Privacy Policy

Last updated: 12 July 2026

In short: this is an informational website. We do not sell products online, we do not process payments, and we do not collect identity documents. The personal data we hold is limited to what you send us through the contact form, what you enter if you create an account, and standard website analytics.

1. Who we are

This website (medicalcannabiscenter.net) is operated by Kush Holding Co., Ltd., trading as Medical Cannabis Center ("MCC", "we", "us"). We are the data controller for the personal data described in this policy.

Registered address: 10 Soi On Nut 88/3 Road, Prawet District, Bangkok 10250, Thailand.

For any privacy question or request, contact us at info@medicalcannabiscenter.net.

2. What we collect

We collect personal data in three situations, and no others.

When you contact us

The contact form records your name, email address, and your message, plus your phone number, company, and subject if you choose to provide them. We use this only to respond to your enquiry and to keep a record of the correspondence.

When you create an account

An account stores your name, email address, an optional phone number, and an optional profile photo. Your password is never stored in readable form — only a bcrypt hash of it. An account is not required to browse this site.

When you browse

We use Google Analytics 4 to understand how the site is used. It collects usage data such as pages viewed, approximate location derived from your IP address, device and browser type, and a randomly generated identifier stored in a cookie.

We do not collect payment card details, delivery addresses, government identification documents, or health information through this website.

3. Why we are allowed to use it

Under Thailand's Personal Data Protection Act (PDPA), we rely on the following bases:

  • Your request: when you send an enquiry or create an account, we process your data to do the thing you asked for.
  • Legitimate interest: keeping the site secure, preventing abuse, and understanding in aggregate how it is used.
  • Consent: for analytics cookies, which you can refuse through your browser settings at any time.

4. Who else sees it

We do not sell personal data and we do not share it for advertising. Data is handled on our behalf by the following service providers:

  • Vercel — website hosting and file storage.
  • Neon — the database, hosted in the Asia-Pacific (Singapore) region.
  • Google — Analytics, and the Translate widget. If you switch the site into another language, the page content is sent to Google to be translated.
  • Our email provider — to deliver messages such as password resets.

Some of these providers operate outside Thailand, which means your data may be transferred abroad. We may also disclose data where we are legally required to.

5. Cookies

This site sets a small number of cookies:

  • A session cookie, if you log in, so that you stay logged in. It is removed when you sign out.
  • Google Analytics cookies, which measure site usage.
  • A language cookie, if you use the translation widget, which remembers your chosen language.

You can block or delete cookies in your browser settings. Blocking the session cookie will prevent you from logging in; blocking the others will not affect your use of the site.

6. How long we keep it

Enquiries are kept for as long as we need them to handle your request and to maintain a business record. Account data is kept until you ask us to delete the account. Analytics data is retained according to Google Analytics' own retention settings.

7. How we protect it

The site is served over HTTPS. Passwords are hashed with bcrypt and are never readable by us. Access to the administrative system is restricted to authorised staff, protected by role-based permissions, and changes are recorded in an audit log.

8. Your rights

Under the PDPA you may ask us to give you a copy of your personal data, correct it, delete it, restrict or object to how we use it, or withdraw a consent you previously gave. You also have the right to complain to the Personal Data Protection Committee.

To exercise any of these rights, email info@medicalcannabiscenter.net. We will respond within the period required by law.

9. Children

This site is not intended for anyone under 20 years of age, and we do not knowingly collect personal data from them.

10. Changes to this policy

If we change this policy we will update the date at the top of this page. Material changes will be announced on the site.

See also our Terms of Service.