Owner: Alliyson Bonner (Head of Field Ops & Claims) — outbound coordination + on-site disposition
Compliance: Ayisha "Balboa" Oglivie — regulatory notification + cure window
Inbound questions: Heaven Lee (T1) handles customer recall questions
Copy approvals: Tiana (Head of Content) drafts; Ayisha + Jonathan approve
Engineering: Robert "Rep" Taylor — fan-out pipeline, in-app banner
Operations oversight: Lola (Laura Daniels)
Author: Workflow Architect (Amena) — for Chief of Staff team
Status: Draft v0.1 — pending sign-off from Alliyson, Ayisha, Tiana, Heaven, Lola, Rep, Jonathan
Effective: TBD — after sign-off + recall pipeline tested + E10 recall-registration system live
Pairs with: §16 Channel Routing Map, §17.4 §8.2 (regulator-complaint edge), §17.5 Regulator-Direct, docs/REGULATORY_COMPLIANCE_MASTER.md
Supersedes: None
Cross-reference: SOP §17.3 step 4 (on-site recall disposition — Alliyson)
A recall event is registered in the system via the E10 recall registration flow. E10 is the system-of-record for whether a recall is active. §17.8 picks up from that registration event — this SOP is the customer-facing fan-out that runs once E10 says "we have a recall."
Recall triggers:
Inbound recall questions (a customer hears about a recall and asks us about it) come in via §16 normal customer-support channels. Heaven (T1) handles using the scripted recall-response from §3 below.
The entire customer-facing notification + refund/replacement + inbound-question-handling chain after a recall event is registered. Includes:
Actor: Alliyson (operational scope) + Rep (technical query) + Ayisha (regulatory scope).
Action: Identify the affected universe:
Timeout: Within 2 hours of recall registration. Within 30 minutes for severity Class I (life-threatening).
Output: A scope object stored on recall_event row.
Output on FAILURE:
FAILURE(scope_too_broad): When in doubt, broaden. False-positive notifications are recoverable; missed customers are not. Document over-broad reasoning.FAILURE(scope_too_narrow): Same posture — broaden if unsure.Actor: Ayisha (decides classification) + Alliyson + Jonathan.
Action: Classify per FDA recall classification:
| Class | Definition | Customer-comms urgency | Regulatory clock |
|---|---|---|---|
| Class I | Reasonable probability of serious adverse health consequences or death | Same-day notification, multi-channel | Notify FDA / DSHS within 24 hours |
| Class II | May cause temporary or medically reversible adverse consequences | Within 48 hours, multi-channel | Notify FDA / DSHS within 5 business days |
| Class III | Not likely to cause adverse health consequences (labeling, packaging, mislabeling) | Within 5 business days | Standard regulatory reporting |
Texas DSHS hemp-product recall: State-level coordination via DSHS. Timeline aligns with FDA classifications above per docs/REGULATORY_COMPLIANCE_MASTER.md.
Output: Recall class set on recall_event. Regulatory clock starts. §17.5 fires for regulator notification.
Actor: Tiana (drafts; Amena assists with structure and tone but does not send).
Action: Draft three artifacts:
Required elements per FDA + DSHS guidance:
support@gethempdash.com and phone)Tone: Plain, factual, calm. No corporate stiffness. No minimization. Per HempDash voice (feedback_amena_voice.md).
Timeout: Class I: 4 hours. Class II: 24 hours. Class III: 3 business days.
Actor: Ayisha.
Action: Review draft for regulatory accuracy. Required language per FDA / DSHS guidance. Edit or block.
Hard rules Ayisha checks for:
Actor: Jonathan.
Action: Reviews final copy + remediation policy (refund only? replacement option? return shipping at our cost?). Signs off.
Default remediation policy (subject to per-recall override):
Actor: Alliyson briefs Heaven + Alicia. Tiana provides talk-track.
Action:
Timeout: Before STEP 7 fan-out fires. T1 must be ready before the email goes out, because inbound starts immediately.
Actor: Rep (technical execution) + Alliyson (decides go-time) + Lola (operational confirmation).
Action:
gethempdash.com/recalls/{recall_id} goes liveTimeout: Within the regulatory clock per class. Internal target: Class I within 8 hours of registration; Class II within 48 hours; Class III within 5 business days.
