Privacy Policy

1. Who We Are

SendRx.to is a specialty pharmacy routing and formulary reference platform designed exclusively for licensed healthcare professionals. We provide drug-level information on pharmacy routing, prior authorization requirements, savings programs, and buy-and-bill acquisition — to assist prescribers and their staff in managing specialty medication logistics.

We are not a healthcare provider, pharmacy, pharmacy benefit manager, insurance plan, or covered entity under HIPAA in connection with the use of this Platform.

2. Information We Collect

2a. Account Registration Information

When you create an account, we collect:

• Healthcare providers / prescribers: first and last name, professional credentials (e.g., MD, DO, NP, PA), email address, NPI number, practice name, practice address, city, state, ZIP code, and phone number.
• Pharmaceutical representatives: name, email address, company or employer name, and drug or product associations managed on the Platform.
• Pharmacy staff: name, email address, and associated pharmacy information.

2b. Usage and Activity Data

When you use the Platform, we automatically collect:

• Drug lookups and searches performed on the Platform;
• Pharmacy routing interactions and saved associations;
• Sample requests submitted through the Platform;
• Log data, including IP address, browser type, operating system, pages visited, and timestamps; and
• Device information sufficient to deliver and maintain the Platform.

2c. Communications

If you contact us by email or through the Platform, we retain the content of your communications and your contact information for the purpose of responding and improving the Platform.

2d. NPI Registry Data

We may look up and store provider and pharmacy information from the CMS National Plan and Provider Enumeration System (NPPES) NPI Registry, which is a publicly available federal database. This includes publicly listed practice name, address, phone, and taxonomy information associated with your NPI.

3. What We Do Not Collect — No Patient Data

Users are expressly prohibited from entering patient-identifiable information into the Platform. If you believe patient information has been inadvertently submitted, please contact us immediately at answers@sendrx.to.

4. How We Use Your Information

We use the information we collect to:

• Provide and operate the Platform — including account management, drug lookup, pharmacy routing, and sample request features;
• Verify professional credentials — NPI numbers may be used to confirm eligibility for access to professional-use features;
• Communicate with you — including platform updates, account notices, and responses to your inquiries;
• Improve the Platform — analyzing usage patterns (in aggregate or de-identified form) to enhance features and accuracy;
• Maintain security — detecting and preventing unauthorized access, fraud, and misuse; and
• Comply with legal obligations — responding to lawful requests from regulatory authorities or courts.

We do not use your information for automated clinical decision-making, advertising targeting, or sale to third parties.

5. How We Share Your Information

We do not sell, rent, or trade your personal information. We may share information in the following limited circumstances:

5a. Service Providers

We use third-party vendors to operate the Platform. These providers have access to your information only as necessary to perform their functions and are contractually prohibited from using it for other purposes:

• Supabase — database and authentication infrastructure (hosted in the United States);
• Vercel — web hosting and deployment infrastructure (United States);
• CMS NPPES — NPI verification (U.S. federal public database, read-only).

5b. Within the Platform

Certain profile information — such as your name, practice name, and NPI — may be visible to other verified users of the Platform (e.g., pharmaceutical representatives who receive sample requests you submit). We limit visibility to information relevant to the professional function of the Platform.

5c. Legal Requirements

We may disclose information when required by law, subpoena, court order, or regulatory request, or when we believe in good faith that disclosure is necessary to protect the rights, property, or safety of SendRx.to, its users, or the public.

5d. Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of our assets, your information may be transferred to the successor entity, subject to the same privacy protections described in this Policy.

6. Cookies and Tracking Technologies

We use essential cookies and session tokens to authenticate users and maintain secure login sessions. We do not use third-party advertising cookies or cross-site tracking.

We may use basic analytics to understand how the Platform is used (e.g., page visits, feature usage) in aggregate form. This data does not identify individual users.

You may disable cookies through your browser settings, but doing so may prevent certain Platform features — including login — from functioning correctly.

7. Data Retention

We retain your account information for as long as your account is active or as needed to provide the Platform. If you request account deletion, we will remove or de-identify your personal information within a reasonable period, except where retention is required by law or legitimate business necessity (e.g., audit logs, legal disputes).

Log and usage data may be retained in aggregate or de-identified form for longer periods for platform improvement purposes.

8. Data Security

We implement industry-standard technical and organizational measures to protect your information against unauthorized access, disclosure, alteration, and destruction. These include encrypted data transmission (TLS), access controls, and secure hosting infrastructure.

No method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, and you use the Platform at your own risk. You are responsible for maintaining the confidentiality of your login credentials.

9. Your Rights and Choices

Depending on your location, you may have the right to:

• Access the personal information we hold about you;
• Correct inaccurate or incomplete information in your account;
• Delete your account and associated personal information;
• Object to or restrict certain processing of your information; and
• Data portability — receive a copy of your information in a structured format.

To exercise any of these rights, contact us at answers@sendrx.to. We will respond to verified requests within 30 days. We may need to verify your identity before fulfilling a request.

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA). We do not sell personal information as defined under the CCPA.

10. HIPAA — Our Role and Limitations

SendRx.to operates as a professional reference tool, not as a covered entity or business associate under HIPAA in connection with the Platform's standard use. The Platform is not designed, built, or certified to receive, store, transmit, or process PHI.

If your use of the Platform involves the creation, receipt, maintenance, or transmission of PHI on behalf of a covered entity, you are solely responsible for ensuring compliance with applicable HIPAA requirements. SendRx.to does not execute Business Associate Agreements (BAAs) in connection with general Platform access.

11. No Use by Minors

The Platform is not directed to individuals under 18 years of age. We do not knowingly collect personal information from minors. If we learn that a minor has provided personal information, we will delete it promptly.

12. Third-Party Links

The Platform may link to third-party websites, including specialty pharmacy portals, drug manufacturer savings program enrollment pages, and insurance plan resources. These sites have their own privacy policies, and we are not responsible for their practices. We encourage you to review their policies before providing any personal information to third-party sites.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page. For material changes, we will provide notice through the Platform or via the email address associated with your account. Your continued use of the Platform after any change constitutes acceptance of the updated Policy.

14. Contact Us

For questions, requests, or concerns regarding this Privacy Policy or our data practices, please contact: