Privacy Policy

NimbusWeave Rx Inc. (“NimbusWeave Rx”, “we”, “us”, or “our”) provides digital intake forms and a pharmacist triage dashboard for independent and community pharmacies. This Privacy Policy outlines our data handling practices across two distinct capacities:

We collect information across the following categories:

• Pharmacy Account Information: Pharmacist and staff names, business email addresses, telephone numbers, pharmacy physical address, national provider identifier (NPI), and role credentials.
• Commercial & Billing Data: Payment card details (processed through PCI-DSS Level 1 payment processors; we do not store raw card numbers) and subscription invoicing records.
• Protected Health Information (ePHI): Patient prescription numbers, medication names, prescriber details, insurance cards, and date of birth submitted through intake forms—handled strictly under our Business Associate obligations.
• Technical & Telemetry Data: IP addresses, browser types, operating system identifiers, and system access logs. All telemetry logs are rigorously scrubbed to ensure zero Protected Health Information is written to disk or monitoring channels.

We adhere to a strict minimal-data philosophy:

• Essential Session Cookies: We use strictly necessary, cryptographically signed HTTP cookies solely to maintain authenticated staff sessions, manage cryptographic CSRF prevention, and ensure cross-site request security.
• No Third-Party Advertising Trackers: We do NOT deploy third-party advertising cookies, cross-site tracking pixels, or behavioral behavioral profiling tools across our platform or embedded intake widgets.
• Bot Protection: We utilize privacy-preserving Turnstile verification to safeguard public intake forms from automated abuse without inspecting personal browsing history.

We process collected information exclusively for legitimate clinical and operational purposes:

• Operating, maintaining, and triaging patient intake submissions for authorized pharmacy personnel;
• Facilitating secure, outbound synchronization between intake queues and subscriber PrimeRx dispensing systems;
• Verifying professional pharmacy licenses, NPI credentials, and account access authorization;
• Enforcing role-based access control, auditing operator actions, and maintaining tamper-evident compliance ledgers;
• Communicating mission-critical security advisories, system notifications, and invoice receipts.

We do not sell, rent, or trade personal data or protected health information to anyone.

We disclose information only to vetted infrastructure sub-processors essential to delivering our service, under strict contractual Business Associate Agreements (BAAs) and Data Processing Agreements (DPAs):

• Cloud hosting, serverless compute, and encrypted database infrastructure providers;
• HIPAA-compliant document storage and notification gateway services (e.g., transactional SMS / email alerts);
• PCI-DSS certified payment processors for SaaS subscription billing;
• Legal authorities when strictly required by enforceable subpoena, court order, or mandatory statutory law.

In our capacity as a Business Associate, we implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of ePHI, and promptly report any confirmed security incidents or breaches in accordance with federal law.

We retain account data and administrative logs for the duration of the pharmacy’s active subscription plus any statutory period mandated by pharmacy board regulations and commercial law.

Patient intake submissions and uploaded insurance cards are managed according to subscriber retention configurations and purged utilizing cryptographically secure deletion procedures upon request or contract termination.

We maintain comprehensive technical, physical, and organizational security controls designed to safeguard protected data:

• Data Isolation: Per-pharmacy cryptographic boundaries guarantee complete multi-tenant partition separation.
• Encryption: AES-256 encryption at rest for all stored databases, documents, and backups; TLS 1.3 encryption in transit for all network traffic.
• Access Controls: Enforced role-based access, multi-factor authentication, and short-lived session tokens.
• Audit Logging: Immutable, tamper-evident recording of every clinical access and administrative operation.

Depending on your jurisdiction, including California (CCPA/CPRA) and other applicable state frameworks, you may possess rights to:

• Request access to and disclosure of personal information collected about you;
• Request correction of inaccurate or incomplete commercial account records;
• Request deletion of personal information, subject to statutory retention exemptions;
• Opt out of the sale or sharing of personal data (we do NOT sell or share personal information);
• Exercise privacy rights without facing discriminatory treatment.

Our website and B2B services are directed exclusively to adult pharmacy operators and healthcare professionals. We do not knowingly solicit or collect information from children under 13.

Prescription intake forms submitted on behalf of pediatric patients are authorized by the patient’s parent or legal guardian and processed in strict accordance with HIPAA regulations.

We may update this Privacy Policy periodically to reflect technological advancements, legal developments, or operational updates. We will notify subscribers of material modifications via email or through the pharmacy admin console.