Legal

Privacy Policy

Effective October 16, 2026 · Last updated October 24, 2026

This policy explains how Grass Valley Patient Resource Group (“HENDRX Genetics,” “HENDRX,” “we,” “us”) collects, uses, shares and protects personal information when you use our services. Our address is PO Box 2457, McKinleyville, CA 95519, and you can reach us at info@hendrx.farm.

State cannabis licenses: DCC Nursery Lic. CCL18-0001546 · DCC Self-Transport Lic. C13-0000119-LIC

1. What this policy covers

This policy applies to:

PhenoHunt, our breeding, nursery and cultivar records app at hendrxgenetics.com;
the open submission portal and website tools (strain library, review and booking forms) served from phenohunt-embed.web.app, including when they appear on partner websites;
the PhenoHunt Connect WordPress plugin, which displays those tools; and
emails we send about these services.

PhenoHunt is a business tool for HENDRX staff, partner farms and their teams. Partner websites that show our tools have their own privacy policies, which govern everything else on those sites.

2. Information we collect

Account information

When you sign in with Google or Microsoft we receive your name, email address and profile photo from that account. If you sign in with your email and a password instead (for example after an invitation from HENDRX), we store your email and a securely hashed password with our sign-in provider (Firebase Authentication); we never see or store the password itself. We create an account profile with your company, role and approval status. An administrator approves accounts before they can see company data.

Library Card members of the former hendrx.farm site. If you had a Library Card, or had applied for one, on the old hendrx.farm website, we copied your name, email and the details you gave there (such as phone and website) to set up your PhenoHunt account and invite you. Passwords from the old site were not copied.

Records you or your company add

Varieties and pedigrees, pheno hunts and selections, lab reports and certificates of analysis, cultivation and harvest reviews, sensory and effects reports, nursery, propagation and flower production records, plant health tests, orders and invoices, photos and uploaded files (for example CoA PDFs). Reviews and reports record the reviewer's name and email address.

Agronomic and genomic data exclusion: cultivar records, lineage pedigrees, chemotype analyses, phenotypic observations and genetic trial records are business records and agronomic data. They are not the “personal information” of the individual who enters them, and they are not subject to personal-information deletion requests where they form part of a shared, company or breeding ledger. The reviewer's name and contact details attached to them are personal information (see section 11).

Submissions through the portal and website forms

Form	What we collect
Public reviews (sensory, cultivation & harvest, lab results)	Your review, your name and your email address (required), plus any optional details you add such as phone, farm or company. Lab results also need the lab's certificate of analysis, as a PDF upload or a link. Uploaded PDFs are stored privately and only HENDRX staff can open them until the result is approved. Emails are never published.
Commercial license reviews	Your review, name, email, business name, license state and license number
Booking and preservation requests	Name, email, phone (optional), farm or company, and the request details
Wholesale and Library Card applications (hendrx.farm/apply)	Wholesale: company, contact name, email, phone, license number and type, region and website (optional). Library Card: name, email and a website or social media link. Both: notes (optional), your email-update choice, and a record that you accepted the User Agreement & Liability Release: the agreement's version and a fingerprint of its text, the name you typed as your signature, the date and time, the page, your browser type and the one-way code made from your IP address (not the IP address itself)
Delivery QR links (partner farms)	The harvest, quality and review details the farm enters

Technical information

IP address (forms only). To stop spam and abuse, our servers convert the IP address of each form submission into a one-way code and count submissions per code. We don't store the IP address itself, and the counters are deleted after a few days.
Error reports. If the app crashes, it may record your user ID, browser type and version, the page address and the error message so we can fix it.
Service logs. Our hosting and cloud providers keep standard server logs (such as IP address, time and requested page) for security and reliability.
Analytics on our public pages. The sign-in page at hendrxgenetics.com and the review submission portal use Google Analytics to count visits and see how people arrive (for example from hendrx.farm or a search engine), along with general device, browser and approximate location (city or region) information. Google Analytics uses cookies and receives your IP address. It runs only on those public pages: it's switched off as soon as you sign in, so nothing you do inside the app is sent to Google Analytics. Google receives the page address without its query or link code (so invitation and delivery links stay private), never your name, email or what you type. Google signals and ad personalization are off, and it doesn't load at all if your browser sends a Global Privacy Control signal.
Hosting performance monitoring. Our website host (currently GoDaddy) adds its own performance-monitoring script to the app's pages at hendrxgenetics.com. It measures how quickly pages load and records basic visit details (such as the page address, browser type and IP address) for GoDaddy's hosting service. It doesn't read what you enter in the app or the records you keep in it.

