Privacy Policy

Vireo Health, Inc. Privacy Notice

Last updated: 11/09/2026

This privacy notice (“Notice”) is designed to help you understand how we collect information about you, how we use it, how we share it, and how you can exercise your privacy rights with respect to that information.

Table of Contents

What This Notice Covers

What Personal Information We Collect

How We Use Your Personal Information

How We Use Cookies and Similar Technologies

Disclosure of Your Personal Information

Additional Disclosures Related to Collection, Use, and Disclosure of Personal Information for Residents of certain U.S. States

Data Retention

Your Privacy Rights

Exercising Your Privacy Rights

Privacy Rights under Financial and Insurance Privacy Laws

Data Security

Minors and Children

Third-Party Links

Changes to thisNotice

Additional Information for Residents of the UK and EU

Contact Details

To submit a privacy rights request, contact us using one of the methods listed in the “Contact Details” section below.

What This Notice Covers

This Notice describes how Vireo Health, Inc.and Vireo Health, Inc. affiliates that provide products and services directly to consumers, including, but not limited to, Bridgewell Operating Group and Hawthorne Gardening Co. (collectively, “Vireo,” “we,” “us,” or “our”) , collect, use, and disclose your Personal Information. That includes Personal Information we collect through or in connection with:

• our websites bridgewellab.com and hawthorne-gardening.com (collectively, the “Sites”) .
• any emails, texts, online chats or other communications with us , including communications via third-parties, such as service providers, (collectively our “Partners”) who may offer chat capabilities via our Sites.
• any offline interactions we have with you , such as when you visit our storefronts.
• Cookies and Similar Technologies (as defined below) through the Sites.

This Notice applies to all Sites operated by Vireo affiliates that manufacture, distribute, dispense, or deliver non-cannabis products, such as fertilizers or growing equipment. Vireo and its affiliates only provide cannabis products in the United States.

This Notice does not apply to information collected or controlled by a third party, including any third-party apps or websites (including third-party websites you may access through our Sites.) We encourage you to review the privacy policies of any business you interact with .

This Notice also does not apply to workforce members, such as job applicants, employees, retirees, or contractors.

Our privacy practices may vary among the jurisdictions in which we operate to reflect local practices and legal requirements, which we may explain through jurisdiction-specific addenda to this Notice. In the event of any conflict or inconsistency between the jurisdiction-specific addendum that applies to you and the main body of this Notice, the terms of such addendum will govern and prevail.

What Personal Information We Collect

We collect a variety of Personal Information in connection with offering our Sites and our products and from our Partners. “Personal Information” generally means any information that identifies, relates to, describes, is reasonably capable of being associated with you or could reasonably be linked with you, directly or indirectly. Personal Information does not include publicly available information or information that is deidentified or anonymized consistent with applicable privacy laws.

Depending on how you interact with our Sites, in some instances, with our Partners, we may collect the following categories of personal information about you:

• Identifiers such as real name, alias, unique personal identifier, IP address, passport number, driver’s license number, or other form of state identification.
• Contact Information such as postal address, email address, or phone number.
• Demographic Information such as age, gender identity or expression, ethnicity, or nationality.
• Device and Location Information such as device type and identification number, zip code or other geolocation information, mobile network, operating system type, web browser type and version, orsystem events .
• Usage Informationsuch as where you hover or clickon a website, your interactions with features and content, search queries, date and time of certain actions, data on how you navigate and use website s, links clicked, or browsing history.
• Account Information such as username and password, security questions and answers, or access codes.
• Transaction or Commercial Informationsuch as your purchase history, related payment information, information you input into our Sites, or other data related to your use of our Sitesor services provided by our Partners.
• Content You Submit to our Sites or through services operated by our Partners, such as reviews of your experience, messages, comments, or other content you submit.

· Sensory informationsuch as via CCTV when you visit our stores or when you call customer service and we record your call.

• Call tracking information, such as interactions made through our toll-free numbers which may be available on our Sites .

How We Collect Personal Information

Directly from You

We collect Personal Information directly from your use or interaction with our Sites or through services operated by our Partners, and information you directly provide to us. This may include:

• Information you submit through forms on our Sites, such as when you make a purchase, enter contests or promotions, sign up to receive communications, schedule an appointment with us, or report a problem.
• Information you submit when you make an account with us.
• Information made available to us when you connect to social networking platforms through our websites or services.
• Your correspondence with usor our Partners.
• Responses to surveys or feedback requests.
• Details of transactions carried out through the Sites or through websites or services of our Partners, such as purchases.
• Search queries conducted on the Sites.

