Privacy Policy

This policy explains what information RxPortal collects, why, and what you can do about it. We have tried to write it plainly. If anything is unclear, email [email protected].

Who we are

RxPortal is a product of Pharmvisory LLC, a Utah limited liability company (“we”, “us”). You can reach us about anything in this policy at [email protected].

What this policy covers

• This website, rxportal.app.
• RxPortal accounts used by pharmacy staff and prescribers on each pharmacy’s own portal address (for example, yourpharmacy.rxportal.app).

RxPortal does not currently store patient health information. See Patient health information below.

This website

This website has no sign-up form, no analytics, no advertising or tracking pixels, no session recording, no chat widget and no embedded content from other companies. Its fonts are served from our own server. We do not set cookies on rxportal.app, and we do not use your visit to build a profile of you.

Like any website, your browser sends technical information, such as your IP address and browser type, so the page can be delivered. Our network provider (Cloudflare) and our hosting provider handle that information to deliver the site and protect it from attacks. Cloudflare may set a strictly necessary security cookie when it needs to tell people apart from automated traffic. It is not used for advertising or tracking.

If you email us, we keep your message and address so we can reply and keep a record of the conversation.

Information we collect in RxPortal accounts

Account information

• Name, email address, role and the pharmacy the account belongs to.
• For prescribers: professional credentials, NPI number, DEA number, state license number and state, clinic name, practice address and phone number. DEA numbers are stored encrypted.
• Your password, which we store only as an Argon2id hash that is then encrypted. We cannot see your password.
• If you turn on two-step sign-in: your passkey’s public key (never a private key or biometric data), or your authenticator app’s secret, stored encrypted.

Most of this comes from you or from the pharmacy that invited you. Changes a prescriber asks to make to their professional details are kept until the pharmacy approves or declines them.

Security and log information

• Our servers and our network provider, Cloudflare, see your IP address whenever you connect. We store the IP address and browser type (user agent) of each signed-in session, and the time it started and was last used.
• An audit log of security-relevant actions, such as sign-ins, failed sign-ins, account changes, prescriber approvals and catalog changes. Each entry records who acted, when, what changed and the IP address.
• Counters of recent sign-in attempts, used to limit password guessing. They hold a hashed form of your IP address and email address, not the addresses themselves, and are removed after about an hour, when RxPortal next clears old counters.
• A record of each system email RxPortal generates for you, such as an invitation or a password reset: the recipient, subject and body, stored in our database. When email delivery is turned on, sign-in links in the stored copy are redacted. Email delivery is not turned on yet, so for now the stored copy keeps the full message, including any sign-in link, so that our administrators can pass it on to you. Those links expire and work only once.

Cookies in the portal

When you sign in on a pharmacy’s portal address, we set one cookie: a session cookie that keeps you signed in. It is strictly necessary, works only on that exact address, cannot be read by scripts in the page, and lasts at most 12 hours. It is removed when you sign out. We use no other cookies, and none for analytics or advertising.

Patient health information

RxPortal does not currently store patient health information. If that changes, we will update this policy first, and before any patient information is stored we will have an agreement with the pharmacy covering it (a business associate agreement). We would then handle it only on the pharmacy’s behalf, under that agreement and the pharmacy’s HIPAA Notice of Privacy Practices, not under this policy.

If you are a patient with questions about your prescriptions or health information, please contact your pharmacy.

How we use information

• To provide RxPortal: create and run accounts, sign you in, and show you the right pharmacy’s portal.
• To prepare the emails the service needs, such as invitations, approvals and password resets, and to send them once email delivery is turned on.
• To keep RxPortal secure: limit sign-in attempts, investigate misuse and keep the audit log.
• To answer your messages and provide support.
• To meet legal obligations and enforce our Terms of Use.

We do not sell personal information. We do not share it for cross-context behavioral advertising, and we do not use it for advertising of any kind.

