1. Introduction

Rx Compliance360 Partners ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our compliance management platform, web portal, mobile applications, AI-powered tools, and related services (the "Services").

By using our Services, you consent to the practices described in this Privacy Policy. If you do not agree with this policy, please do not use our Services.

2. Information We Collect

2.1 Information You Provide Directly

We collect information that you voluntarily provide when using our Services:

Account and Organization Information:

• Full name, email address, phone number, job title
• Organization name, organization ID, business type
• Pharmacy locations and addresses
• Billing contact information and payment details

License and Registration Information:

• State pharmacy license numbers and expiration dates
• DEA registration numbers and renewal dates
• Controlled substance license information
• Pharmacist and pharmacy technician license details
• CMEA registration information
• Medicaid and Medicare provider enrollment data
• Business licenses, zoning permits, and local registration details
• Professional accreditations (URAC, ACHC, VIPPS)

Credential Vault Information (Encrypted):

• Portal usernames and passwords for state boards, DEA, Medicaid, Medicare, 340B OPAIS, NABP, wholesaler portals, PBM portals
• Security questions and answers
• PINs, account numbers, and additional authentication details
• Sharing preferences (whether service team can access credentials)

Documents and Files:

• License certificates and renewal documents
• Application forms and supporting documentation
• Permits, contracts, and agreements (340B, Medicaid, Medicare, wholesaler, PBM)
• Standard Operating Procedures (SOPs) and training manuals
• Accreditation certificates
• Proof of payment documentation (checks, receipts, screenshots)
• Any other compliance-related documents you upload

Service Requests and Applications:

• Project descriptions and service request details
• Application information (state, type, location, timeline)
• Desired completion dates and special requirements
• Notes and additional instructions
• Proof of agency fee payments

Communications:

• Support requests and inquiries
• Email correspondence
• AI chatbot conversations (compliance Q&A, zoning research)
• WhatsApp messages (if you connect our AI assistant)
• Feedback and survey responses

Alert Preferences:

• License alert settings (90/60/30-day notifications)
• Email frequency preferences (immediate, daily, weekly, monthly)
• Subscribed states for regulatory alerts
• Notification preferences and opt-out choices

2.2 Automatically Collected Information

When you use our Services, we automatically collect certain information:

• Usage Data: Pages viewed, features accessed, time spent, buttons clicked, search queries
• Device Information: IP address, browser type and version, operating system, device identifiers, screen resolution
• Log Data: Access times, error logs, performance metrics, API calls
• Location Data: Approximate geographic location based on IP address
• Referral Data: How you arrived at our website (referral source, search terms)

2.3 Information from Third Parties

• Payment processors (transaction confirmations, payment status)
• Authentication providers (if you use single sign-on)
• AI service providers (responses to your queries)
• Email delivery services (delivery status, open rates)

2.4 AI-Processed Information

When you use our AI-powered features, we process:

• Your questions and prompts to AI compliance assistants
• Uploaded documents sent to OCR/AI for data extraction
• Conversation history with AI chatbots
• Regulation documents uploaded for AI analysis

3. How We Use Your Information

3.1 To Provide Core Services

• Track license expirations and send automated 90/60/30-day email alerts
• Store and manage compliance documents in encrypted cloud storage
• Securely store portal credentials in AES-256 encrypted vault
• Process service requests and license applications on your behalf
• Submit applications to government agencies (with your authorization)
• Generate compliance reports, dashboards, and analytics
• Enable multi-user access with role-based permissions

3.2 AI-Powered Features

• Provide AI compliance Q&A assistance for regulatory questions
• Power AI zoning and business research assistant
• Extract data from uploaded documents using OCR technology
• Auto-fill forms with AI-extracted license information
• Analyze uploaded regulations and extract key information
• Generate AI-powered compliance recommendations

3.3 Communications and Alerts

• Send license expiration alerts via email
• Deliver compliance digest emails (weekly or monthly)
• Send state-specific regulatory updates and alerts
• Provide service request status updates
• Send invoice and payment reminders
• Respond to customer support inquiries
• Send important service announcements
• Deliver marketing communications (with your consent, can opt out)

3.4 To Improve Our Services

• Analyze usage patterns and user behavior
• Identify and fix technical issues and bugs
• Develop new features and functionality
• Improve AI model accuracy and responses
• Conduct research and analytics on compliance trends
• Train and improve our OCR and document scanning capabilities

