Privacy Policy

1. Scope

This Policy applies to information We handle through Our website and Services. ScriptSafe primarily serves businesses, and most information We collect relates to pharmacies and the individuals who act on their behalf. This Policy does not apply to the practices of pharmacies, Relying Parties, or other third parties that We do not control.

2. Information We Collect

Information You provide

When You apply, create an account, or contact Us, We collect information such as business name and address, the name, title, email, and phone number of the person acting for the pharmacy, license and registration numbers, the pharmacy website address, and information You submit to support an application or a dispute.

Information We collect automatically

When You use Our website, We collect standard technical information such as IP address, device and browser type, pages viewed, referring pages, and the date and time of access, using cookies and similar technologies as described below.

Information from public and third party sources

As part of accreditation and Monitoring, We collect information from publicly available and third party sources, including state and federal licensing records, regulatory and enforcement data, website content, domain registration records, and location data.

3. How We Use Information

We use information to:

• operate the accreditation program, including assessing pharmacies, issuing and maintaining Accreditation, and conducting Monitoring;
• prepare and provide Compliance Packages to Relying Parties as part of the program;
• communicate with applicants, Accredited Pharmacies, Relying Parties, and partners;
• operate, secure, and improve Our website and Services;
• process payments and maintain records;
• detect, prevent, and address fraud, abuse, and security issues; and
• comply with legal obligations and enforce Our Terms.

We do not sell personal information, and We do not use personal information for cross context behavioral advertising.

4. Legal Bases for Processing

Where required by law, We process personal information to perform Our agreement with You, to pursue Our legitimate business interests in operating the accreditation program, to comply with legal obligations, and, where applicable, with Your consent. Where We rely on consent, You may withdraw it at any time, though this may affect Your ability to use the Services.

5. How We Share Information

With Relying Parties

Providing Compliance Packages to registered Relying Parties is a core function of the accreditation program. A Compliance Package includes accreditation status, scope, Monitoring history, and summary findings. The internal Trust Score is never shared externally. This sharing is disclosed to pharmacies at the time of application.

With service providers

We share information with service providers and sub processors who perform functions on Our behalf, such as hosting, payment processing, email delivery, and analytics. They are permitted to use the information only to provide services to Us and are bound by obligations consistent with this Policy.

For legal, safety, and compliance reasons

We may disclose information when required by law or legal process, to protect the rights, property, or safety of ScriptSafe or others, to detect or prevent fraud, or to obtain professional advice.

In a business transfer

If ScriptSafe is involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction, subject to this Policy.

6. Cookies, Analytics, and Your Choices

We use cookies and similar technologies to operate the website, remember Your preferences, keep You signed in, maintain security, and understand how the website is used. We may use third party analytics providers to help Us measure and improve the website. You can control cookies through Your browser settings, though disabling them may affect how the website works. We do not use the website to serve third party behavioral advertising. Where required, We honor recognized opt out preference signals, including the Global Privacy Control.

7. Website Visitor Identification

On Our public website, We use a third party business identification service to estimate the organization associated with a visit, using the Internet Protocol (IP) address of the visit. This identifies businesses and organizations, not individuals, and We use it only to understand which businesses are interested in ScriptSafe. The provider acts as Our service provider and is contractually restricted to using the information only to provide the service to Us; We do not sell or share this information. We configure the service to anonymize IP addresses, We do not run it on operator, administrative, or legal pages, and We do not load it for visitors whose browser sends a recognized opt out signal such as the Global Privacy Control. These results are probabilistic organization level signals and are not a confirmed identification of any visitor or business.

We also use Our own first party analytics to understand general website traffic, including the approximate city or region associated with a visit, the page viewed, and the time of access, derived from network location. We use this internally to understand interest in ScriptSafe. We do not store the Internet Protocol (IP) address for this purpose, We do not collect it on operator, administrative, or legal pages, and We do not collect it for visitors whose browser sends a recognized opt out signal such as the Global Privacy Control. We also compute aggregate, de identified engagement estimates, such as how many visits viewed multiple pages, using a short lived, cookieless session signal that uses no cookie, stored Internet Protocol (IP) address, or device identifier, is automatically deleted within forty eight hours, and is never linked to Your identity or location.