We do not use advertising cookies or third-party marketing pixels, and we don't sell personal information or share it for cross-context behavioral advertising.

3. How we use information

To provide PhenoHunt: sign-in, company workspaces, records, reports, sharing within your company and with partner farms you work with.
To review, approve and publish submissions. Approved reviews and lab results may appear, combined with others, on HENDRX and partner strain pages (see section 7).
To respond to booking, preservation and support requests.
To keep the services secure, prevent spam and abuse, and fix errors.
To send service emails and, if you agree, marketing emails (see section 9).
To meet legal obligations and enforce our Terms of Service.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

4. Automated document reading (AI)

When you choose to scan a lab certificate of analysis or plant health report, the file is processed through Google's Gemini API strictly to read and extract the analytical values into the form. You review and verify all values before they're saved. Certificates sent through our public review forms are never scanned automatically: HENDRX staff choose whether to scan them while reviewing the submission. Documents are processed transiently through Google's paid API service; uploaded diagnostic reports and laboratory data are not used by us, or shared with Google, to train public artificial intelligence foundation models.

5. Google account and Google Workspace data

Sign-in asks Google only for your basic profile (name, email, photo). If you use the optional Google Drive file picker, PhenoHunt asks for access only to the files you select (drive.file), and uses them only to attach that file to your record.

PhenoHunt's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We don't use Google user data for advertising, we don't sell it, and people don't read it except with your permission, for security, or as required by law.

You can remove PhenoHunt's access at any time at myaccount.google.com/permissions.

Within your company and with partners you work with

Data belongs to the company workspace it was created in, subject to any overarching commercial contracts, intellectual property covenants or Materials Transfer Agreements (MTAs) governing proprietary plant genetics, derived progeny or breeding selections. Approved members of your company can see your company's pedigree data, lab reports and cultivation reviews. Effects reports are visible to their author and to company staff. Partner farms see the records shared with them (for example their orders and delivery links).

Service providers

We use these providers to run the services. They process information only on our instructions:

Provider	Purpose
Google (Firebase and Google Cloud)	Sign-in, database, file storage, server functions, hosting of the submission portal and website tools
Google (Gemini API)	Reading uploaded lab documents when you ask it to (section 4)
Google Analytics	Measuring visits to our public pages only (section 2); see how Google uses this information
Website hosting provider (currently GoDaddy)	Hosting the PhenoHunt app at hendrxgenetics.com, including the host's page-performance monitoring (section 2)
Email provider	Sending service and marketing emails, when we use one

Other sharing

Legal reasons: to comply with law, legal process or regulators, or to protect rights, safety and security.
Business transfers: as part of a merger, acquisition or sale of assets, subject to this policy.
With your consent or at your direction.

California “Shine the Light”: we don't share personal information with third parties for their own direct marketing.

7. Public pages and partner websites

Strain pages on HENDRX and partner websites show combined results such as average ratings, common effects and lab ranges. They never show reviewer emails, phone numbers or license numbers. Submissions are reviewed by HENDRX before they appear. Partner websites that show our tools are responsible for their own pages and privacy policies.

Non-medical / FDA disclaimer: reported sensory effects and experiential descriptions on public strain cards reflect observational user reviews and laboratory chemotype testing. They are not medical advice, have not been evaluated by the US Food and Drug Administration or the California Department of Cannabis Control, and are not intended to diagnose, treat, cure or prevent any disease.