3.5 For Legal and Security Purposes

• Comply with legal obligations and court orders
• Respond to subpoenas and government requests
• Protect against fraud, security threats, and abuse
• Enforce our Terms of Service and Acceptable Use Policy
• Protect our rights, property, and safety
• Maintain audit logs and activity records

4. How We Share Your Information

We may share your information in the following specific circumstances:

4.1 With Your Explicit Consent

• When you authorize us to access portal credentials from your encrypted vault to submit applications
• When you grant permission for specific data sharing

4.2 With Government Agencies

• When submitting license applications, renewals, or regulatory filings on your behalf (only with authorization)
• State Boards of Pharmacy
• Drug Enforcement Administration (DEA)
• Centers for Medicare & Medicaid Services (CMS)
• Local and state government agencies for business licenses and permits

4.3 With Service Providers and Technology Partners

We share information with third-party service providers who perform services on our behalf. These providers are contractually obligated to protect your information:

• Cloud Hosting: Amazon Web Services (AWS) or similar for secure data storage and infrastructure
• Payment Processing: Stripe, PayPal, or similar for billing and invoicing (they handle credit card data directly)
• Email Services: SendGrid, Mailgun, or similar for transactional emails and alerts
• Analytics: Google Analytics or similar for usage tracking and reporting
• AI Services: OpenAI, Anthropic, or similar for powering AI chatbots and compliance assistants
• OCR Services: AWS Textract, Google Vision, or similar for document scanning and data extraction
• Communication: Twilio or similar for WhatsApp integration (if you enable)
• Customer Support: Helpdesk and ticketing systems

4.4 Within Your Organization

Users within your organization who have appropriate access permissions may view organizational data:

• Admin users: Full access to all organizational licenses, documents, credentials, and applications
• Regular users: View-only access to licenses, documents, and applications

4.5 For Legal Reasons

• When required by law, regulation, court order, or legal process
• In response to subpoenas or government investigations
• To protect our rights, property, safety, or that of our users
• To enforce our Terms of Service
• To investigate fraud, security issues, or policy violations

4.6 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of assets, your information may be transferred to the acquiring entity. We will notify you before your information is transferred and becomes subject to a different privacy policy.

4.7 Aggregated and De-Identified Data

We may share aggregated, de-identified, or anonymized data that cannot reasonably be used to identify you (e.g., compliance trends, industry statistics) for research, marketing, or business purposes.

5. Data Security

We implement comprehensive security measures to protect your sensitive information:

5.1 Encryption

• In Transit: All data transmitted to and from our Services is encrypted using TLS 1.2+ (HTTPS)
• At Rest: Sensitive credential data in the vault is encrypted using AES-256 encryption
• Passwords: All passwords are hashed using bcrypt or similar industry-standard algorithms
• Database: Database encryption at rest for all stored data

5.2 Access Controls

• Role-based access controls (RBAC) limit data access to authorized users only
• Multi-factor authentication (MFA) available for enhanced security
• Employee access to production data is restricted on a strict need-to-know basis
• All credential vault access is logged with timestamps and user identification
• Administrative actions are audited and logged

5.3 Infrastructure Security

• Data hosted on SOC 2 Type II compliant cloud infrastructure
• Regular security audits and vulnerability assessments
• Automated daily backups with disaster recovery procedures
• Intrusion detection and prevention systems
• Firewall protection and DDoS mitigation
• Regular security patching and updates

5.4 Employee Training

• All employees receive security and privacy training
• Background checks for employees with data access
• Confidentiality agreements and data protection policies

6. Data Retention

We retain your information for different periods based on type and legal requirements:

6.1 Active Accounts

• All data retained for the duration of your active subscription
• License and document history maintained as long as account is active
• Activity logs retained for 2 years

6.2 Terminated or Cancelled Accounts

• Data retained for 30 days after termination (grace period for data export)
• After 30 days, User Content is permanently deleted unless legally required to retain
• You may request immediate deletion by contacting privacy@rxcompliance360partners.com

6.3 Legal Compliance and Business Records

• Financial records (invoices, payments) retained for 7 years for tax and accounting purposes
• Application submissions and correspondence retained for 5 years
• Legal holds and litigation-related data retained as required by law
• Anonymized analytics data may be retained indefinitely

6.4 AI and Machine Learning

• AI chat conversations retained for quality improvement and training
• Document OCR data retained to improve extraction accuracy
• You may request deletion of AI conversation history

7. Your Privacy Rights

7.1 Access Your Data

You have the right to request a copy of all personal information we hold about you. You can download most of your data directly from the portal. For additional data, contact privacy@rxcompliance360partners.com.