8. Data Security and Breach Notification

We use generally accepted, industry standard administrative, technical, and physical safeguards to protect information, and We use recognized secure payment systems for transactions. No method of transmission or storage is completely secure, and We cannot guarantee absolute security. If We become aware of a breach that compromises Your information, We will notify You and any authorities as required by applicable law and without undue delay.

9. Data Retention

We retain accreditation records, including application data and compliance findings, for at least five years from the date of the accreditation decision. We retain Monitoring data for the duration of the accreditation period and for three years after expiration or revocation. We retain technical and usage data only as long as needed for the purposes in this Policy or as required by law. When information is no longer needed, We delete or de identify it.

10. International Data Transfers

Our website and service providers are located in the United States, and information is stored and processed there. If You access the Services from outside the United States, You consent to the transfer, storage, and processing of Your information in the United States, where privacy laws may differ from those where You are located. Where required, We use appropriate safeguards for international transfers.

11. Your Privacy Rights

Subject to applicable law, You may have the right to:

• access the personal information We hold about You and request a copy;
• correct inaccurate or incomplete information;
• request deletion of Your information;
• request that Your information be transferred to another provider;
• object to or restrict certain processing; and
• withdraw consent where We rely on it.

To exercise a right, contact Us using the details below. We may need to verify Your identity before acting, and We may decline or limit a request where We are required or permitted by law to retain information, such as accreditation records relied on by Relying Parties. We will not discriminate against You for exercising Your rights.

12. California Privacy Rights

ScriptSafe complies with the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the 'CCPA'). California residents have the right to know the categories and specific pieces of personal information We collect, the purposes for collection, and the categories of recipients; to request correction or deletion; to opt out of any sale or sharing of personal information; and to limit the use of sensitive personal information. We do not sell or share personal information for cross context behavioral advertising, and We do not use sensitive personal information to infer characteristics. We honor authorized agent requests and recognized opt out preference signals such as the Global Privacy Control. We may verify identity and California residency before responding, and exercising these rights will not result in discriminatory treatment.

13. Other State Privacy Rights

Residents of other United States states with comprehensive privacy laws, including Virginia, Colorado, Connecticut, and Utah, may have similar rights to access, correct, delete, and obtain a copy of their personal information, and to opt out of targeted advertising, sale, and certain profiling. We honor these rights as required by applicable law. To exercise them, contact Us using the details below, and where a law provides an appeal process, We will inform You how to appeal a decision.

14. Health Information and No PHI

ScriptSafe assesses pharmacies as businesses and does not need or want protected health information. ScriptSafe is not a covered entity or a business associate under the Health Insurance Portability and Accountability Act (HIPAA), and the Services are not intended to receive patient health records. Please do not submit protected health information to Us. If You do, You consent to Our handling of it in accordance with this Policy and applicable law.

15. Children's Privacy

The Services are intended for businesses and are not directed to children under the age of 16. We do not knowingly collect personal information from anyone under 16. If You believe We have collected such information, please contact Us so We can delete it.

16. Sensitive Information

We ask that You not send Us sensitive personal information unless We specifically request it, including Social Security numbers, financial account numbers, health or genetic data, or information about ethnic origin, religious beliefs, or criminal history. If You choose to send such information, You consent to Our handling of it in accordance with this Policy.

17. Changes to This Policy

We may update this Privacy Policy from time to time. Changes become effective when posted on this page, and the date at the top will be updated. We encourage You to review this Policy periodically.

18. Contact and Data Requests

For privacy questions or to exercise Your rights, contact ScriptSafe LLC at info@scriptsafe.com or through Our Contact page. We will respond within the time required by applicable law.