Welcome to AbridgeRx. This Privacy Notice explains how RemedyRx, LLC d/b/a AbridgeRx ("AbridgeRx," "we," "us," or "our") handles personal information ("Personal Information") when you use our website (https://www.abridgerx.com) (the "Site") and related services. It covers collection, use, sharing, and your rights regarding your data.

By using the Site, you agree to this Privacy Notice. If you disagree, please do not use the Site. For California residents, see our "California Privacy Notice" below for additional specifics.

• Account Information and Personal Identifiers:
  • Patients: Name, email, phone, address, date of birth, payment details, account preferences, Care Plan interaction data, and activities.
  • Prescribers (Parent Accounts): Name, practice details, contact info, NPI number, licensing info, payment details, and account activities.
  • Sub-Accounts (Staff & Delegates): Name, email, office address, credentials, and account activities.
• Information Collected Automatically: Device and browser details, IP address, usage data, site interactions, and cookies.
• Cookies and Similar Technologies: We use these for site functionality and analytics. For more on cookies, visit allaboutcookies.org. You can opt out of Google Analytics tracking here: https://tools.google.com/dlpage/gaoptout.
• Communications: Information provided in contact forms or customer service interactions.

• Directly from you when you create an account or use our Site.
• From your prescriber when they initiate a prescription or Care Plan for you via our platform.
• From authorized Sub-Accounts or linked providers within your Prescriber's practice.
• Automatically from your device when you interact with our Site.
• From third parties, including public records (e.g., for prescriber verification).

• Operating our business, including providing platform services and facilitating transactions between you, your prescriber, and the pharmacy.
• Delivering Non-Covered Services, such as automated SMS reminders and educational content via the AbridgeRx Care Plan.
• Enhancing user experience and site functionality.
• Responding to your requests or communications.
• De-identification and Analytics: We may de-identify Protected Health Information in accordance with 45 C.F.R. § 164.514 (using either the Safe Harbor method, which removes specified identifiers, or the Expert Determination method, which applies statistical or scientific principles to ensure no reasonable basis exists to identify individuals). Once de-identified, the information is no longer considered PHI under HIPAA and may be used by AbridgeRx for legitimate business purposes, including platform improvement, internal analytics, research, product development, and aggregated reporting, without further authorization from you. We will not attempt to re-identify de-identified data except as required by law or with your prior written approval.
• Compliance with legal obligations or industry standards.
• Marketing communications related to AbridgeRx services using non-PHI (e.g., cookies, IP addresses for targeted ads about our platform), with opt-out options available. Marketing involving PHI requires your separate authorization.
• Security measures to protect our business and users.

We retain your data for as long as necessary for the purposes outlined here, to fulfill our contractual obligations, or as required by law (including healthcare record retention requirements applicable to prescribers and pharmacies, which may influence data AbridgeRx holds on their behalf).

• Your Prescriber's Practice: Sharing PHI necessary to facilitate your prescription and Care Plan. This includes sharing your data among authorized Sub-Accounts (e.g., medical assistants, delegates) and linked providers within the same practice to facilitate your continuous care (Intra-Practice Data Sharing).
• Dispensing Pharmacies: Sharing PHI (e.g., prescription and shipping information) to enable the Partner Pharmacy to fulfill and ship your medication.
• Service Providers: Business partners (e.g., Stripe for payment processing; Twilio for SMS communications, secure hosting providers), who may receive limited PHI or non-PHI as necessary for their services.
• Legal Compliance: In response to legal processes or to comply with the law.
• Business Transactions: Like mergers, acquisitions, or sales of assets.
• Advertising Partners: For targeted advertising related to AbridgeRx services, using non-PHI, with opt-out options available.

• Review and update your account information by logging in.
• Unsubscribe from marketing emails by clicking "unsubscribe" and from Care Plan texts by replying "STOP".
• Manage cookie settings through your browser.

We monitor site activity for security, operational, and business purposes. If you do not consent to this monitoring, do not use our Site.

Our Privacy Notice does not apply to third-party sites linked from our Site. Review their privacy policies separately.

The Site is intended for use only by individuals 18 years of age or older. Usage by minors (under 18) is permitted only under the supervision and with the consent of a parent or legal guardian who is at least 18 years old and who agrees to be bound by our Terms on behalf of the minor. AbridgeRx does not knowingly collect personal information from children under 13 without verifiable parental consent in accordance with the Children's Online Privacy Protection Act (COPPA). If we learn that we have collected information from a child under 13 without appropriate consent, we will delete that information as quickly as possible.

This section describes how medical information about you (Protected Health Information or PHI) may be used and disclosed by AbridgeRx when we are acting as a Business Associate to your healthcare providers (your prescriber and the pharmacy), and how you can get access to this information. Please review it carefully.

