Privacy Policy

1. Three kinds of data, governed differently

Most privacy policies describe one relationship. Ours has to describe three, and conflating them is how these documents become misleading.

If you are a patient, we do not have a direct relationship with you. Your privacy rights run against the brand you bought from and the professional entity that treated you. We act only on their documented instructions. See our HIPAA and business associate statement.

2. Information we collect from website visitors

• Information you give us. Name, work email, company, phone and anything else you enter when booking a demo or contacting us.
• Usage data. Pages visited, referring URL, approximate location derived from IP, device and browser type, and time on page.
• Cookies and similar technologies. See section 7.

We do not ask website visitors for health information, and you should not send health information to us through this website or by email.

3. Information we process for business customers

• Account data. Names, work contact details and roles of your users.
• Configuration data. Your treatments, intake forms, pricing and brand assets.
• Operational data. Order volumes, fulfillment performance, payment health and analytics.
• Billing data. The information needed to invoice you for platform fees.

We do not process your patients' card details. Payments settle into a Stripe account held in your organisation's name, and card data is handled by that processor under its own terms and PCI obligations. We store payment tokens only to the extent needed to operate the billing features you have enabled, and those tokens are exportable to you on request.

4. Protected health information

When a brand operates on PharmaBro, we process protected health information on that brand's behalf as a business associate under HIPAA. This includes intake responses, clinical messages, prescription records and shipment information.

We use and disclose PHI only as permitted by the executed Business Associate Agreement and as required to provide the service. We do not use PHI for our own marketing, do not sell it, and do not use it to train models.

5. How we use information

• To provide, operate, secure and improve the platform.
• To respond to enquiries and provide support.
• To invoice customers and collect fees.
• To send service and security notices, which you cannot opt out of while you hold an account.
• To send marketing about PharmaBro to business contacts, which you can opt out of at any time.
• To comply with legal obligations and to establish or defend legal claims.

We do not sell personal information, and we do not share it for cross-context behavioural advertising as those terms are defined under California law.

6. When we disclose information

• Subprocessors who provide infrastructure, communications and analytics on our behalf, under written terms and, where PHI is involved, a BAA. See our subprocessor list.
• Independent providers and pharmacies in your network, to the extent required to deliver care and fulfil an order.
• Professional advisers, under duties of confidentiality.
• Legal and regulatory recipients, where required by law or valid legal process. Where we are permitted to notify you first, we will.
• A successor in a merger, acquisition or asset sale, subject to this policy and to any applicable BAA.

7. Cookies

We use a small number of cookies and similar technologies: strictly necessary ones that make the site work, and analytics that tell us which pages are read. You can block cookies in your browser; strictly necessary cookies cannot be disabled without affecting the site.

We do not use advertising cookies that build a cross-site profile of you on this website.

8. Security

• Encryption of protected health information in transit and at rest.
• Role-based access control on least privilege.
• Audit logging of clinical, billing and record-access events, queryable per patient.
• Verification of provider credentials before any clinician accesses a patient record.
• A defined breach notification procedure, with timelines set out in the BAA.

PharmaBro does not currently hold SOC 2 Type II attestation. We state that here and on our security page rather than leave it to be discovered during procurement. No system is perfectly secure, and we do not represent otherwise.

9. Retention

We keep business customer data for the term of the agreement and for a defined period afterwards to meet legal, tax and audit obligations. Protected health information is retained and disposed of in accordance with the BAA and applicable medical record retention law, which is generally governed by the covered entity rather than by us.

Website enquiry data is kept only as long as needed to respond and to maintain a record of the contact.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete or receive a portable copy of your personal information, to opt out of sale or sharing, and to be free from discrimination for exercising these rights. Residents of California, Colorado, Connecticut, Utah and Virginia have specific rights under state law.

To exercise a right, write to support@pharmabro.co. We will verify your request and respond within the period required by applicable law. You may use an authorised agent where the law permits it.

If your request concerns health information held on behalf of a brand, we will refer you to that brand, because they, not we, are the covered entity able to act on it.

11. Children, international transfers and changes

The platform is not directed to children and we do not knowingly collect information from anyone under 18 through this website.

We operate in the United States and information is processed there. If you access the site from outside the United States, you are transferring information to the United States.

We may update this policy and will change the effective date above. Material changes will be notified to customers. Questions: support@pharmabro.co.