Privacy Notice

• Account data: name, work email, work phone, timezone, hashed password, MFA enrollment state
• Organization data: clinic/pharmacy entity info, NPI, licenses, FDA registration, insurance
• Operational data: prescriptions you create, orders, audit log of every state-changing action
• Patient data (PHI): demographics + Rx history, handled per BAA, never used for marketing or analytics
• Payment data: payment card saved with Stripe; Pharity never stores card numbers — only the card brand and last four digits for display

• Operate the marketplace platform per your executed agreements
• Verify credentials of clinics, pharmacies, and prescribers
• Route prescriptions and process payments via the card on file (Stripe)
• Maintain audit logs, which HIPAA §164.312(b) requires — retained six years as a Pharity commitment under the executed BAA, since HIPAA sets no retention period for the log itself
• Send transactional notifications you've enabled in /clinic/notifications
• Provide quarterly Service Delivery Reports to pharmacy counterparties

• Sell PHI or account data, ever
• Use PHI for advertising, lookalike audiences, or analytics
• Share PHI with non-BAA-covered subcontractors
• Bill Medicare, Medicaid, Tricare, or VA

DigitalOcean (Postgres + hosting), AWS SES (email), BoldSign (e-signature), Middesk (KYB). Stripe (card payments and pharmacy payouts) is a payment processor under the HIPAA payment-processing exemption.

Pharity does not disclose PHI to a subprocessor until a signed BAA is in place with it. No such agreement is executed yet — see the BAA page for the full list of agreements required before launch, including vendors not yet integrated.

Patient PHI rights (access, amendment, accounting of disclosures) flow through the covered entity (your clinic or pharmacy). Pharity supports clinic/pharmacy responses to patient requests within the timelines required by HIPAA and applicable state law.

If Pharity discovers a breach of unsecured PHI, we notify the affected covered entity per HIPAA §164.410 (within 60 days, typically much sooner). State-law timelines (e.g., CMIA 15 business days; CCPA 30 days for individual notice and 15 days for CA AG notice) are also met.

HIPAA Privacy Officer / Security Officer: see your executed BAA for the current named officer. General privacy questions: privacy@pharity.com.