From Non-Affiliated Third Parties

We may also obtain Personal Information about you from third-party sources. These sources can include our service providers, business partners, analytics providers, social media platforms, data brokers, or publicly available sources.

How We Use Your Personal Information

We use the information we collect about you, or that you provide to us, including Personal Information, for the following purposes:

• Providing services to you: To operate, maintain, and provide you with access to the Sites, their contents, and any information, products, or services you request, including customer support (such as troubleshooting or providing instructions or tips).
• Account administration:Including to process your payments and fulfill your orders.
• Programs and promotions: To communicate with you about, and administer your participation in, special events, programs, surveys, contests, sweepstakes, and other promotions.
• Marketing and advertising: To provide you with marketing and promotional content.
• Communications and feedback: To engage with you when you contact us, request information, or provide feedback .
• Product and service improvement: To evaluate, operate, and improve our products, services, and overall business, and to ensure functionality of our Sites.
• User interactions: To facilitate your interaction with us or our Partners when you submit information through a form to request an appointment or consultation.
• Compliance and legal: To comply with applicable laws, regulations, and internal policies, to fulfill our legal obligations, protect our legal interests, or to address legal claims or disputes.
• Security: To detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity .
• For any purpose where you have given your consent, where legally required.

We have grown in part through acquisitions of other companies and brands. If you were a customer or user of an acquired business prior to its acquisition by or integration with us, this section describes how we handle personal information we obtained as a result of that acquisition ("Legacy Data"). We will use and disclose your Legacy Data consistent with the privacy notice or policy in effect at the acquired business or brand at the time the Legacy Data was originally collected from you (the "Original Notice"). We may integrate Legacy Data into our systems, combine it with other personal information we hold about you, and apply our data security, retention, and access practices described elsewhere in this Notice to that data. Integration of Legacy Data into our systems does not, by itself, expand the purposes for which that data may be used beyond what was disclosed in the original notice you received at the time of collection of your data, if applicable, except as permitted by applicable law or as separately disclosed and consented to.

If we intend to use Legacy Data for a materially different purpose than disclosed in the original notice (for example, to support marketing across other Vireo brands, to include it in a group-wide loyalty program, or to share it with a broader set of Vireo affiliates than previously disclosed) we will, to the extent required by applicable law, provide notice and will honor any applicable opt-out or consent requirements under the law of your state of residence.

Disclosure of Your Personal Information

We may share your Personal Information with people and businesses that help operate and carry out our business, as well as when we are otherwise legally permitted or required to do so.

If necessary for the purposes described below, we may share your Personal Information with the following categories of recipients where permitted by law:

• Affiliates and subsidiaries within our corporate family to deliver products and services to you, ensure a consistent level of service across our products and services, and enhance our products, services and your customer experience.
• Professional advisors, such as lawyers, accountants, insurers, information security and forensics experts.
• Service providersto enable them to perform services on our behalf, including marketing vendors, advertisement agencies, cloud storage solutions, payment processors, technology providers, website and data hosting, product and Services delivery, data analytics, data security, ecommerce operations, surveys, research, administration of promotions, offers and loyalty programs and otherwise to help us carry out our business.

• Potential or actual acquirers or investors and their professional advisers in connection with any actual or proposed merger, acquisition, or investment in or of all or any part of our business.
• Competent law enforcement, government regulators and courts when we believe disclosure is necessary (i) to comply with the law, (ii) to exercise, establish or defend legal rights, or (iii) to protect the rights, property and safety of us, our consumers, business partners, service providers or another third party.

• Business Transfers. As we continue to develop our business, we may buy, merge, or partner with other companies. In such transactions, user information may be among the transferred assets. If a portion or all of our assets are sold or transferred to an affiliate, a third-party, customer information would likely be one of the transferred business assets. If such transfer is subject to additional mandatory restrictions under applicable laws, we will comply with such restrictions.

Additional Disclosures Related to Collection, Use, Disclosure of Personal Information , and Lawful Bases

The Personal Information we collect about you includes information within the below categories of data. Note that the “category” of data listed below refers to the category of Personal Information as defined under California law and represents the categories of Personal Information that we have collected, and how it has been shared, over the past 12 months. Inclusion of a category in the list below indicates only that we may collect some information within that category. We do not necessarily collect all information listed in a particular category, nor do we necessarily collect all categories of information for all individuals. While the categories are as defined under California law, the disclosures below also apply to residents of other states.

