Privacy Policy

1. Introduction

This Privacy Policy explains how Prescrivia ("we", "us", "our") collects, uses, stores, and protects your personal data when you use our platform. We are committed to protecting your privacy in accordance with the General Data Protection Regulation (GDPR) and applicable EU data protection laws.

2. Data Controller

Prescrivia is controller for data used to operate its platform. Each independent doctor or medical practice and each licensed pharmacy operates its own business and is responsible for the clinical or dispensing data it controls under its own privacy notice and professional duties. The responsible provider can vary between requests; its identity and contact details must be made available for that service. Prescrivia's own operator legal-entity details remain pending verification. Any jointly determined processing requires a separately assessed and disclosed controller arrangement. Required operator information must be provided before the corresponding data collection; pre-production status does not defer those duties.

3. Data We Collect

3.1 Account Data

When you create an account, we collect: name, email address, date of birth, and delivery address.

3.2 Health Assessment Data

When you submit a health assessment, we collect medical information including: current symptoms, medical history, current medications, allergies, and lifestyle factors. This data is classified as special category data under GDPR and receives additional protections.

3.3 Payment Data

We process transaction references, amounts, payment status and the minimum payment or return-payment details needed for the selected payment method. Where card payments are offered, full card details are handled by the selected payment provider rather than stored by Prescrivia. The applicable provider, account, regulatory scope and contractual safeguards require verification; naming a payment service is not a certification of compliance. Payment references or purchase context can reveal health information and must receive the corresponding safeguards.

3.4 Technical Data

We collect technical information such as IP address, browser type, device information and security logs to operate and protect the platform. Optional analytics require prior consent and are limited to permitted public pages; you can withdraw consent through your privacy settings.

3.4.1 Identity and professional verification
Didit is the identified verification service, subject to confirmation of its contractual role and configured method. Verification may involve identity-document details, a facial image or liveness check, a verification result and professional credentials. An ordinary photograph is not automatically special-category biometric data; technical processing to uniquely identify a person requires both an Article 6 basis and an applicable Article 9 condition. Verification is not automatically a statutory obligation, and accepting these policies is not explicit biometric consent.

Before collecting verification data, the specific notice must identify the responsible business and provider, the actual data and method, purpose and grounds, any identified legal duty, required and optional inputs, consequences of refusal, recipients and transfers, separate periods or criteria for raw captures, biometric templates and results, and rights and deletion arrangements. Where explicit consent is relied on, refusal or withdrawal must be possible without inappropriate detriment and any alternative must support freely given consent. If lawful verification is necessary for a particular action, explain why that action cannot proceed without verification and what lawful alternative, if any, is available; do not promise an unverified alternative. Keeping a verification result does not itself justify keeping raw images or biometric templates. Method, grounds, alternatives and provider-side retention remain pending review before the corresponding use.

Draft pending qualified legal review: optional attribution lawful bases and recipient safeguards require confirmation.

3.5 Optional referral attribution

If you arrive through a referral link, attribution is recorded only after your marketing-cookie consent.

3.5.1 What we collect (with consent)

With consent, we may record the source identifier, referral URL, UTM parameters, IP address, user-agent and visit to attribute a later registration and prevent abuse. Without consent, this referral collection does not take place. Clinical answers and identifiable treatment details must not be included in optional attribution. Health-inference risks from page context or account links require separate review; optional marketing consent alone does not permit health-data processing.

3.5.2 The attribution token

The partner_attribution local-storage entry lasts 30 days and may link a registration to its source. It does not track other websites. A linkable token can be personal data even if it contains no name.

3.5.3 What the partner sees

Partners can view only:

Aggregate referral counts — the number of attributed registrations and completed orders
Attribution dates without direct identifiers; dates and small groups require safeguards against identifying individuals

Partners cannot see:

The visitor's identity, name, email address, or contact details
The visitor's IP address
Any health data, medical history, symptoms, medications, or clinical information
Any payment or financial information belonging to the visitor

3.5.4 Purpose

Attribution supports referral administration and fraud prevention. A referral does not determine independent clinical or dispensing decisions. Commercial participation is governed by separate partner terms.

3.5.5 Lawful basis

Processing activity	Lawful basis
Collection of referral visit data (IP, UA, UTM, referral URL, partner identifier)	Consent for optional attribution; any separate fraud-prevention reliance on legitimate interests requires a documented necessity and balancing assessment
Storage of the `partner_attribution` token in local storage	Consent (ePrivacy Directive Art. 5(3) and GDPR Art. 6(1)(a)) — non-essential device storage requires prior consent via the cookie banner
Linking an account registration to a referring partner	Consent for optional attribution; any separate legitimate-interest purpose requires assessment and disclosure
Sharing aggregate attribution counts and dates with the partner	Assessed lawful basis and safeguards for limited recipient disclosure; no health-data access

3.5.6 Retention

partner_attribution token (local storage): 30 days from visit
Referral attribution records (account-level link): per the applicable partner terms and tax/financial retention periods
Financial records: the applicable statutory accounting or tax period, with its retention trigger documented

See the Cookie Policy for details on the partner_attribution local-storage entry, and the "Tax Reporting (DAC7)" section below for tax reporting of partner earnings.