Who helps us run RxPortal

We use a small number of service providers, who may handle personal information only to provide their service to us:

• Hosting: the servers that run RxPortal and store its database (DigitalOcean).
• Network and security: the network that carries traffic to RxPortal and protects it from attacks (Cloudflare).
• Email delivery: when email delivery is turned on, Amazon Simple Email Service delivers RxPortal’s system emails.

We may also disclose information when the law requires it, to protect the safety or rights of people or of RxPortal, or as part of a merger or sale of the business, in which case this policy would continue to apply to it.

How long we keep information

• Account information: while the account is active, and afterwards as long as the pharmacy’s agreement with us or the law requires.
• Sessions: a session ends after 15 minutes without activity and expires after at most 12 hours. Its record is deleted when you sign out, or when an expired session is next presented. We do not yet run a scheduled cleanup, so the record of an expired session that is never presented again stays in the database until we remove it.
• Sign-in attempt counters: about an hour.
• Records of system emails: nothing deletes them automatically yet, so they are kept while the account exists and until we remove them. You can ask us to delete yours.
• Audit log: kept as a permanent security record. The application cannot edit or delete it; a database rule blocks changes.
• Backups: each nightly backup is encrypted, kept on our server for 14 days and then deleted. The key to decrypt them is stored separately. Information you delete can remain in backups for up to 14 days.
• Emails you send us: as long as needed to respond and keep a record of the conversation.

How we protect information

We use technical and organizational safeguards, including HTTPS for connections, two-step sign-in options, separation of each pharmacy’s records enforced in the database, encryption of sensitive fields, an append-only audit log, and encrypted nightly backups. No method of storing or sending information is perfectly secure, so we cannot promise that information will never be accessed without permission. If we learn of a breach that affects you, we will notify you and others as the law requires.

Your privacy rights

Utah residents

Under the Utah Consumer Privacy Act, Utah residents may ask us to confirm whether we process their personal data, and to access it, correct it, delete data they gave us, and receive a portable copy. You may also opt out of the sale of personal data and of targeted advertising. We do neither, so there is nothing to opt out of.

Residents of other states

Several other states give their residents similar rights. Wherever you live, you can ask us to tell you what personal information we hold about you, give you a copy in a portable format, correct it, or delete it. We do not sell personal information, share it for targeted advertising, or use it for profiling that produces legal or similarly significant effects, so there is nothing to opt out of. We honor these requests to the extent we can, subject to exceptions the law allows, such as information we must keep for security or legal reasons. Deleted information can remain in backups for up to 14 days.

How to make a request

Email [email protected]. We will confirm your identity, usually by replying to the email address on your account, before acting on a request. You may use an authorized agent; we may ask for proof that they act for you. We aim to respond within 45 days. If we need more time, we will tell you why.

If your account belongs to a pharmacy’s portal, some requests may need the pharmacy’s involvement, because the pharmacy decides what records it must keep. We will tell you if that is the case.

We will not treat you differently, or deny you service, because you used any of these rights.

Appeals

If we decline your request, you can appeal by replying to our decision or emailing [email protected] with “Appeal” in the subject. We will respond in writing within 60 days and explain our decision. If you are not satisfied, you may contact your state attorney general.

Global Privacy Control and Do Not Track

We do not track visitors across websites or for advertising, so there is nothing to switch off. If your browser sends a Global Privacy Control or Do Not Track signal, we treat it as a request to opt out of sale and targeted advertising, which we already do not do.

Children

This website is not directed to children under 13, and we do not knowingly collect their personal information. RxPortal accounts are only for adults 18 or older who work for or with a pharmacy. If you believe a child has given us personal information, email us and we will delete it.

Where information is stored

RxPortal is operated from, and its data is stored in, the United States.

Changes to this policy

If we change this policy, we will post the new version here with a new effective date. If a change materially affects how we use personal information, we will also tell account holders by email or in RxPortal before it takes effect.

Contact

Pharmvisory LLC, Utah. Email [email protected].