Privacy Policy

1. Scope

This Privacy Policy applies to personal information collected through the Services and the Website. It does not apply to third-party websites, applications, or services that may be linked from the Services.

The Services are designed exclusively for 503A compounding pharmacies operating under state Board of Pharmacy oversight. The Services are not designed for, and should not be used by, 503B outsourcing facilities or any entity subject to a different regulatory framework.

2. Information We Collect

2.1 Information You Provide

Account and Pharmacy Profile Information. When you register for the Services and complete the onboarding wizard, you provide pharmacy name, address, state, phone number, compounding types (sterile, non-sterile, or both), and DEA number. You also create login credentials (email address and password) and may set an administrator PIN. We use the state you enter to select state-specific regulatory content.

Staff Information. You may enter staff member names, roles, license numbers, certification dates (garbing/fingertip testing, media fill, annual training, competency evaluation dates), and contact information. Compliance records in the Services name the staff member you select for each action, as described in Section 10.7 of our Terms of Service.

Equipment and Operational Data. You may enter equipment types, model numbers, serial numbers, certification dates, and recertification frequencies. During daily operations, you may record checklist completions (with staff attribution), quantitative readings (temperature, humidity, differential pressure), cleaning documentation (agent, lot number, contact time), and environmental monitoring results.

AI Interaction Data. When you use the Ask AI feature, we collect the questions you submit, the AI-generated responses, associated citations, and confidence scores. Chat transcripts are stored in your account.

Documents. You may generate compliance documents using the AI document generation feature and register existing standard operating procedures (SOPs) and compliance documents in the document registry, including review dates and frequencies.

Training and Competency Data. We collect competency evaluation records for staff members across USP skill areas, including evaluator identity, evaluation dates, and proficiency ratings.

Legal Acceptance Records. When you accept our Terms of Service, this Privacy Policy, or the automatic renewal terms, we record the document version, the time of acceptance, your IP address, and your browser's user agent.

Support Communications. When you contact us for support, we collect the information you provide in your communications, including your name, email address, and the content of your request.

Website Forms. When you use the contact form on the Website, we collect your name, email address, pharmacy name, and message. When you request a resource through a Website form, we collect your name, work email address, pharmacy name, and state. Where resource request forms are offered, HubSpot hosts them and stores the entries in our customer relationship management system. A Website form may include a separate, optional box to receive marketing emails. We send marketing emails only if you check that box.

2.2 Information Collected Automatically

Usage Data. We collect information about how you interact with the Services, including login activity, features accessed, and general usage patterns. This data is used to maintain and improve the Services.

Technical Data. We collect device and browser information, IP addresses (for security and authentication purposes), and basic server log data necessary to deliver the Services.

Observability Data. We use an AI observability platform to monitor AI response quality. Each AI query generates a trace that includes the question and the response after the redaction step described in Section 5.2, retrieval scores, and quality metrics. Each trace carries a pseudonymized user identifier, not your account ID or email address.

2.3 Cookies, Tracking, and Protected Health Information

The Services. The Services do not use advertising trackers or third-party analytics tools, and do not use cookies for tracking or advertising. The Services store data in your browser only for functional purposes: session authentication, in-progress checklist state, and display preferences. The Services load fonts from Google Fonts, which receives your IP address and browser details when it serves the fonts. At sign-up, Cloudflare Turnstile checks that the request comes from a person, and processes device and browser signals for that purpose. Our error monitoring service receives technical details about errors and performance, and is configured to exclude personally identifiable information.

The Website. Netlify hosts the Website. The Website loads fonts from Google Fonts and a styling script from the Tailwind CSS content delivery network, and those providers receive your IP address and browser details when they serve those files. The Website stores the campaign source of your visit in your browser session so that it can pass that source to our sign-up page, and remembers whether you closed a banner. Where resource request forms are offered, HubSpot's tracking code sets cookies on the Website pages that carry those forms, to record visits to those pages and form submissions.

