Privacy Policy
PepNationRX is a technology and management services platform. We are not a healthcare provider. All clinical services are provided by independent, licensed medical practitioners. This policy describes how PepNationRX collects and uses information in its capacity as a technology platform and billing agent.
1. Who We Are
PepNationRX ("PepNationRX," "we," "us," or "our") operates pepnationrx.com and related mobile and web applications (collectively, the "Platform"). We are a technology platform and Management Services Organization (MSO) that connects patients with independent, licensed healthcare providers and state-licensed 503A compounding pharmacies.
PepNationRX does not practice medicine, does not employ the healthcare providers who treat you, and does not dispense medications. Telehealth consultations, diagnoses, and prescriptions are rendered by independent physicians, nurse practitioners, and other licensed clinicians. Medications are dispensed by independent, licensed 503A compounding pharmacies.
Depending on the nature of the information and how it is used, PepNationRX may act as a HIPAA "Business Associate" of the licensed medical practices whose providers use our Platform. In that capacity, we are required by law to protect Protected Health Information (PHI) in accordance with the HIPAA Privacy and Security Rules.
2. Information We Collect
2.1 Information You Provide Directly
- Account Information: Name, email address, phone number, date of birth, biological sex, and state of residence when you create an account.
- Health and Medical Information: Symptoms, medical history, current medications, allergies, and other health details you submit during intake questionnaires and consultations. This information constitutes PHI under HIPAA and is handled with the highest level of protection.
- Identity Verification: Government-issued ID documents and photographs used to verify your identity and age.
- Payment Information: Credit or debit card information, billing address, and payment history. Payment card data is processed and stored by Stripe, Inc., our PCI-DSS-compliant payment processor. PepNationRX does not store full card numbers.
- Shipping Information: Mailing address for medication delivery.
- Communications: Messages you send to providers, pharmacists, or our support team through the Platform.
- Consent Records: Records of your consents, including telehealth informed consent, HIPAA authorization, Terms of Service acceptance, and MSO billing agent acknowledgment, including timestamps and IP addresses.
2.2 Information Collected Automatically
- Log Data: IP address, browser type, operating system, pages visited, time of access, and referring URL.
- Device Information: Device type, operating system version, unique device identifiers, and mobile network information.
- Usage Data: Features used, actions taken, session duration, and clickstream data within the Platform.
- Location Data: State of residence (required for provider licensing compliance). We do not use precise geolocation without your explicit consent.
- Cookies and Similar Technologies: See Section 8 for details.
2.3 Information From Third Parties
- Healthcare Providers: Clinical notes, prescription records, lab results, and treatment recommendations generated by independent providers on the Platform.
- Pharmacies: Dispensing records, prescription fill status, and shipping information from our pharmacy partners.
- Laboratory Partners: Lab test results ordered through the Platform.
- Identity Verification Services: Verification status returned by identity verification providers.
3. How We Use Your Information
We use your information for the following purposes:
| Purpose | Legal Basis |
|---|---|
| Creating and managing your account | Performance of contract |
| Facilitating telehealth consultations with independent providers | Performance of contract; HIPAA treatment operations |
| Routing prescriptions to licensed pharmacies | Performance of contract; HIPAA healthcare operations |
| Processing payments and managing subscriptions | Performance of contract; legitimate interest |
| Sending clinical communications, order updates, and appointment reminders | Performance of contract; HIPAA treatment |
| Verifying provider licensing and patient eligibility by state | Legal obligation; legitimate interest |
| Fraud prevention, security, and abuse detection | Legitimate interest; legal obligation |
| Complying with legal and regulatory requirements | Legal obligation |
| Improving the Platform and developing new features | Legitimate interest (de-identified/aggregated data only) |
| Sending marketing communications (with your consent) | Consent; opt-out available at any time |
We do not sell your personal information or Protected Health Information to third parties. We do not use your health information for targeted advertising.
5. HIPAA and Protected Health Information
This section describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.
5.1 Our Obligations
To the extent that PepNationRX handles Protected Health Information (PHI) as a Business Associate of licensed medical practices, we are required by the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act to:
- Maintain the privacy and security of your PHI
- Notify you if there is a breach of your unsecured PHI
- Follow the duties and privacy practices described in this Notice
- Only use and disclose your PHI as described in this Notice or as permitted by law
- Not sell your PHI
5.2 Permitted Uses and Disclosures of PHI
We may use or disclose your PHI without your specific authorization for the following purposes:
- Treatment: To facilitate your care, share clinical information with the providers treating you, and coordinate prescriptions with pharmacies.
- Payment: To process payments for healthcare services, including billing, insurance coordination (where applicable), and collections.
- Healthcare Operations: For quality assurance, care coordination, operational administration, and business management activities that are essential to running the Platform.
- As Required by Law: To comply with applicable laws, regulations, court orders, and government investigations.
- Public Health Activities: To report certain communicable diseases or adverse events as required by public health authorities.
- Serious Threats to Health or Safety: To prevent a serious and imminent threat to your health or safety or the health and safety of another person.
5.3 Uses Requiring Your Authorization
Certain uses and disclosures of PHI require your written authorization, including:
- Marketing purposes using PHI
- Sale of PHI
- Most uses of psychotherapy notes
- Uses and disclosures not otherwise permitted by HIPAA
You may revoke a HIPAA authorization at any time in writing. Revocation does not affect uses or disclosures made prior to the revocation.
