Privacy Policy

We collect the following types of personal information:

From Pharmacy Partners:

• Business name and contact information
• Authorized user names and email addresses
• Phone numbers
• Business license information
• DEA registration numbers

From Patients (via Pharmacy Submissions):

• Full name
• Date of birth
• Delivery address
• Phone number
• Prescription information (medication name, dosage, quantity, prescriber information)
• Special delivery instructions

From Drivers:

• Full name
• Driver's license number
• Vehicle information (make, model, license plate)
• Background check information
• GPS location data (during active deliveries)
• Phone number and email address
• Payment information (for compensation)

Under HIPAA, we collect and process PHI including: prescription details, patient name and delivery address, prescriber information, and pharmacy information.

• Device information (type, OS, browser)
• IP address
• Log data (access times, pages viewed, errors)
• GPS location (drivers during active deliveries only)
• Usage analytics (features used, time in app)

• Authentication cookies — to keep you logged in
• Analytics cookies — to understand platform usage
• Session cookies — to maintain your session state

You can disable cookies in your browser settings, but this may limit functionality.

• Process prescription deliveries — assign drivers, route, confirm delivery
• Ensure compliance — validate prescriptions against DEA and state regulations
• Provide customer support
• Maintain custody chain — tamper-evident record of prescription custody transfers
• Send notifications — real-time delivery status (WebSocket, SMS, email)
• Improve our services — analyze usage patterns and optimize performance

RxRunner uses automated decision-making systems to process operational data (not PHI) for: dispatch optimization, route planning, trust scoring, anomaly detection, and policy enforcement.

• Treatment — facilitating delivery of prescribed medications
• Payment — processing payments for delivery services
• Healthcare Operations — quality improvement, compliance monitoring, training

• Comply with legal obligations (DEA, HIPAA, state pharmacy laws)
• Respond to lawful requests from authorities (subpoenas, court orders)
• Protect our rights and prevent fraud or misuse
• Investigate security incidents

We share information with Business Associates under HIPAA, including cloud infrastructure providers, SMS/email providers (Twilio, SendGrid), payment processors, and background check providers.

We will NEVER:

• Sell your personal information or PHI to third parties
• Use your PHI for marketing without your authorization
• Disclose your information for purposes unrelated to healthcare delivery, payment, or operations without your consent

• Access Your PHI — request copies of prescription and delivery records
• Request Amendments — request corrections to inaccurate PHI
• Accounting of Disclosures — receive a list of PHI disclosures (prior 6 years)
• Request Restrictions — request restrictions on PHI use or disclosure
• Confidential Communications — request communications via alternative means

• Right to Know — what personal information we collect and why
• Right to Delete — request deletion (subject to HIPAA retention requirements)
• Right to Opt-Out — we do not sell personal information, so opt-out is not applicable
• Right to Non-Discrimination — no discrimination for exercising your rights

We respond to HIPAA requests within 30 days (60 days if extension needed) and CCPA requests within 45 days.

Technical Safeguards:

• Encryption in transit (TLS 1.3 for all network communication)
• Encryption at rest (database-level encryption for all PHI)
• Strong authentication (JWT tokens with bcrypt password hashing)
• Role-based access control (RBAC)
• Immutable audit logging with cryptographic integrity

If a data breach occurs, we will notify affected individuals within 60 days (HIPAA requirement) and the Department of Health and Human Services (HHS). Breaches affecting 500+ individuals will also require media notification.

Report a suspected breach: security@bidayax.com