Skip to content
Back to home

Policy

Privacy Policy

How ScriptExchange collects, uses, and protects your information.

Draft last edited: September 18, 2026

Draft — approval required. This page is pending product-owner and counsel review and is not an approved or effective policy.

1. Introduction

ScriptExchange, LLC ("ScriptExchange," "we," "us," or "our") is committed to protecting the privacy of our users. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use the ScriptExchange platform ("Platform"), including our website at scriptexchange.com and all associated services.

This Policy applies to all users of the Platform, including licensed prescribers, pharmacy partners, and clinic administrators. Protected Health Information (PHI) processed on behalf of covered entities is governed separately by our HIPAA Notice and Business Associate Agreements.

2. Information We Collect

2.1 Account and Professional Information

When you register, we collect:

  • Full name, email address, and contact information
  • National Provider Identifier (NPI) and DEA registration number
  • State pharmacy license numbers and licensing state(s)
  • Practice name, address, and specialty
  • Billing contact information for invoices issued to your organization. We do not collect or store payment card numbers.

2.2 Platform Usage Data

We automatically collect:

  • Server request logs generated by our hosting provider, including IP address, browser type, requested URL, and timestamps
  • Audit records of actions taken in the Platform, including the acting user, the action, the record affected, and the time it occurred

2.3 Application and Inquiry Information

When you submit a clinic, pharmacy, referral-partner, or career form, we collect the fields you provide. Career introductions include a PDF resume. We also retain submission metadata, including IP address and browser or user-agent information, for abuse prevention and review.

2.4 Patient and Prescription Data

When you use the Platform to manage patients and transmit prescriptions, we process patient demographic information and prescription data as a Business Associate under HIPAA. This data is handled in accordance with our HIPAA Notice and applicable Business Associate Agreements.

2.5 Communications

We retain records of communications you send to us, including support tickets, feedback, and correspondence, to improve our services and resolve disputes.

3. How We Use Your Information

We use the information we collect to:

  • Provide, operate, and maintain the Platform and its features
  • Review professional and organization information submitted for access or participation
  • Process and route electronic prescriptions to pharmacy partners
  • Send transactional notifications including order status updates and prescription confirmations
  • Provide customer support and respond to inquiries
  • Analyze usage patterns to improve Platform performance and user experience
  • Detect, prevent, and investigate fraud, security incidents, and policy violations
  • Comply with applicable legal obligations, including HIPAA, DEA regulations, and state pharmacy laws

4. How We Share Your Information

4.1 Pharmacy Partners

When an authorized clinic user places an order, we share the information required for the selected pharmacy to review and fulfill that order. Contractual and Business Associate Agreement requirements are governed by the agreements applicable to each relationship.

4.2 Service Providers

We use service providers to operate the Platform, including application hosting, managed database and authentication, transactional email, and the pharmacy-system or transmission provider configured for a participating pharmacy. The providers used for a particular order can vary by configuration. Their obligations are governed by the applicable service and data-protection agreements.

4.3 Prescription Transmission

For prescription transmission, the Platform shares the information required by the path configured for the selected participating pharmacy. Supported paths currently include direct pharmacy-system connections, a configured hub connection, and portal-managed workflows. Controlled-substance prescriptions are not supported.

4.4 Legal and Regulatory Disclosures

We may disclose information when required by law, court order, or government authority, including to the DEA, state pharmacy boards, or law enforcement agencies in connection with investigations of fraud or regulatory violations.

4.5 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity, subject to the same privacy protections described in this Policy.

5. Data Retention

Retention periods depend on the type of record, the agreements applicable to the participating organization, and applicable law. We keep information only for the period required for those purposes and obligations, then delete or de-identify it when permitted.

6. Data Security

Platform controls include:

  • AES-256-GCM authenticated encryption of Protected Health Information at the application layer, with fail-closed key handling: if the encryption key is unavailable, the Platform refuses to process PHI rather than storing it unprotected
  • Encrypted transport for Platform traffic and configured service connections
  • Multi-factor authentication (authenticator app or emailed one-time code) on portal accounts
  • Automatic sign-out after 30 minutes of inactivity
  • Role-based access controls
  • Audit logging of patient record access and of prescription, order, refill, and account changes

No method of transmission or storage is 100% secure. If you believe your account has been compromised, contact us immediately at security@scriptexchange.com.

7. Your Rights and Choices

Depending on your jurisdiction, you may have the right to:

  • Access: Request a copy of the personal information we hold about you
  • Correction: Request correction of inaccurate or incomplete information
  • Deletion: Request deletion of your personal information, subject to legal retention requirements
  • Portability: Request your data in a machine-readable format
  • Opt-out: Contact us to opt out of non-essential communications. Transactional messages about your orders and account cannot be opted out of while your account remains active.

To exercise any of these rights, contact us at privacy@scriptexchange.com. Requests are handled according to the identity-verification steps and response periods required by applicable law.

8. Cookies and Tracking Technologies

We use cookies to maintain session state. We do not use analytics or behavioral tracking cookies. For detailed information, see our Cookie Policy. You can control cookie preferences through your browser settings, though disabling certain cookies may affect Platform functionality.

9. Children's Privacy

The public website and its application forms are not directed to children. The Platform may process information about minor patients on behalf of participating healthcare organizations, subject to applicable agreements and law. We do not knowingly solicit personal information directly from children through public application or inquiry forms.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a prominent notice on the Platform. Your continued use of the Platform after the effective date of any update constitutes your acceptance of the revised Policy.

11. Contact Us

For privacy-related questions or to exercise your rights:
Privacy Officer, ScriptExchange, LLC
Email: privacy@scriptexchange.com
Address: 1309 Coffeen Avenue STE 1200, Sheridan, WY 82801