Activity across other websites. When you use the Website, the providers named in this section receive information about your visit to provide their services. We do not allow advertising networks or other parties to use the Website to collect personal information about your online activities over time and across different websites. The Services and the Website do not respond to browser "Do Not Track" signals, because neither tracks you across other websites.

No Protected Health Information. The Services are not designed to collect, store, or process Protected Health Information ("PHI") as defined under the Health Insurance Portability and Accountability Act ("HIPAA"). You must not upload, enter, or transmit PHI into the Services, and you must not send PHI to us by email. We do not offer Business Associate Agreements, because the Services are not designed to create, receive, maintain, or transmit PHI on your behalf. Section 10.3 of our Terms of Service describes the redaction step and what we do if we find PHI.

3. How We Use Your Information

We use your information for the following purposes:

To Provide the Services. We process your information to operate the platform, including generating AI-powered compliance guidance, tracking deadlines and checklists, producing compliance documents, managing staff and equipment records, calculating compliance scores, and generating exports.

To Maintain and Improve the Services. We use usage data, technical data, and AI observability traces to monitor system performance, identify and fix errors, and improve the accuracy and reliability of AI responses.

To Communicate with You. We use your contact information to send transactional communications (account notifications, subscription confirmations, security alerts, and notices about changes to our legal documents), respond to support requests, and, with your separate opt-in consent, send marketing communications such as product updates, compliance tips, and educational content.

To Protect Our Services and Users. We use technical data and login activity to detect unauthorized access, prevent fraud, and maintain the security and integrity of the Services.

To Comply with Legal Obligations. We process your information as necessary to comply with applicable laws, regulations, and legal processes, and we keep records of your acceptance of our legal documents.

To Generate Aggregated Insights. As described in Section 8.3 of our Terms of Service, we may use anonymized and aggregated data derived from your use of the Services for product improvement, analytics, research, and development. Such data is de-identified so that it cannot reasonably be used to identify you, any Authorized User, or any individual.

4. How We Share Your Information

We do not sell, rent, or trade your personal information. PharmComplyAI does not sell personal data as defined under any applicable state privacy law, including the Texas Data Privacy and Security Act and the California Consumer Privacy Act. We share your information only in the following circumstances:

Service Providers. We use third-party service providers to operate and deliver the Services and the Website. These providers process personal information to provide their services to us, under their agreements with us. Section 5.1 names each provider and its purpose.

Legal Requirements. We may disclose your information if required to do so by law, regulation, legal process, or enforceable governmental request, or to protect the rights, property, or safety of PharmComplyAI, our customers, or others.

Business Transfers. In the event of a merger, acquisition, bankruptcy, reorganization, or sale of all or substantially all of our assets, your information may be transferred as part of that transaction. We will notify you via email or prominent notice within the Services before your information becomes subject to a different privacy policy.

With Your Consent. We may share your information with third parties when you have given us your explicit consent to do so.

Aggregated or De-Identified Data. We may share aggregated or de-identified data that cannot reasonably be used to identify you for any legitimate business purpose, including product improvement, research, and industry benchmarking.

5. Service Providers and AI Data Processing

5.1 Our Service Providers

We use the following service providers. "Redacted query text" means text you submit to the AI features after the redaction step described in Section 5.2.