5.4 Your HIPAA Rights
- Right to Access: You have the right to inspect and obtain a copy of your PHI held by the independent providers on our Platform. Requests can be directed to privacy@pepnationrx.com.
- Right to Amend: You have the right to request amendment of PHI you believe is inaccurate or incomplete.
- Right to an Accounting of Disclosures: You have the right to request a list of certain disclosures of your PHI made during the six years prior to your request.
- Right to Request Restrictions: You have the right to request restrictions on how your PHI is used or disclosed.
- Right to Confidential Communications: You have the right to request that communications about your PHI be sent to you in a specific way or location.
- Right to File a Complaint: You have the right to file a complaint with us or with the U.S. Department of Health and Human Services (HHS) Office for Civil Rights if you believe your privacy rights have been violated. Filing a complaint will not result in any retaliation against you.
6. Your Rights and Choices
6.1 Account Information
You may update or correct your account information at any time by logging into your account or contacting us at support@pepnationrx.com. You may request deletion of your account, subject to our retention obligations for medical records and legal compliance.
6.2 Marketing Communications
You may opt out of marketing emails at any time by clicking "Unsubscribe" in any marketing email or by contacting us at support@pepnationrx.com. You may opt out of marketing SMS messages by replying STOP to any marketing text. Please note that you will continue to receive transactional communications related to your care and account even after opting out of marketing.
6.3 Data Portability
You may request a copy of your personal data in a structured, machine-readable format by contacting privacy@pepnationrx.com. We will respond to verifiable requests within 45 days.
6.4 Account Deletion
You may request deletion of your account. Please note that we are required by law and professional standards to retain certain medical records for a minimum period (typically 7–10 years depending on state law). Financial and transaction records may also be retained for regulatory compliance purposes.
7. Data Security
We implement administrative, physical, and technical safeguards designed to protect your information against unauthorized access, disclosure, alteration, or destruction, including:
- Encryption at Rest and in Transit: All PHI and personal data is encrypted at rest using AES-256 and in transit using TLS 1.2 or higher.
- Field-Level PHI Encryption: Sensitive health data fields are encrypted at the application layer before being written to the database.
- Access Controls: Access to PHI is restricted to personnel and systems with a legitimate need, enforced through role-based access control.
- Audit Logging: All access to PHI is logged and monitored.
- Vendor Security: Third-party vendors are assessed for security practices and required to comply with our security requirements.
- Breach Response: We maintain a breach response plan and will notify you as required by HIPAA (within 60 days of discovery) and applicable state breach notification laws.
No security system is impenetrable, and we cannot guarantee that unauthorized parties will never gain access to your information. If you have reason to believe that your interaction with us is no longer secure, please contact us immediately at security@pepnationrx.com.
8. Cookies and Tracking Technologies
We use cookies and similar technologies to operate and improve our Platform. We do not use advertising cookies or sell your browsing data to advertisers.
| Cookie Type | Purpose | Duration |
|---|---|---|
| Essential / Authentication | Maintain your login session and security tokens | Session / 30 days |
| Preference | Remember your settings and display preferences | 1 year |
| Analytics | Understand how users interact with the Platform (de-identified) | Up to 2 years |
You can control cookies through your browser settings. Disabling essential cookies may impair Platform functionality and prevent you from accessing your account.
9. State-Specific Privacy Rights
California Residents (CCPA/CPRA)
California residents have the right to: (1) know what personal information we collect, use, disclose, and sell; (2) delete personal information we collected about you, subject to certain exceptions; (3) correct inaccurate personal information; (4) opt out of the sale or sharing of personal information; and (5) non-discrimination for exercising your rights. We do not sell personal information. To exercise your rights, contact privacy@pepnationrx.com.
Washington Residents (My Health My Data Act)
Washington residents have enhanced rights regarding consumer health data. We do not share your health data with non-healthcare third parties without your explicit consent. We do not use geofencing to collect health data. To exercise your rights, contact privacy@pepnationrx.com.
Virginia, Colorado, Connecticut, Nevada, and Other State Residents
Residents of states with comprehensive consumer privacy laws have the right to access, correct, delete, and obtain a portable copy of personal data we hold about you, and to opt out of certain processing activities. To submit a verifiable consumer request, contact privacy@pepnationrx.com. We will respond within 45 days.
Medical Records — State Law
Your medical records generated through independent providers on our Platform are subject to state medical records laws where your provider is licensed. State-specific retention and access rights apply and may differ from the general rights described above.
10. Children's Privacy
Our Platform is not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If you are under 18, do not use or provide any information on our Platform. If we learn we have collected personal information from a child under 18, we will delete that information as quickly as possible. If you believe we might have any information from or about a child under 18, please contact us at privacy@pepnationrx.com.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email (sent to the email address specified in your account) or by posting a prominent notice on our Platform prior to the change becoming effective. We encourage you to review this Policy periodically. Your continued use of the Platform after any changes constitutes your acceptance of the updated Policy.
The "Last Updated" date at the top of this page indicates when the Policy was most recently revised.
12. Contact Us
If you have questions, concerns, or requests related to this Privacy Policy or your personal information, please contact us:
- Email: privacy@pepnationrx.com
- Support: support@pepnationrx.com
- Mailing Address: PepNationRX, 4830 97th Place, Oak Lawn, IL 60453
To file a complaint with the U.S. Department of Health and Human Services regarding HIPAA violations, visit hhs.gov/hipaa/filing-a-complaint or call 1-800-368-1019.