Output on SUCCESS: All affected customers reached on at least one channel.
Output on FAILURE:
FAILURE(email_bounce): Customer email bounced. SMS fan-out and in-app banner still cover them. If both fail, customer remains in "not reached" bucket; Alliyson manually outreaches.FAILURE(unsubscribed_customer): Recall notifications override marketing-unsubscribe per industry practice. Recall is a transactional safety notification, not marketing. Document the override.FAILURE(rate_limit): Resend / SMS provider rate-limits at bulk send. Rep stages the batch. Document any send delay.Actor: Heaven (T1 primary), Alicia (mentor / fallback), Alliyson (T2 for edge cases).
Action: Use scripted response from §3. Standard pattern:
Actor: Heaven (processes refund / replacement) + Alliyson (handles disputes / edge cases) + Lola (oversight).
Action:
recall_remediation row per customerTimeout: Refund initiated within 1 business day of customer request. Funds returned per processor timeline (typically 3-5 business days).
Actor: Ayisha (regulator) + Tiana (press).
Action:
#press-monitor for awarenessActor: Alliyson + Rep.
Action: Track:
Target thresholds (FDA recall-effectiveness guidance):
If thresholds not met:
Actor: Ayisha (decides closure) + Jonathan (approves).
Action:
Closure does not delete the recall record. recall_event retained 7+ years.
Compressed timeline:
A vendor we sell from issues a recall. We propagate. Same workflow but:
The agency orders the recall. §17.5 is already running; §17.8 follows the agency's required language and timeline. Tiana's draft must include agency-required language verbatim where applicable.
§17.4 §2.2 multi-customer pattern (3+ unrelated customers reporting same issue inside 24h) flags. Investigation by T2 (Alliyson) + Ayisha. If they confirm a safety issue, decision tree:
Rare but possible. Customer sees a single email summarizing all affected orders, not N separate emails. Rep + Tiana coordinate combined-recall template.
Send to last-known email + SMS anyway (recall obligations don't require living recipient). If account is deceased per family request, do not pursue further; document.
If account holder is identified as minor (per §17.4 §8.5), notify the parent/guardian. Compliance + counsel review.
Notify customer of recall, cancel shipment, full refund automatic. Coordinate with Alliyson for carrier-side return-to-sender.
Vendor receives the recall notice via their vendor-portal channel (vendors@). Different remediation: pull from their inventory, vendor processes returns to HempDash. Alliyson coordinates B2B.
Scope widens after fan-out (more batches identified). Re-run STEPS 1, 3-7 for the additional scope. Existing customers don't get re-notified unless their order is in the new scope.
Initial signal turned out to be wrong; product is safe. Issue an "all clear" notification to everyone we recalled. Coordinate with regulator if they were notified. Document the false-alarm cause for post-mortem.
HANDOFF: E10 -> §17.8
PAYLOAD: {
recall_id: uuid,
trigger: enum('voluntary','regulator_directed','vendor_pass_through','multi_complaint'),
initial_scope: { sku_list: [str], batch_list: [str], date_range: [d, d] },
initial_class: enum('I','II','III','unknown'),
registered_by: str,
registered_at: timestamptz,
regulator_involved: bool,
source_notes: text
}
SUCCESS RESPONSE: { fanout_workflow_started: true, owner: 'alliyson' }
FAILURE RESPONSE: { ok: false, error: str }
TIMEOUT: 15 minutes (workflow must spin up)
ON FAILURE: PagerDuty P0 to Alliyson + Ayisha + Lola
HANDOFF: Alliyson -> Tiana (recall copy)
PAYLOAD: {
recall_id: uuid,
class: enum('I','II','III'),
scope: { sku, batch, lot, dates, count },
health_risk: text,
remediation_policy: text,
regulator_required_language: text?,
deadline_ts: timestamptz
}
SUCCESS RESPONSE: { drafts: { email_uri, sms_text, banner_text, public_page_uri } }
FAILURE RESPONSE: { ok: false }
TIMEOUT: per class — 4h / 24h / 3bd
ON FAILURE: Lola covers as backup drafter; Ayisha re-routes
HANDOFF: §17.8 -> §17.5
PAYLOAD: {
recall_id: uuid,
class: enum,
regulatory_clock_ts: timestamptz,
agencies: ['fda','dshs',...],
notification_required: bool
}
SUCCESS RESPONSE: { matter_id: uuid } // §17.5 regulatory_matter row
FAILURE RESPONSE: { ok: false }
TIMEOUT: Per class — 24h / 5bd / standard
ON FAILURE: Ayisha + Jonathan paged
HANDOFF: Rep -> Email/SMS/Banner fan-out
PAYLOAD: {
recall_id: uuid,
affected_customer_ids: [uuid],
email_template_uri: str,
sms_text: str,
banner_config: { flag_name, target_customer_ids, start_ts, end_ts },
return_shipping_label_endpoint: str?
