Privacy Policy

This summary provides key points from our Privacy Policy — use the table of contents below to jump to any section in full.

What personal information do we process? When you use our Services, we may process personal information depending on how you interact with the app and the features you use.

Do we process any sensitive personal information? Yes — health data, precise geolocation, biometric authentication results, and your state medical marijuana Registry ID. We do not process race, ethnicity, sexual orientation, or religious belief information; none of that applies to this app.

Do we collect any information from third parties? Only your own records, retrieved directly from the official Florida MMUR state registry using credentials you provide, at your explicit request. We do not purchase or receive data about you from data brokers, advertisers, or marketing partners.

How do we process your information? Primarily to calculate your dispensable allotment under Florida law, respond to your support inquiries, and comply with legal obligations. We process your information only when we have a valid reason to do so.

How do we keep your information safe? By design, most of it never leaves your device. See How AllotIQ Is Built for specifics.

How do you exercise your rights? Visit allotiq.com/privacy-request or email privacy@allotiq.com.

Personal information you disclose to us

In short: we collect personal information that you provide to us.

We collect personal information that you voluntarily provide when you use the app or contact us. This may include:

• Names
• Usernames and passwords for the Florida MMUR portal (not an AllotIQ account — there is no AllotIQ account system)
• State medical marijuana Registry ID
• Medical recommendation/certification dates
• Purchase/dispensation history

Sensitive information. When necessary, with your consent or as otherwise permitted by applicable law, we process:

• Health data
• Your state medical marijuana Registry ID (a government identifier)

Application data. If you grant permission, we also collect:

• Geolocation. Used to detect proximity to Florida dispensaries for purchase-logging reminders. This is not stored — see Section 5.
• Mobile device access to your calendar, camera, microphone, storage, and biometric authentication (Face ID/Touch ID/fingerprint). You can change these permissions at any time in your device's settings.

All personal information you provide to us must be true, complete, and accurate.

Information collected from other sources

In short: the only information we obtain that you didn't type directly into the app is your own record, pulled from the official Florida MMUR state registry, at your request.

When you use the MMUR sync feature, your device retrieves your own doctor recommendation orders, dispensation history, and card status directly from the State of Florida's official MMUR registry, using the credentials you provide. This is your own data, retrieved only because you logged in with your own credentials and explicitly requested it — it is not data purchased, brokered, or obtained from advertisers, data brokers, or any other third party.

In short: we process your information to deliver the app's core function, respond to your inquiries, protect the Services, and comply with the law.

• To deliver services. To calculate your dispensable medical marijuana allotment under Florida Administrative Code Rule 64-4.224, based on your synced or manually entered patient records.
• To respond to user inquiries/offer support. To respond to your questions and resolve issues you might have.
• To request feedback. To ask about your experience using the Services.
• To protect our Services. As part of efforts to keep the Services safe and secure.
• To comply with our legal obligations. To respond to legal requests and exercise or defend our legal rights.

In short: we may share information in the specific situation described below.

• Business transfers. We may share or transfer your information in connection with, or during negotiation of, any merger, sale of company assets, financing, or acquisition of all or part of our business by another company.

Outside of that scenario, we do not share your personal information with any third party.

In short: yes, two specific on-device features use real machine-learning models — everything else in the app, including the assistant's reasoning, is deterministic rule-based logic, not AI.

Our AI features are used for:

• Natural language processing — transcribing your spoken question to Mary into text.
• Image analysis — reading receipts, product labels, and QR codes via the camera.

How we process your data using AI. Both models are open-source, downloaded once, and run entirely on your own device. There is no third-party AI platform or API involved — your voice recordings and photos are never uploaded anywhere to be processed.

How to opt out. No account or contact required — simply use the manual alternatives built into the app. Type your question instead of using the microphone, and enter purchases manually instead of scanning a receipt or label. If you never use the microphone or camera-scan features, the on-device AI models are never downloaded or run on your device.

In short: for as long as it's on your device — we don't hold a copy anywhere else.

We do not retain your information on any server we operate — there isn't one. Your patient profile, purchase history, and MMUR credentials exist only in an encrypted database on your own device, for as long as you keep the app installed. Deleting a record within the app removes it immediately; uninstalling the app removes everything. There is no copy anywhere else for us to retain or delete on your behalf.

Your precise location specifically is not stored at all — it is used only in the moment to determine proximity to nearby dispensaries and is discarded immediately after.

In short: through real technical measures, not just a promise.

