If you track your medical cannabis use, whether in a spreadsheet, a notebook, or an app, you are creating a record of sensitive personal data. That record includes your prescription details, your consumption patterns, and potentially your medical history. Understanding how that data is protected matters.
This article explains why cannabis tracking data is sensitive, what UK data protection law means for patients, and what to look for when choosing a tracking tool.
Why cannabis tracking data is sensitive
Your tracking data is not just a list of numbers. It reveals:
- Your prescription. The products, quantities, and frequency of your treatment, which is private medical information.
- Your consumption patterns. How much you use, when, and how, which could be misinterpreted or used against you.
- Your medical history. If you track symptoms, effects, and mood alongside your doses, you have built a detailed health journal.
This information could affect you in several contexts. Employers might make assumptions about cannabis use. Insurance applications might ask about prescriptions. And despite medical cannabis being legal in the UK since 2018, stigma persists — sharing this data inadvertently could have real-world consequences.
UK GDPR and your health data
Under UK GDPR, health data is classified as "special category data" — it receives the strongest legal protections. Any organisation processing your health data must have a lawful basis for doing so, and they must implement appropriate technical and organisational measures to protect it.
In practice, this means any app or service that stores your cannabis tracking data must:
- Be transparent about what data they collect and why
- Have a clear and accessible privacy policy
- Only process data for the purposes you have agreed to
- Implement risk-appropriate security measures such as encryption in transit and at rest
- Allow you to access, export, and delete your data on request
UK data protection law expects organisations to apply appropriate technical and organisational measures. While encryption is not required in every scenario, it is one of the strongest protections available and is considered best practice for handling special category health data.
Questions to ask any tracking app
Before you trust any app with your cannabis data, here are the questions worth asking:
- Do you sell or share my data? Some free apps monetise user data. If the app is free and the business model is unclear, your data may be the product.
- Is my data encrypted? Both in transit (when it moves between your device and the server) and at rest (when it is stored). Encryption should be standard.
- Can I export my data? Data portability is a GDPR right. You should be able to download your complete history in a usable format.
- Can I delete my data? Account deletion should mean complete deletion, not just deactivation. Check the privacy policy for retention details.
- Where is my data stored? UK GDPR has rules about international data transfers. Ideally, your data stays within the UK or EU.
What Grams Left does differently
We built Grams Left with privacy as a foundation, not an afterthought. Here is our approach:
- No data selling. We do not sell, share, or broker your cannabis, prescription, strain, or consumption data to anyone — not clinics, pharmacies, advertisers, insurers, employers, or data brokers. Ever.
- No ad targeting. We do not use your data for advertising or profiling. We do not build shadow profiles or infer anything beyond what you explicitly track.
- Explicit deletion. You can delete your account and all associated data at any time, from within the app. Deletion means deletion, not archiving or anonymised retention.
- Data export. You can download your complete tracking history as a CSV anytime from your account settings. Your data stays portable.
- Clear business model. Grams Left is free for the core tracker. Plus is a paid subscription for deeper features. We charge for features, not for your data. The business model is transparent because we want you to trust it.
You can read the full details in our privacy policy.
The bottom line
Your cannabis tracking data is sensitive personal information. Treat it that way. Whether you track in a notebook, a private spreadsheet, or an app, be intentional about where your data lives and who can access it. You have legal rights under UK GDPR — and you should expect any service you trust to respect them fully.