We have disclosed Personal Information in each of the categories listed below to our affiliates and subsidiaries, Partners, service providers, and other third parties, as well as to government entities where required, for our business purposes within the past 12 months. Please note that we have not necessarily disclosed every type of information listed in a given category. In addition, we have shared Internet or other electronic network activity information (as described below) with advertising and marketing partners for purposes of targeted advertising.

We do not sell your personal information to third parties.

We do not collect Sensitive Personal Informationas defined by California law.

Notice of Financial Incentive

We may offer financial incentives in the form of promotions, Reward Programs, and our Referral Program (collectively, the “Promotional Offer”) to consumers in exchange for voluntarily sharing certain Personal Information with us through our Sites. We offer Promotional Offers to understand and improve your satisfaction, experience, and relationship with us. You may opt-in to the Promotional Offers by sharing a referral code, signing up via a referral code, creating a Rewards Program profile, or as otherwise specified on our Sites. When you enter a Promotional Offer, we may collect Personal Information about you, including your name, phone number, email address, and birthday.

You may withdraw from participating in a Promotional Offer at any time as defined under the terms of the relevant Promotional Offer or, if undefined, by emailing us at [email protected]. Requests must include “Promotional Offer Opt-Out Request” in the email subject line and include your name, email address and telephone number associated with your submission to the Promotional Offer. Incomplete information will delay or possibly prevent our ability to honor your request. Please note that if you withdraw from a Promotional Offer, or submit a request to delete your Personal Information, your participation in that Promotional Offer will be terminated, which means, generally, that you will no longer be eligible for the benefits described in each such Promotional Offer, subject to the applicable Promotional Offer terms.

We do not generally assign specific monetary or other value to the Personal Information you submit and our Promotional Offers change continually. In conducting Promotional Offers, we assess that the  value of the Personal Information collected and used under each Promotional Offer is reasonably equivalent to the total value of the costs of conducting each Promotional Offer and the benefits or rewards provided to winners in each such Promotional Offers, based upon a practical and good-faith effort to assess on an aggregate basis for all collected information: (1) the type of Personal Information collected, (2) the use of such information by us in connection with our marketing activities, and (3) the number of individuals enrolled in respective Promotional Offers. These values can change over time. We reserve the right to add financial incentives to this Notice of Financial Incentives or to terminate the Promotional Offer at any time at our sole discretion.

Data Retention

Except as otherwise permitted or required by applicable law, we retain Personal Information in the categories set forth above only for as long as we have a legitimate business need to provide our services to consumers and our Partners.

To determine the appropriate retention period, we consider various criteria, including applicable law (such as reporting requirements, retention requirements, or applicability to any legal claims), whether the Personal Information continues to be necessary to provide our services; the amount, nature, and sensitivity of the Personal Information; the potential risk of harm to consumers from unauthorized use or disclosure; whether you have withdrawn your consent or objected to the processing of your personal information; whether we have an existing relationship with you; and the purposes for which we collect the Personal Information.

We continually review and enhance our retention practices in order to protect consumers while providing our services.

Your Privacy Rights

Depending on your state of residency, and the type of data collected, you may have rights with respect to your Personal Information, subject to certain exemptions provided by law . We may choose to extend these rights to you even if we are not required to under applicable law.

• Right to withdraw consent.Where our processing of your Personal Information is based on your consent, you have the right to withdraw your consent at any time. Note this does not affect the lawfulness of processing based on consent before withdrawal. Under the GDPR, we would stop processing your Personal Information unless there is another lawful basis upon which we rely, in which case we would let you know.
• Right to access/know.Depending on your jurisdiction, you may have the right to:

• Know and request information about the categories and specific pieces of personal information we have collected about you, as well as the categories of sources from which such information is collected, the purpose for collecting such information, and the categories of third parties, or specific third parties, depending on your jurisdiction, to whom we share such information, as well as the categories of personal information shared.

• Know if we have sold or disclosed your personal information, including the categories of third parties, or specific third parties, to whom we have sold personal information and the categories of the personal information sold.

• Know whether we use or sell your personal information for the purpose of training large language models.

• Right to correct/rectify. You may have the right to request correction of any inaccurate information we hold about you. We may not be able to accommodate your request if we believe it would violate any law, any legal requirements, or cause the information to be incorrect. Information solely retained for data backup purposes is generally excluded.
• Right to delete/erasure. You may have the right to request the deletion of your personal information, subject to certain exceptions.
• Right to restriction of processing. You may have the right to request that we restrict the processing of your personal data in certain circumstances, such as where you contest the accuracy of your data or object to our processing.
• Right to limit use and disclosure of sensitive personal information. To the extent we process or disclose your sensitive personal information, you may have the right to limit our use of this information.
• Right to opt-in to processing of sensitive personal information. To the extent we process your sensitive personal information, we may have to obtain your consent before processing it.
• Right to portable data.You may have the right to obtain personal information about you in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the information to another entity without hindrance.
• Right to appeal. You may have the right to appeal our decision regarding a request by email at [email protected]. Please use the same email address that you used to submit the initial privacy rights request when you submit your Request to Appeal and please add “Request to Appeal” in the subject line of the email. If you do not use the same email address, we cannot link your request to appeal to your initial privacy rights request.