We use biometric app-lock (Face ID/Touch ID/fingerprint), store your MMUR credentials in your phone's secure hardware keychain rather than as plain text, and encrypt exported backup files with real AES-256-CBC encryption plus HMAC integrity verification, protected by a passcode you choose. Because there is no central server holding your data, the most common attack surface most apps have simply doesn't exist here. That said, no method of electronic storage is 100% secure, and we cannot guarantee absolute security.

In short: no.

We do not knowingly collect, solicit data from, or market to children under 18 years of age. By using the Services, you represent that you are at least 18. If we learn that personal information from a user under 18 has been collected, we will take reasonable measures to promptly delete it. If you become aware of any such data, please contact us at privacy@allotiq.com.

In short: you may review, access, correct, or delete your information at any time, depending on your state of residence.

Withdrawing your consent. If we are relying on your consent to process your personal information, you have the right to withdraw it at any time by contacting us — see Section 13 below. This will not affect the lawfulness of processing before withdrawal.

If you have questions about your privacy rights, email privacy@allotiq.com.

Most browsers and some mobile operating systems include a Do-Not-Track ("DNT") feature. No uniform standard for recognizing DNT signals has been finalized, so we do not currently respond to them. This is a low-stakes disclosure for this app in particular, since there is no tracking to opt out of in the first place — no analytics or advertising technology exists here to respond to such a signal.

In short: if you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to access, correct, obtain a copy of, or delete your personal information, and to withdraw consent to our processing of it. These rights may be limited in some circumstances by applicable law.

Categories of Personal Information We Collect

The table below shows the categories of personal information collected in the past twelve months, per applicable state law definitions.

We only collect sensitive personal information as permitted by law or with your consent. We do not collect or process sensitive personal information for the purpose of inferring characteristics about you.

Will Your Information Be Shared With Anyone Else?

We have not disclosed, sold, or shared any personal information with third parties for a business or commercial purpose in the preceding twelve months, and we will not do so in the future.

Your Rights

You have rights under certain US state data protection laws, including:

• Right to know whether we are processing your personal data
• Right to access your personal data
• Right to correct inaccuracies in your personal data
• Right to request deletion of your personal data
• Right to obtain a copy of the personal data you previously shared with us
• Right to non-discrimination for exercising your rights
• Right to opt out of the collection of sensitive data and personal data collected through a voice or facial recognition feature (Florida)

We do not engage in targeted advertising, sale of personal data, or automated profiling with legal or similarly significant effects, so the corresponding opt-out rights are not applicable in practice — there is nothing to opt out of.

How to Exercise Your Rights

Visit allotiq.com/privacy-request or email privacy@allotiq.com. You may designate an authorized agent to make a request on your behalf; we may require proof of that authorization.

Request Verification

Upon receiving your request, we will verify your identity using only the information provided in the request itself, since we don't hold a separate database to cross-reference against.

Appeals

If we decline to act on your request, you may appeal by emailing privacy@allotiq.com. We will respond in writing with the reasons for our decision. If your appeal is denied, you may submit a complaint to your state attorney general.

California "Shine the Light" Law

California Civil Code Section 1798.83 permits California residents to request, once a year and free of charge, information about what personal information (if any) we've disclosed to third parties for direct marketing purposes. As stated above, we do not share information with third parties for their own marketing purposes — if you'd still like to submit this request, contact us using the details in Section 13.

Unlike most apps, AllotIQ does not operate a server that stores your personal or medical information. Your patient profile, purchase history, and login credentials are stored exclusively in an encrypted database on your own device. When you sync with the Florida MMUR registry, your device connects directly to the State of Florida's official portal — that connection is never routed through or logged by us. When you use on-device AI features (voice assistant or receipt/label scanning), your voice recordings and photos are processed entirely on your device and are never uploaded anywhere. If our company ceased to exist tomorrow, your data would be entirely unaffected, because we never had a copy of it to begin with.

In short: yes, as necessary to stay compliant with relevant laws.

We may update this Privacy Policy from time to time. The updated version will be indicated by a revised "Last updated" date at the top of this page. We encourage you to review it periodically.

If you have questions or comments about this notice, contact our privacy contact by email at privacy@allotiq.com, or by post at:

AllotIQ
Data Protection Officer
1021 Rosetree Ln
Tarpon Springs, FL 34689-2854
United States

Based on applicable law in your state of residence, you may have the right to request access to, details about, correction of, or deletion of the personal information we hold about you, and to withdraw your consent to its processing. To make this request, visit allotiq.com/privacy-request.