8. Cookies, browser storage and Do Not Track

We use your browser's storage only for things the services need: keeping you signed in (Firebase Authentication), caching your records so the app loads quickly, remembering settings, and running the demo, which stays in your browser. We don't use advertising cookies. On the public sign-in and submission pages only, Google Analytics sets its own cookies (_ga and _ga_ followed by an ID, lasting up to two years) to tell repeat visits apart; you can block them in your browser, use Google's Analytics opt-out add-on, or turn on Global Privacy Control. Clearing your browser's site data removes this information from your device.

Do Not Track and Global Privacy Control: we don't track you across other websites or use your information for advertising. If your browser sends a Global Privacy Control signal, Google Analytics doesn't load on our public pages; everything else works the same.

9. Emails from us

Service emails (invitations, account approval, order and submission updates, security notices) are part of using the services.
Marketing emails (news, releases, offers) are sent only to people who have agreed to receive them or who are business contacts where the law allows. Every marketing email includes our postal address and an unsubscribe link, and we honor unsubscribe requests within 10 business days. You can also unsubscribe by writing to info@hendrx.farm.

10. How long we keep information

Accounts and company records: for as long as the account or company workspace is active, then deleted or anonymized within 12 months unless the company asks us to keep or return them.
Published reviews and lab results: kept as part of the strain record. If you ask, we remove your contact details from your submissions.
Certificate of analysis PDFs you upload with a lab result: kept privately while the submission is reviewed. If it's approved, the PDF becomes the lab report's certificate. If it's rejected or marked as spam, the PDF is deleted automatically after 30 days; if the submission is deleted, its PDF is deleted with it.
Rejected submissions and booking requests: up to 24 months.
Signed agreement records: for as long as your account or business relationship with HENDRX lasts, plus four years, so we can show what was agreed. Declined or spam applications are deleted with their record after 30 days.
Spam-prevention counters: a few days. Error reports: up to 12 months.
Longer when the law requires it or to resolve disputes.
Google Analytics data: up to 14 months, then deleted automatically by Google Analytics.

11. Your choices and rights

You can ask us to:

tell you what personal information we hold about you and give you a copy;
correct inaccurate information;
delete your personal information, subject to legal exceptions, enterprise integrity requirements and your company's records; and
stop sending you marketing emails.

Your right to deletion applies to your personal identifying information, such as your name, personal email, phone number and account credentials. It does not apply to non-personal business records, aggregated commercial reviews, or permanent agricultural ledger entries such as variety registration history, lab analyses or trial records submitted to a workspace. When you ask us to delete your information, we remove or de-identify your personal details from those records instead.

Email info@hendrx.farm from the address on your account, or tell us which submission is yours. We'll confirm we received your request within 10 business days and respond within 45 days. We may need to verify your identity. You can use an authorized agent, and we won't treat you differently for using these rights. If your account belongs to a company workspace, some requests may be handled together with your company's administrator.

California residents have these rights under California law where it applies to us. Residents of other states may have similar rights, and we honor the requests above for everyone.

12. Security

We protect information with Google, Microsoft or password sign-in, administrator approval, per-company access rules, encryption in transit (HTTPS) and at rest (Google Cloud), spam and rate limits on public forms, and least-privilege access for staff. No system is perfectly secure. If a breach affects your personal information, we'll notify you as the law requires.

13. Age requirement

Our services involve cannabis genetics and are intended only for adults 21 and older. We don't knowingly collect information from anyone under 21, and we don't direct our services to children. If you think someone under 21 has given us information, contact us and we'll delete it.

14. Where information is stored

Information is stored and processed in the United States. If you use the services from outside the US, your information is transferred to the US.

15. Changes to this policy

We'll post changes on this page and update the date at the top. If a change materially affects how we use personal information, we'll tell account holders by email or in the app before it takes effect.

16. Contact us and licensing

Grass Valley Patient Resource Group (dba HENDRX Genetics)
PO Box 2457, McKinleyville, CA 95519
Email: info@hendrx.farm
State cannabis licenses: DCC Nursery Lic. CCL18-0001546 | DCC Self-Transport Lic. C13-0000119-LIC