Data solely retained for data backup purposes is principally excluded from these rights until it is restored to an active system or next accessed or used for a sale, disclosure, or commercial purpose. These rights also do not apply to pseudonymous data if the information necessary to identify the individual is kept separately and is subject to controls that prevent access to the information. Pseudonymous data is Personal Information that can no longer be attributed to a specific individual without the use of additional information, if the additional information is kept separately and is subject measures to ensure that Personal Information is not attributed to the specific individual.

Exercising Your Privacy Rights

To submit a privacy rights request, contact us using one of the methods listed in the “Contact Details” section below.

If you provided your minor child’s personal information while acting as a registered caregiver, you may subject a privacy rights request on behalf of your minor child.

You also may designate an authorized agent to make a request on your behalf. If you are submitting a request through an authorized agent, the authorized agent must provide us with your signed written permission stating that the agent is authorized to make the request on your behalf. Alternatively, your authorized agent may provide evidence of having power of attorney or acting as a conservator for you. We may also request that any authorized agents verify their identity and, where permitted by law, may reach out to you directly to confirm that you have provided the agent with your permission to submit the request on your behalf.

When you exercise these rights and submit a request to us, we may verify your identity where required by law by asking you for the following pieces of information: your relationship with us, first and last name, email address, telephone number, and postal address.

We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you. Making a verifiable consumer request does not require you to create an account with us. We will use the Personal Information you provide to us when submitting a consumer request only to verify the requestor’s identity or authority to make the request.

Depending on your jurisdiction, we generally have between 45 and 90 days to respond to your request.

There may be circumstances where we will not be able to honor your request, in which case, we will notify you. For example, if you request deletion, we may need to retain certain Personal Information to comply with our legal obligations or other permitted purposes. Additionally, if you continue to interact with our Sites and our services after you request deletion, this may result in us receiving your Personal Information despite having honored your previous request to delete. Depending on your jurisdiction, you may have the right to appeal this decision or to contact your Attorney General if you have concerns about the results of the appeal.

Please note that depending on your jurisdiction, we may only beobligated to respond, free of cost , to Personal Information requests from the same consumer up to two times in a 12-month period. Depending on your jurisdiction, after you have exceeded the applicable number of requests, we have the right to charge a reasonable fee for fulfilling the request. In addition, under the applicable state privacy law, and for the protection of your Personal Information, we may be limited in what Personal Information we can disclose.

Depending on your jurisdiction, we may maintain your rights requests for at least 2 years. This information will not be used for any other purpose except to review compliance processes; it will not be shared except as necessary to comply with a legal obligation.

Data Security

The security of your information is important to us. We have implemented reasonable security measures to protect the information, including without limitation, use of firewalls, encryption, cybersecurity controls, application controls and monitoring. No method of electronic storage or transmission over the Internet is 100% secure. While we strive to use commercially reasonable means to protect your information, we cannot guarantee complete security.

Minors and Children

The Sites are intended for general adult audiences. We do not knowingly collect, store, use, sell, or share the Personal Information of children who are under 18 years of age. If you believe we have collected such information, please contact us immediately at [email protected].

Third-Party Links

Our Sites may include links to third-party websites , plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control third-party websites and are not responsible for their privacy notice. If you submit Personal Information to any third-party websites or service providers, your information is governed by their privacy policies. When you leave our Sites, we encourage you to read the privacy notice on every website you visit.

Changes to this Notice

We reserve the right to change this Notice at any time in our sole discretion. If we make changes, we will post the revised notice here, so that you can see what information we gather, how we might use that information and in what circumstances we may disclose it. If we make a material change to this Notice, i.e. a change notifying you of materially different collection, processing, or transfer, we will notify of such change as required by law .By continuing to use our services after notice is provided, you accept and agree to this Notice as modified.

Contact Details

If you have any questions about this Notice, the ways we collect and use your Personal Information, or you would like to exercise your privacy rights, you may contact us at:

Prolific Supply LLC

Email:[email protected]

Mail:Prolific Supply LLC, 207 South 9th St., Minneapolis, MN 55402, Attn: Legal Department