• Supabase: database, authentication, and file storage for Customer Data. Stores Customer Data in the United States.
• DigitalOcean: hosts the application servers and their logs, in the United States.
• Anthropic: generates AI answers and AI-drafted documents. Receives redacted query text and may process it outside the United States.
• Voyage AI: converts redacted query text into embeddings for search.
• Cohere: ranks search results for relevance. Receives redacted query text and may process it in the United States or Canada.
• Pinecone: stores and searches our regulatory knowledge base, in the United States. Receives only a numeric representation (embedding) of your query.
• Langfuse: monitors AI response quality, in the United States. Receives redacted text, a pseudonymized user identifier, and quality metrics.
• Sentry: error and performance monitoring, in the United States, configured to exclude personally identifiable information.
• Stripe: payment processing and billing records.
• Proton: sends our email. Processes email addresses and message content in Switzerland.
• Cloudflare: Turnstile bot protection at sign-up.
• Google Fonts: serves fonts for the Services and the Website.
• Netlify: hosts the Website and receives Website contact form entries.
• Tailwind CSS content delivery network: serves a styling script for the Website.
• HubSpot: where resource request forms are offered on the Website, hosts those forms and stores the entries in our customer relationship management system.
• GitHub: runs our internal operations reports, which include pharmacy account details and short excerpts of redacted query text.

When we delete a customer's data under Section 7.3, we also delete that customer's AI quality monitoring traces.

5.2 AI-Specific Data Practices

Your questions and conversation history pass through an automated redaction step before any AI provider receives them. The redaction is designed to detect identifiers in the categories listed in the HIPAA Privacy Rule's Safe Harbor standard (45 CFR § 164.514(b)(2)(i)), other than dates. It can miss an identifier, and it does not apply to data stored in the Services.

• Anthropic does not use inputs or outputs to train its models without our express permission, and we have not given that permission. Anthropic deletes inputs and outputs within thirty (30) days, except that it may keep them for up to two (2) years if they are flagged for a usage policy violation, or longer where the law requires.
• Voyage AI does not use our data to train its models, and deletes it after processing.
• Cohere does not use our data to train its models, and deletes logged requests after thirty (30) days.

Your questions are combined with retrieved regulatory content from our knowledge base to generate responses. The regulatory knowledge base contains publicly sourced interpretive guides, enforcement data, and compliance operations content authored by PharmComplyAI. It does not contain Customer Data.

6. Data Storage and Security

6.1 Data Location

Customer Data is stored in the United States. Some service providers process limited data outside the United States: our AI model provider may process redacted query text in other countries, Cohere may process redacted query text in Canada, and Proton processes email in Switzerland.

6.2 Security Measures

PharmComplyAI implements commercially reasonable administrative, technical, and physical safeguards to protect your information, including:

• Encryption in transit (TLS/HTTPS for all data transmission)
• Database-level security isolating each customer's data
• Role-based access controls
• Cryptographically hashed administrator PINs with rate-limited verification
• Error monitoring configured to exclude personally identifiable information
• Server-side sign-up abuse controls and bot protection
• Immutable audit trail design for compliance-critical records (checklist completions, competency evaluations, monitoring results, document reviews)

While we use reasonable measures to protect your data, no method of electronic storage or transmission is completely secure. We cannot guarantee absolute security.

6.3 Breach Notification

In the event of a data breach affecting your personal information, we will notify you in the most expedient time possible and without unreasonable delay, but no later than forty-five (45) days from the discovery of the breach, in accordance with the Tennessee Identity Theft Deterrence Act (T.C.A. Section 47-18-2107) and any other applicable breach notification laws. If the breach affects more than one thousand (1,000) individuals, we will also notify applicable consumer reporting agencies as required by law.

7. Data Retention and Deletion

7.1 During Active Subscription

Your Customer Data is retained and available through the Services for the duration of your subscription.

7.2 Selective Deletion During Active Subscription

You may request deletion of specific Customer Data at any time by contacting support@pharmcomplyai.com, and we will respond within thirty (30) days. You can delete chat conversations yourself in the Services. Some compliance records are kept unchanged by design, so that they stay reliable as audit evidence: for example, checklist completions, monitoring results, competency evaluations, document revisions and reviews, and the change history of your records. We can delete those records only when we delete your account data under Section 7.3.

7.3 Post-Termination

For ninety (90) days after your subscription ends, we will provide export files of your Customer Data on request to support@pharmcomplyai.com. After that period, we will delete your Customer Data within sixty (60) days, including from backup systems, except for the records described in Section 7.4.

