Privacy policy

1. Two different places, two different rules

This policy covers two things. The first is this public website at formulynx.com, which anyone can visit. The second is the Formulynx platform, which pharmacies and clinics (our customers) use with their staff and patients at their own address, for example your-pharmacy.formulynx.com.

On the website we are the party responsible for the small amount of information collected. Inside the platform the customer organization is the covered entity responsible for its patients' information, and we act as its business associate under the Health Insurance Portability and Accountability Act (HIPAA). We process that information only as the customer's business associate agreement (BAA) and this policy allow.

2. What the website collects

• Contact form. Your name, email address, the organization you type (optional) and your message. We use these to answer you. The form asks you not to include patient information; please do not.
• Aggregate visit statistics. We use Plausible, a privacy-focused analytics service, on the public pages only. It does not use cookies, does not store your IP address, and does not follow you across sites. It tells us how many people visited a page, from which country and referring site. It is never loaded on sign-in, account or portal pages, or on any customer's address.
• Server logs. Our hosting provider keeps standard request logs (time, requested page, status, IP address) for a short period for security and reliability.

We do not run advertising, advertising trackers or social media embeds. See the cookie policy.

3. What the platform holds

When a customer organization sets up Formulynx, the platform holds account information for the people the organization invites (name, email address, role) and the records the organization creates: patients, prescriptions, orders, uploaded documents such as insurance cards, messages, visit schedules and an audit trail of who accessed what and when. Patient information is protected health information (PHI) and belongs to the customer organization.

We use PHI only to provide the service to that organization, to keep it secure, and as the law requires. We never sell it, use it for advertising, or use it to train models.

4. How we protect information

• Each organization's data is separated at the database level with row-level security, in addition to checks in the application.
• Access is granted by role, and the server checks the role on every request.
• Every read or change to a patient record is written to an audit log. Patient details are never written to application logs or error messages.
• Data is encrypted in transit, and files and the database are encrypted at rest.
• Our infrastructure providers are covered by business associate agreements.

5. Who else handles data (subprocessors)

We use a small number of service providers to run the platform. Each is bound by contract to protect the data it handles.

Billing is between us and the customer organization; the payment provider receives the organization's name and billing contact, never patient information.

6. When we share information

We share information only: with the subprocessors above; when the customer organization instructs us; when the law requires it; or to protect the safety and security of the service and its users. We do not sell personal information and have not done so in the past twelve months.

7. How long we keep it

• Contact form messages: until we have answered and for up to 24 months afterwards, unless you ask us to delete them sooner.
• Platform records: for as long as the customer organization's account is active and thereafter as its BAA and applicable law require. Audit logs are retained for the period required by HIPAA, at least six years.
• Server logs: a short rolling period, currently 90 days.

8. Your rights

If you are a patient whose information is in the platform, your rights under HIPAA (access, amendment, an accounting of disclosures) are exercised with the pharmacy or clinic that treats you. We will help that organization respond. We cannot act on a patient request directly, because the records are theirs.

California residents (CCPA/CPRA). For information we collect as a business (the website and account information), you may request to know what we hold, to delete it, and to correct it, and you will not be treated differently for exercising these rights. We do not sell or share personal information for cross-context behavioral advertising. Protected health information handled under HIPAA is exempt from the CCPA. Requests go to [PRIVACY CONTACT EMAIL]; we will verify your identity by replying to the address on file.

European Economic Area and United Kingdom (GDPR). The platform is offered to organizations in the United States. If we nevertheless hold information about you, our legal basis is the performance of a contract or our legitimate interest in running and securing the service, and you have the rights of access, rectification, erasure, restriction, portability and objection, and the right to complain to your supervisory authority. Contact [PRIVACY CONTACT EMAIL].

9. Children

The website is not directed at children under 13 and we do not knowingly collect their information there. Patient records for minors inside the platform are handled by the treating organization under HIPAA.

10. Changes to this policy

We will post changes on this page and update the effective date. For material changes affecting customer organizations we will also notify their administrators by email.

11. Contact

[LEGAL ENTITY NAME]
[REGISTERED ADDRESS]
Privacy requests: [PRIVACY CONTACT EMAIL]