• Our Role as a Business Associate: AbridgeRx provides a software technology platform for your prescriber to manage your care and transmit prescriptions to a compounding pharmacy. In providing these services, we create, receive, maintain, or transmit PHI on behalf of your prescriber and the pharmacy, as governed by Business Associate Agreements. AbridgeRx does not serve as your Electronic Medical Record (EMR); your Prescriber is solely responsible for maintaining your official medical record.
• Personal Health Information (PHI) We Handle: Name, contact information, date of birth, prescription information, medication history, and communications regarding your Care Plan SMS messages.
• Permissible Uses/Disclosures of PHI:
  • To Facilitate Your Treatment: Transmitting your prescription; sending order status updates.
  • To Facilitate Payment: Processing your payment via Stripe; providing information to your prescriber for their billing reconciliation.
  • For Healthcare Operations: Sending Care Plan reminders and SMS messages as authorized; performing quality assessment; de-identifying data for platform analytics.
  • As Required By Law.
  • To Subcontractors: We may disclose PHI to our own subcontractors that perform functions on our behalf, provided they agree to safeguard the PHI.
• Uses/Disclosures Requiring Your Authorization: Any use or disclosure of PHI for marketing purposes or for the sale of PHI requires your separate written authorization.
• Your Rights Regarding Your PHI: Since AbridgeRx holds your PHI as a Business Associate, you should generally exercise your rights directly with your prescriber, who is the Covered Entity responsible for your primary medical record. These rights include the Right to Access, Amend, Request an Accounting of Disclosures, Request Restrictions, and Request Confidential Communications.
• Our Duties Regarding PHI: We are required by law to maintain the privacy and security of your PHI. We will notify you (or your provider) within timelines required by law following the discovery of a breach of unsecured PHI.
• Substance Use Disorder (SUD) Records (42 CFR Part 2): If Protected Health Information we handle includes substance use disorder treatment records subject to 42 CFR Part 2 ("Part 2 records"), we will apply the heightened confidentiality protections required by Part 2, which may be more restrictive than standard HIPAA rules. This includes:
  • Limitations on uses and disclosures for treatment, payment, and health care operations without your written consent (except as expressly permitted under Part 2).
  • Restrictions on redisclosure of Part 2 records by recipients without your authorization or a valid court order after notice and opportunity to be heard.
  • Prohibition on using or disclosing Part 2 records in civil, criminal, administrative, or legislative proceedings against you without your consent or a qualifying court order.
  • We handle Part 2 records in accordance with applicable law and our Business Associate Agreement. If your records include Part 2 information, your prescriber (as the Covered Entity) remains primarily responsible for providing notices and handling your rights requests related to such records.
• Complaints: If you believe your privacy rights have been violated, you may file a complaint with your prescriber, AbridgeRx's Privacy Officer, or the Secretary of the Department of Health and Human Services.

This section applies to California residents:

• Collection: We collect the categories of Personal Information described above.
• Sources: Same as described in "How Does AbridgeRx Collect This Information?"
• Use: As described in "How Does AbridgeRx Use Your Information?"
• Disclosure: Shared with third parties as noted in "Does AbridgeRx Share Your Information with Others?"
• Sharing for Targeted Advertising: We may share certain information (like cookies and IP addresses) with third-party advertising partners to provide you with targeted advertisements about AbridgeRx services.
• Opt-Out Preference Signals: We honor Global Privacy Control (GPC) signals and other user-enabled opt-out preference signals that indicate your choice to opt out of the sale or sharing of your personal information for cross-context behavioral advertising. If your browser or device sends a valid GPC or similar signal, we will treat it as an opt-out request in accordance with applicable law. You may also opt out via the methods listed above or through tools provided by the Digital Advertising Alliance (optout.aboutads.info) or Network Advertising Initiative (optout.networkadvertising.org).
• Your CCPA Rights:
  • Right to Know: What Personal Information we have collected about you.
  • Right to Correct: Inaccurate Personal Information.
  • Right to Delete: Personal Information we've collected, subject to exceptions.
  • Right to Opt-Out of Sale/Sharing: AbridgeRx does not "sell" PHI. You may opt out of "sharing" for cross-context behavioral advertising.
  • Right to Limit Use of Sensitive Personal Information: (Our use of health information is primarily governed by HIPAA).
  • Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise your rights under CCPA (Right to Know, Correct, Delete, Opt-Out of Sale/Sharing, Limit Use of Sensitive Information, or Non-Discrimination), or for any privacy-related questions, comments, or complaints, contact our Privacy Officer:

• Email: support@abridgerx.com (please include your full name, email address associated with your account, and a clear description of your request; we may require verification of your identity).
• Phone: (866) 754-4309
• Mail: RemedyRx, LLC d/b/a AbridgeRx, Attn: Privacy Officer, 840 W Chalmers Pl, Chicago, IL 60614

We will respond to verifiable consumer requests within 45 days (extendable by another 45 days if reasonably necessary and with notice to you). For HIPAA-related rights (e.g., access or amendment of PHI), please direct your request to your prescriber, who maintains your official medical record.