Medical cannabis has been legal in the UK since November 2018, when it was rescheduled under the Misuse of Drugs Regulations 2001. But legality does not mean your data is automatically protected — understanding how UK law treats your cannabis tracking data is important for every patient.
Legality is not the same as privacy, and the legal status of cannabis says nothing about how the data you generate while tracking it must be handled.
Medical cannabis law in the UK: a quick overview
In November 2018, the UK government rescheduled cannabis-based products for medicinal use from Schedule 1 (no therapeutic value) to Schedule 2 (recognised medical use) under the Misuse of Drugs Regulations 2001. This means specialist doctors on the General Medical Council's specialist register can prescribe cannabis-based medicinal products where they believe it is in the patient's best interest.
In practice, medical cannabis is typically prescribed by private clinics — NHS prescriptions remain rare. Patients receive a prescription that specifies the product, quantity, and dosage. Possession is legal when the product is used in accordance with that prescription.
This is the legal context for Grams Left and for any tracking tool: medical cannabis is a prescribed medication, and tracking it is part of managing your treatment, just as you might track any other prescribed medication.
What UK GDPR means for your tracking data
Under UK GDPR, health data is classified as "special category data" — it receives the strongest legal protections. Your cannabis tracking data falls into this category because it reveals information about your prescription, your consumption patterns, and potentially your medical history.
Any organisation processing your tracking data must:
- Have a lawful basis for processing (typically consent or contract).
- Implement appropriate technical and organisational measures to protect it.
- Be transparent about what data they collect and why.
- Allow you to access, correct, export, and delete your data.
- Report certain types of data breaches to the ICO within 72 hours.
For special category data specifically, an additional condition under Article 9 of UK GDPR must be met — typically explicit consent. Grams Left obtains this consent at sign-up, and you can withdraw it at any time by deleting your account.
Your data rights as a UK patient
Under UK GDPR, you have several specific rights regarding your data:
- Right to be informed. You must be told what data is collected and how it is used, in clear, plain language — not buried in legal jargon.
- Right of access. You can request a copy of all data held about you. This should be provided free of charge and within one month.
- Right to rectification. If your data is inaccurate, you can have it corrected.
- Right to erasure. You can request that your data be deleted. For tracking data, this should be self-serve and immediate.
- Right to data portability. You can receive your data in a structured, machine-readable format (CSV or JSON) and take it elsewhere.
- Right to object. You can object to processing of your data, particularly for direct marketing — though Grams Left does not do this.
If you believe your rights have been violated, you can complain to the Information Commissioner's Office (ICO), the UK's data protection regulator.
What to look for in a privacy policy
A good privacy policy for a cannabis tracking app should be clear about:
- What data is collected (be specific).
- Why each piece of data is collected (the purpose).
- The lawful basis for processing (consent, contract, legitimate interest).
- Who has access to the data (processors, sub-processors).
- Where the data is stored (country and infrastructure).
- How long data is retained.
- Whether data is shared or sold (this should be a clear "no").
- How to exercise your rights (export, delete, complain).
If a privacy policy is vague, hard to find, or uses language that avoids clear answers, treat that as a warning sign. A tool handling sensitive medical data should be transparent about its practices.
How Grams Left approaches data protection
Grams Left was built in the UK with UK GDPR as the baseline. We have published a full privacy policy and a visual overview of how we handle your data — including what we collect, where it goes, and what we never share.
The core tracker is free, and the business model is transparent: we charge for Plus features, not your data. If you have questions about how your data is handled, contact support@gramsleft.com. And if you want to start tracking, sign up free — no card required.