7.2 Correct Inaccurate Data

You may update your account information, license details, and documents through your portal account settings. For assistance, contact support@rxcompliance360partners.com.

7.3 Delete Your Data

You may request deletion of your personal information by contacting privacy@rxcompliance360partners.com. Note: We may retain certain information for legal compliance, fraud prevention, or dispute resolution.

7.4 Data Portability

You have the right to receive your data in a structured, commonly used format (e.g., CSV, JSON) and transmit it to another service provider.

7.5 Opt-Out of Marketing

You may unsubscribe from marketing emails using the unsubscribe link in any marketing message or by visiting [your domain]/unsubscribe. Note: You cannot opt out of transactional emails (license alerts, service updates, invoices).

7.6 Manage Alert Preferences

You can customize license expiration alert preferences, compliance digest frequency, and state subscriptions through your portal account settings.

7.7 California Privacy Rights (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act:

• Right to know what personal information we collect and how we use it
• Right to request deletion of personal information
• Right to opt out of "sale" of personal information (we do not sell personal information)
• Right to non-discrimination for exercising these rights
• Right to correct inaccurate personal information
• Right to limit use of sensitive personal information

7.8 European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA), you have rights under GDPR:

• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent
• Right to lodge a complaint with a supervisory authority

To exercise any of these rights, contact us at: privacy@rxcompliance360partners.com

We will respond to verified requests within 30 days (45 days for GDPR requests).

8. Cookies and Tracking Technologies

8.1 Types of Cookies We Use

• Essential Cookies (Required): Authentication tokens, session management, security features. These cannot be disabled.
• Functional Cookies: User preferences, language settings, timezone, alert preferences
• Analytics Cookies: Google Analytics or similar to understand usage patterns (anonymized)
• Performance Cookies: Monitor site performance, identify errors, optimize loading times

8.2 Managing Cookies

You can control cookies through your browser settings. Note that disabling essential cookies will prevent you from using our Services. Disabling analytics cookies will not affect functionality.

8.3 Third-Party Tracking

We use Google Analytics, which may set cookies for tracking purposes. You can opt out using the Google Analytics Opt-Out Browser Add-on.

9. Children's Privacy

Our Services are intended for business use by licensed pharmacy professionals and are not directed to children under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately at privacy@rxcompliance360partners.com so we can delete it.

10. Third-Party Links and Services

Our Services may contain links to third-party websites or integrate with third-party services:

• State Board of Pharmacy websites
• DEA NTIS system
• CMS PECOS system
• 340B OPAIS portal
• Wholesaler and PBM portals
• Payment processors

We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any information.

11. International Data Transfers

Your information may be transferred to, stored, and processed in the United States or other countries where we or our service providers operate. These countries may have data protection laws different from your country. By using our Services, you consent to such transfers. We implement appropriate safeguards (such as Standard Contractual Clauses) to protect your data during international transfers.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:

• Email to your registered email address
• Prominent notice in the portal
• Updating the "Last Updated" date at the top of this page

Changes become effective 30 days after notification. Your continued use after changes become effective constitutes acceptance.

13. Contact Us About Privacy

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices:

We will respond to privacy inquiries within 30 days (45 days for GDPR requests).

14. HIPAA & Health Data Disclosure

15. Specific Service Disclosures

14.1 AI Services and Data Processing

14.2 WhatsApp Integration

If you choose to connect our AI assistant via WhatsApp:

• Your WhatsApp phone number is collected and stored
• Message content is processed through WhatsApp Business API (Twilio or similar)
• WhatsApp's privacy policy applies to messages transmitted through their platform
• You can disconnect WhatsApp integration at any time through portal settings

14.3 Email Alert System

Our automated email alert system:

• Tracks email delivery status (delivered, bounced, opened)
• Uses email service providers (SendGrid, Mailgun) who may track opens and clicks
• Sends alerts based on your configured preferences
• You cannot opt out of critical transactional emails (license expirations, security alerts)

14.4 Payment Information

16. Legal Bases for Processing (GDPR)

For users in the EEA, our legal bases for processing personal data include:

• Contract Performance: Processing necessary to provide Services you requested (license tracking, application submissions)
• Legal Obligation: Compliance with laws, regulations, court orders
• Legitimate Interests: Fraud prevention, security, service improvements (balanced against your rights)
• Consent: Marketing communications, WhatsApp integration, optional AI features (you may withdraw consent anytime)