7.4 Exceptions

After the deletion period, we may keep only: billing, payment, and tax records; records of your acceptance of our legal documents; anonymized and aggregated data as described in Section 8.3 of our Terms of Service; and limited data that applicable law requires us to keep, or that we need to resolve a dispute or enforce our Terms of Service.

8. Your Rights

Depending on your jurisdiction, you may have specific rights regarding your personal information. PharmComplyAI supports the following rights for all customers, regardless of location:

Access. You may request confirmation of whether we process your personal information and obtain a copy of that information.

Correction. You may request correction of inaccurate or incomplete personal information. Many corrections can be made directly through the Services (for example, updating staff records or pharmacy profile information in Settings).

Deletion. You may request deletion of your personal information, subject to the retention requirements described in Section 7.

Data Portability. You may export your data from the Services. Operational, training, monitoring, equipment, and audit records export in PDF, CSV, and JSON formats. Documents and conversations export in PDF.

Opt-Out of Marketing. You may opt out of marketing communications at any time by clicking the unsubscribe link in any marketing email or by contacting support@pharmcomplyai.com. Opt-out requests will be honored within ten (10) business days. Opting out does not affect transactional communications.

To exercise any of these rights, contact us at support@pharmcomplyai.com. We will respond to verified requests within forty-five (45) days. If we need additional time, we will notify you of the extension and the reason.

Staff members and other individuals. If a customer entered your information into the Services (for example, as a staff member), that customer controls it. We will refer your request to that customer and help the customer respond, as described in Section 10.8 of our Terms of Service.

9. California Privacy Rights

This section applies to California residents and supplements the information in this Privacy Policy.

9.1 Categories of Personal Information

In the preceding twelve (12) months, PharmComplyAI has collected the following categories of personal information as defined by the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"):

• Identifiers: Name, email address, phone number, IP address
• Professional or Employment-Related Information: Job title, role, license numbers, certification dates, competency evaluation records
• Internet or Other Electronic Network Activity: Login activity, feature usage patterns, device and browser information

9.2 Use and Disclosure

We collect this information for the business purposes described in Section 3. We do not sell or share (as defined by the CCPA) your personal information for monetary consideration or for cross-context behavioral advertising. We do not use sensitive personal information for purposes beyond those permitted by the CCPA.

9.3 Your CCPA Rights

California residents have the right to know what personal information we collect, the right to request deletion, the right to correct inaccurate information, and the right to not be discriminated against for exercising these rights. To exercise your rights, contact us at support@pharmcomplyai.com.

10. Children's Privacy

The Services are designed for pharmacy professionals and are not directed at individuals under eighteen (18) years of age. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected personal information from an individual under 18, we will take steps to delete that information promptly. If you believe we have inadvertently collected information from a minor, please contact us at support@pharmcomplyai.com.

11. Third-Party Links

The Services may contain links to third-party websites or resources that are not operated by PharmComplyAI. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party websites you visit.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Services, or applicable law. When we make a material change, we will present the updated Privacy Policy in the Services and ask you to accept it. A material change takes effect for you when you accept it. Until you accept, the version you last accepted continues to apply to your information, and you may not use the Services other than to review the updated Privacy Policy, accept it, or contact us. If applicable law requires notice of a change in a form you can keep, we will also send that notice by email to the address associated with your account. If you are a paying customer and do not agree to a material change, Section 21.2 of our Terms of Service describes your option to cancel with a refund of the unused prepaid period.

Non-material changes, such as clarifications or formatting updates, take effect when posted. For information collected only through the Website, a change takes effect when we post it. The "Effective Date" at the top of this policy shows when it was last revised.

13. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of the State of Tennessee, without regard to its conflict of laws principles, consistent with the Terms of Service.

14. Contact Us

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or have concerns about how your information is handled, please contact us:

Email: support@pharmcomplyai.com

We will respond to privacy inquiries within forty-five (45) days.