Except as otherwise provided in this section, information kept or maintained by a medical cannabis establishment may identify a cardholder only by registry identification number and may not contain names or other personally identifiable information.
A cardholder may, in writing, authorize an establishment to maintain the cardholder's name and other personally identifiable information, for the limited purpose of receiving direct communication regarding the cardholder's:
(1) Individual medical needs; or
(2) Use of a specific product.