Draft for legal review. This policy has not yet been approved by counsel and will change before RelayRx handles real patient information.

Privacy policy

Last updated: [date of approval]. Applies to the RelayRx website, the pharmacy portal and the RelayRx Carrier app.

Who we are

RelayRx ([legal entity name, address]) provides delivery services to pharmacies. When we deliver for a pharmacy, we act on that pharmacy's behalf under a business associate agreement, and we handle patients' health information as that agreement and the HIPAA rules require.

Information we handle

Patients (from the pharmacy)

• Name, delivery address and phone number, so the delivery can reach you. We do not receive what your medication is.
• Proof of delivery: the time, the location of the handover, and a photo or signature where the pharmacy asks for one.
• Texts about your delivery, and your replies (for example STOP).

Drivers (RelayRx Carrier app)

• Name and sign-in identifier, license, insurance and training dates.
• Precise location, once, at the moment you complete a delivery (never in the background).
• Photos and signatures you take as proof of delivery; shift times and pay records.

Pharmacy staff (portal)

• Name, work email, role and actions taken in the portal.

How we use it

Only to provide and record deliveries, pay drivers, bill pharmacies, keep the service secure and meet legal obligations. We do not sell information, use it for advertising, or track you across other apps and websites.

Who we share it with

• The pharmacy that requested the delivery.
• Service providers that run the service for us under contracts that protect it: Amazon Web Services (hosting, sign-in and text messages).
• When a driver chooses to navigate, the delivery address (only the address) is sent to the map app on the driver's phone (Google Maps or Apple Maps).
• Authorities, when the law requires it.

How long we keep it

[Retention periods to be set with counsel and the pharmacies, for example delivery records for the period pharmacy regulations require.] Recipient details are encrypted and shown to a driver only while the delivery is theirs.

Security

Information is encrypted in transit and at rest. Access is limited to the people and systems that need it, every view of a patient's details is recorded, and sign-in requires multi-factor authentication for staff.

Your choices and rights

• Patients: reply STOP to any RelayRx text to stop texts; contact your pharmacy about your health information.
• Drivers and staff: ask us for a copy of your information, to correct it, or to delete your account (see Support). Some records must be kept by law.

Children

The RelayRx apps are not intended for children.

Changes and contact

We will post changes here and update the date above. Questions: privacy@relayrx.net.