}
SUCCESS RESPONSE: {
emails_sent: int, emails_bounced: int,
sms_sent: int, sms_failed: int,
banner_activated_for: int
}
FAILURE RESPONSE: { ok: false, partial_results: {...} }
TIMEOUT: Within class-window
ON FAILURE: Repeat with alternate channel; manual outreach for unreached
Subject: Important safety notice about {product_name} — please read
Hi {first_name},
We're writing to let you know that {product_name} (SKU {sku}, batch {batch_number}), which you purchased on {order_date}, has been recalled.
What happened: {plain_language_explanation}
Health risk: {risk_statement_per_class}
What to do:
1. Stop using the product immediately.
2. Reply to this email or visit gethempdash.com/recalls/{recall_id} to start a return.
3. We'll send a prepaid return-shipping label and process a full refund — or send a replacement product, whichever you prefer.
Questions: reply here, email support@gethempdash.com, or call +1 (469) 941-2104 and press 1.
We're sorry for any inconvenience. Your safety is the priority.
— Alliyson Bonner, Head of Field Ops & Claims
HempDash
HempDash safety notice: a product you ordered ({product_short}) has been recalled.
Stop use. Refund/replacement details: gethempdash.com/recalls/{recall_id}
Questions: reply HELP or call 469-941-2104.
Hi {first_name}, thanks for reaching out about this. Yes, {product_name} has been recalled — here's what I can do:
1. I can pull up your order and confirm whether yours is affected.
2. If it is, I'll send you a prepaid return label and process a full refund — or a replacement, whichever you prefer.
3. If it's not, you're not affected and your other orders are fine.
Want me to pull up your order now? I just need your email or order number.
— {agent_first_name}
SAFETY NOTICE: {product_short} has been recalled. Tap for details and to start a return.
Subject: Update on the {product_name} recall — all clear
Hi {first_name},
A few days ago we notified you about a recall on {product_name}. After investigation, we've confirmed that the product is safe and the original concern was a false alarm. We're sorry for the worry.
If you'd already started a return, we'll honor it — you can still keep the refund or get the product back, your choice. Reply here and I'll take care of it.
— Alliyson Bonner, Head of Field Ops & Claims
HempDash
| Stage | Class I | Class II | Class III |
|---|---|---|---|
| Scope determination | 30 min | 2 h | 1 business day |
| Severity classification | 1 h | 4 h | 1 business day |
| Copy drafted | 4 h | 24 h | 3 business days |
| Compliance + Jonathan approval | 1 h | 4 h | 1 business day |
| T1 briefed | Before fan-out | Before fan-out | Before fan-out |
| Fan-out fires | 8 h | 48 h | 5 business days |
| Regulator notification | 24 h | 5 business days | standard reporting |
| Effectiveness check | Daily for 14 days | Weekly for 30 days | Bi-weekly for 60 days |
Customer wasn't on the initial list (data gap). On detection, hand-outreach (call) within 24 hours. Document the gap in post-mortem.
Pull delivery logs (Resend, SMS provider). If we sent, document. If we didn't (data gap), send now and apologize. Either way, treat the customer's concern as a recall ticket and process remediation.
Escalates to Alliyson (T2). She has authority to add reasonable goodwill (extra credit, expedited shipping on replacement). Beyond her authority → Lola → Jonathan.
Critical. Heaven immediately escalates to Alliyson + Ayisha + Jonathan. Treat as P0:
§1.14.10 — re-run STEPS 1, 3-7 for new scope.
Failover to the working channel; manual call list for affected if both fail. Document outage. Resend recall when infra recovers.
