.
• Comply with our legal obligations and enforce our Terms of Service.

We do not sell your personal information. We do not use your contact information for behavioral advertising on third-party platforms.

How We Share Information

We share information only as described below:

• With the Miracle Leaf® clinic location you selected (operated by an independently owned franchisee). The clinic uses your information to respond to your inquiry, prepare for and conduct your evaluation, and follow up after your visit. Each franchisee is responsible for the information it receives, and may have its own privacy practices.
• With service providers acting on our behalf, including: our customer relationship management (CRM) platform (Frappe / ERPNext hosted on Miracle Leaf® infrastructure), our email service provider, our website hosting and content delivery providers, our analytics provider (Google Analytics 4), and our security and fraud-prevention vendors. These providers are bound by written agreements that restrict their use of your information to the services they provide to us.
• For legal compliance, including responses to lawful subpoenas, court orders, and regulatory requests, and to protect the rights, property, or safety of Miracle Leaf®, our patients, or others.
• In connection with a corporate transaction, such as a merger, financing, acquisition, or sale of assets, in which case we will require the recipient to honor the commitments in this Privacy Policy.

HIPAA Notice

Information you submit through a contact or appointment-request form on the Site is collected before a physician-patient relationship has been established. Pre-appointment intake information is not Protected Health Information ("PHI") under the federal Health Insurance Portability and Accountability Act of 1996 ("HIPAA").

Once you complete a physician evaluation at a Miracle Leaf® clinic, the information generated during and after that evaluation is subject to HIPAA and to the physician's separate Notice of Privacy Practices, which the clinic will provide to you at your visit. This Privacy Policy does not govern that clinical information.

Cookies and Tracking Technologies

We use the following categories of cookies and similar technologies:

• Strictly necessary cookies to operate the Site (page navigation, form submission, security).
• Analytics cookies through Google Analytics 4 to measure aggregate Site usage.

You may control cookies through your browser settings. Disabling cookies may degrade Site functionality. The Site does not currently respond to "Do Not Track" browser signals. Where required by law (e.g., for California residents), we honor opt-out preference signals such as the Global Privacy Control (GPC).

Your Privacy Rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate personal information.
• Delete your personal information, subject to legal retention requirements.
• Opt out of any sale or sharing of your personal information for targeted advertising (we do not sell or share for cross-context behavioral advertising, but you may still submit this request).
• Limit the use of sensitive personal information.
• Non-discrimination for exercising your rights.

To exercise any of these rights, contact us using the information in the Contact section below. We will verify your identity before responding. Where required, you may appeal a decision by replying to our written response with the word "Appeal."

California residents: the CCPA/CPRA Notice at Collection is integrated into this Privacy Policy. Categories of personal information collected, purposes, and retention are described above. We retain personal information only as long as needed for the purposes described or as required by law.

Florida, Texas, Virginia, Colorado, Connecticut, Utah, Oregon, and other state residents: rights vary by state. We honor verified requests to the extent required by applicable state law.

Data Retention

We retain form-submission data for no longer than reasonably necessary to respond to your inquiry, complete your appointment, and meet our legal and audit obligations. Aggregate analytics data is retained according to the default retention setting of Google Analytics 4. Clinical records held by Miracle Leaf® clinics after your visit are retained as required by state medical-records law and the clinic's own retention schedule.

Data Security

We use commercially reasonable administrative, technical, and physical safeguards to protect personal information, including encryption in transit (HTTPS/TLS), access controls on our CRM, and regular security review. No method of transmission over the Internet is 100% secure; we cannot guarantee absolute security.

Third-Party Links

The Site may link to third-party websites (e.g., state medical-marijuana registry portals, the Florida Office of Medical Marijuana Use, the Georgia Medical Cannabis Commission, the Texas Compassionate Use Program). We are not responsible for the privacy practices of those sites.

International Visitors

The Site is operated from the United States and intended for U.S. residents. If you access the Site from outside the U.S., your information will be transferred to and processed in the U.S.

Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with a new "Last Updated" date. Continued use of the Site after the effective date of an update constitutes acceptance of the updated policy.

Contact

To exercise a privacy right, ask a question, or submit a complaint, contact:

Miracle Leaf Franchising, LLC Attn: Privacy Officer [CORPORATE MAILING ADDRESS — pending counsel sign-off] Email: privacy@mymiracleleaf.com Phone: (833) LEGAL-MJ

If you are not satisfied with our response, you may have the right to lodge a complaint with your state attorney general or applicable data-protection authority.

---

DRAFT — pending counsel review and sign-off. This document is a starting template for outside counsel to review, edit, and approve before publication. Placeholders are bracketed.