All data related to the implementation of this chapter, including, but not limited to, application forms, licensing information, physician certifications, registration of qualified patients and designated caregivers, compliance, and the status of cannabis research programs must be maintained in a secure system developed or procured by the commission. Data may not be sold, and patient information shall remain confidential, except as otherwise permitted pursuant to this chapter, and may not be transferred or sold.