Privacy Policy

1. Introduction

ScriptXchange, LLC ("ScriptXchange," "we," "us," or "our") is committed to protecting the privacy of our users. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use the ScriptXchange platform ("Platform"), including our website at pharmaxis.health and all associated services.

This Policy applies to all users of the Platform, including licensed prescribers, pharmacy partners, clinic administrators, and API integrators. Protected Health Information (PHI) processed on behalf of covered entities is governed separately by our HIPAA Notice and Business Associate Agreements.

2. Information We Collect

2.1 Account and Professional Information

When you register, we collect:

• Full name, email address, and contact information
• National Provider Identifier (NPI) and DEA registration number
• State pharmacy license numbers and licensing state(s)
• Practice name, address, and specialty
• Billing and payment information (processed by our PCI-compliant payment processor)

2.2 Platform Usage Data

We automatically collect:

• Log data including IP address, browser type, pages visited, and timestamps
• Device identifiers and operating system information
• API request logs including endpoints accessed and response codes
• Session activity and feature usage patterns

2.3 Patient and Prescription Data

When you use the Platform to manage patients and transmit prescriptions, we process patient demographic information and prescription data as a Business Associate under HIPAA. This data is handled in accordance with our HIPAA Notice and applicable Business Associate Agreements.

2.4 Communications

We retain records of communications you send to us, including support tickets, feedback, and correspondence, to improve our services and resolve disputes.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Platform and its features
• Verify prescriber credentials and maintain compliance with DEA and state pharmacy board requirements
• Process and route electronic prescriptions to pharmacy partners
• Send transactional notifications including order status updates and prescription confirmations
• Provide customer support and respond to inquiries
• Analyze usage patterns to improve Platform performance and user experience
• Detect, prevent, and investigate fraud, security incidents, and policy violations
• Comply with applicable legal obligations, including HIPAA, DEA regulations, and state pharmacy laws
• Send product updates and marketing communications (with your consent where required)

4. How We Share Your Information

4.1 Pharmacy Partners

When you place an order, we share the necessary prescription and patient information with the selected pharmacy partner to fulfill the order. All pharmacy partners have executed Business Associate Agreements with ScriptXchange.

4.2 Service Providers

We share information with trusted third-party service providers who assist us in operating the Platform, including cloud hosting (AWS), payment processing, email delivery (SendGrid), SMS notifications (Twilio), and analytics. These providers are contractually bound to use your information only as directed by us.

4.3 Surescripts and E-Prescribing Networks

For electronic prescription transmission, we share prescriber and prescription data with Surescripts and connected pharmacy benefit managers as required to route prescriptions through the Surescripts network.

4.4 Legal and Regulatory Disclosures

We may disclose information when required by law, court order, or government authority, including to the DEA, state pharmacy boards, or law enforcement agencies in connection with investigations of fraud or regulatory violations.

4.5 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity, subject to the same privacy protections described in this Policy.

5. Data Retention

We retain account and professional information for the duration of your subscription and for a minimum of seven (7) years thereafter to comply with DEA record-keeping requirements and applicable state pharmacy laws. Prescription and patient data is retained in accordance with applicable federal and state medical record retention requirements, which vary by state but are generally a minimum of seven (7) years.

6. Data Security

We implement industry-standard security measures to protect your information, including:

• AES-256 encryption for data at rest
• TLS 1.3 encryption for all data in transit
• Role-based access controls and multi-factor authentication
• Regular security audits and penetration testing
• Comprehensive audit logging of all PHI access events
• SOC 2 Type II compliance program

No method of transmission or storage is 100% secure. If you believe your account has been compromised, contact us immediately at security@pharmaxis.health.

7. Your Rights and Choices

Depending on your jurisdiction, you may have the right to:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information, subject to legal retention requirements
• Portability: Request your data in a machine-readable format
• Opt-out: Unsubscribe from marketing communications at any time via the unsubscribe link in any email or by contacting us

To exercise any of these rights, contact us at privacy@pharmaxis.health. We will respond within 30 days.

8. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to maintain session state, analyze usage, and improve the Platform. For detailed information, see our Cookie Policy. You can control cookie preferences through your browser settings, though disabling certain cookies may affect Platform functionality.

9. Children's Privacy

The Platform is intended for use by licensed healthcare professionals and is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected such information, contact us at privacy@pharmaxis.health.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a prominent notice on the Platform. Your continued use of the Platform after the effective date of any update constitutes your acceptance of the revised Policy.

11. Contact Us

For privacy-related questions or to exercise your rights:
Privacy Officer, ScriptXchange, LLC
Email: privacy@pharmaxis.health
Address: 1330 Pin Oak Rd, Katy, TX 77494