We sent recall notices to customers whose product was not actually affected. Send a correction email within 24 hours acknowledging the error. Honor any returns initiated under the false notice.
Press picks up the recall before we've notified customers. Compress timeline; fan-out fires before press goes live if possible. If not, customers may hear from press first — accept that and move fast.
recall_event.regulatory_matter_id)CREATE TABLE recall_event (
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
registered_at TIMESTAMPTZ NOT NULL,
registered_by TEXT NOT NULL,
trigger TEXT NOT NULL, -- 'voluntary','regulator_directed','vendor_pass_through','multi_complaint'
recall_class TEXT, -- 'I','II','III'
scope_skus TEXT[],
scope_batches TEXT[],
scope_date_range DATERANGE,
affected_customer_count INT,
health_risk_summary TEXT,
remediation_policy TEXT,
regulatory_matter_id UUID REFERENCES regulatory_matter(id),
copy_email_uri TEXT,
copy_sms_text TEXT,
copy_banner_text TEXT,
public_page_uri TEXT,
fanout_started_at TIMESTAMPTZ,
fanout_completed_at TIMESTAMPTZ,
closed_at TIMESTAMPTZ,
closure_reason TEXT,
notes TEXT
);
CREATE TABLE recall_remediation (
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
recall_id UUID NOT NULL REFERENCES recall_event(id),
customer_id UUID NOT NULL,
order_id UUID,
outcome TEXT, -- 'refunded','replaced','disposed_self','no_response','injury_reported'
channels_reached TEXT[], -- ['email','sms','banner','phone','manual']
first_notified TIMESTAMPTZ,
customer_acked TIMESTAMPTZ,
resolved_at TIMESTAMPTZ,
refund_amount NUMERIC,
notes TEXT
);
CREATE INDEX idx_recall_remediation_recall ON recall_remediation(recall_id);
CREATE INDEX idx_recall_remediation_customer ON recall_remediation(customer_id);
CREATE INDEX idx_recall_event_class_open ON recall_event(recall_class) WHERE closed_at IS NULL;
recall_event and recall_remediation retained 7 years from closure. FDA recordkeeping standard. Class I retained 10 years per FDA guidance for serious-risk recalls.
gethempdash.com/recalls/{recall_id} — accessible by anyone with the URL while the recall is active.| # | Question | Owner | Why it matters |
|---|---|---|---|
| Q1 | E10 recall-registration system — live? Planned? Schema overlap with recall_event? |
Rep + Ayisha | Defines the entry point for §17.8. |
| Q2 | Return-shipping carrier — who and how do we generate prepaid labels? | Lola + Rep | Required for STEP 9. |
| Q3 | SMS provider — Alpine IQ planned (per alpine_iq_integration_status.md) but not integrated. Use what for v0.1? |
Rep + Lola | Required for STEP 7 SMS channel. |
| Q4 | In-app banner — feature flag plumbing for "show recall banner to these customer IDs"? | Rep | Required for STEP 7 banner. |
| Q5 | Recall page template at gethempdash.com/recalls/{recall_id} — built? |
Rep + Tiana | Required for STEP 7 + landing-link in email/SMS. |
| Q6 | recall_event and recall_remediation tables — new migrations, Katherine reviews. |
Rep | Migration gate. |
| Q7 | Marketing-unsubscribe override for recall notifications — legal basis documented? | Ayisha + counsel | Required for §1.8 FAILURE(unsubscribed) recovery. |
| Q8 | Effectiveness-threshold targets — FDA guidance suggests 95% reach. Confirm our internal targets. | Ayisha | Drives STEP 11 + closure decision. |
| Q9 | Vendor-pass-through coordination — vendor-portal workflow for vendor-issued recalls? | Lola + Tiana | Required for §1.14.2. |
| Q10 | Press holding statement library — pre-drafted templates per recall class? | Tiana + Ayisha | Speeds STEP 10 press coordination. |
recall_event and recall_remediation tables exist; Katherine reviewed.gethempdash.com/recalls/.| Version | Date | Author | Change |
|---|---|---|---|
| 0.1 | 2026-05-11 | Workflow Architect (Amena) | Initial draft. |
SOP index · Recall Execution · Recall Classification Matrix · Recall Fan-Out architecture · Home