4. Legal Basis for Processing

Consent — Explicit consent under GDPR Articles 6(1)(a) and 9(2)(a) for the described platform health-data purpose; separate consent for optional marketing and analytics. Policy acceptance does not establish health-data approval.
Contractual necessity — Account, support, payment coordination and other platform services necessary for your contract. This ground alone does not permit special-category health-data processing.
Legitimate interests — Necessary and proportionate security and fraud prevention, subject to assessment and your right to object; no blanket basis for optional analytics or health-data processing.
Legal obligations — Records required by an identified applicable law, distinguished from optional commercial uses and the separate duties of doctors and pharmacies.

5. How We Use Your Data

Facilitating the connection between you and healthcare professionals
Processing your health assessments and transmitting them to reviewing doctors
Processing payments and managing orders
Communicating with you about your assessments and orders
Improving our platform and services
Complying with legal and regulatory requirements

6. Data Sharing

We share your data only as necessary:

Independent doctors — Your health assessment for medical review
Licensed pharmacies — Prescription and delivery details
Payment providers — Payment processing data
Delivery services — Delivery address and tracking

6.1 Service providers and recipients

Service providers may be used where necessary to operate the platform, process payments, verify identity, send transactional communications, monitor security, and support platform pre-screening, subject to applicable review. Prescrivia has selected an OpenAI model through OpenRouter for planned AI-assisted assessment pre-screening; health-data processing approval for the gateway and inference route remains pending. The table describes provider purposes and safeguards requiring verification. Naming a provider or model does not establish approval or current processing. Actual recipients, contractual roles, account settings, processing locations, and applicable agreements and safeguards must be verified before the corresponding use.

Described provider or recipient	Purpose	Described location (verification pending)	Required agreement / safeguard (verification pending)
Supabase	Platform database, authentication and storage, including submitted health assessments subject to applicable safeguards	EEA-hosted project resources where configured	Supabase data processing agreement and EU transfer safeguards
Wise	Payment initiation, payment status, and reconciliation support	EEA/UK payment infrastructure	Wise data processing and financial-services terms
Didit	Identity and KYC verification	EEA or approved subprocessors, subject to verification	Didit data processing agreement and verification-data retention controls
OpenRouter with selected OpenAI model — health-data approval pending	Planned gateway routing for AI-assisted platform pre-screening using minimised assessment answers	OpenRouter and actual inference-provider accounts, services, processing locations and transfer arrangements require verification	Explicit permission for the relevant health-data scope, applicable processing agreements, no-training and retention safeguards, data-protection impact review, and transfer safeguards and assessments must be reviewed for the gateway and inference providers before health-data use; approval remains pending
Stripe and PayPal, where the corresponding service is used	checkout, payment, refund or payout information where you use the corresponding payment method or professional payout service.	Processing locations depend on the selected payment service and require verification	Applicable payment-provider agreements, minimum-data controls, retention and transfer safeguards
Resend	Transactional email delivery	United States; applicable transfer mechanism required	Resend data processing agreement and transfer safeguards
Google Analytics, after analytics consent	pseudonymous browser identifiers and sanitised public-page events, only after analytics consent; clinical and authenticated account routes are excluded.	Processing locations and transfer safeguards require verification	Prior analytics consent, applicable provider agreements and retention settings; clinical and authenticated account routes excluded
Google reCAPTCHA (automatic security check)	IP address, browser and device information and interaction signals, collected automatically on sign-up, assessment, booking and referral forms to detect and block automated or abusive submissions.	Processing locations and transfer safeguards require verification	Legitimate interests in necessary security and fraud prevention, subject to your right to object; Prescrivia does not use this data for analytics or advertising. Google's processing is also governed by the Google Privacy Policy and Terms of Service.
Sentry	Error monitoring, security diagnostics, and reliability telemetry	EU ingest endpoint where configured	Sentry data processing agreement and EU ingest configuration

We do not sell your personal data to third parties. We do not share your data for marketing purposes without your explicit consent.

Other recipients when the corresponding feature is used
ShipEngine, 17track and delivery carriers — delivery details needed for shipping and tracking identifiers needed for shipment updates; these providers do not need your assessment answers.

Cal.com — scheduling information you provide when opening or using the booking service.

Netlify and security/challenge providers — hosting, request and security information needed to deliver the website and prevent abuse; a challenge provider receives information when its verification is required.

7. Data Security

We protect your data using:

Encrypted transport for sensitive workflows
EU-hosted infrastructure and restricted access controls where configured
Role-based access controls with multi-factor authentication
Security logging, audit trails and risk-based security testing; this statement does not establish an independently certified penetration-test programme
Automatic session timeouts for clinical data access

Draft pending qualified legal review: DAC7 applicability and these obligations require confirmation before production use.

7a. Tax Reporting (DAC7)

Where applicable tax law requires it, Prescrivia collects and reports necessary information about eligible commercial participants. Whether DAC7 applies to a particular activity or participant requires legal review; participation alone does not establish a reporting duty.

7a.1 What data may be reported

Where DAC7 reporting applies, the following partner data may be reported:

Partner identity — full legal name, date of birth, and primary address
Tax Identification Number (TIN) and country of tax residence
Annual gross commission earnings received through the Prescrivia partner programme

Only legally required participant and payment information is reported. Patient assessment answers are not included. This does not establish that every partner or referral activity is reportable.

7a.2 Lawful basis

An identified applicable reporting obligation is the basis for required reporting under GDPR Article 6(1)(c); it does not permit collection for an unverified tax-reporting purpose.

7a.3 Partner notification

Affected participants receive applicable information in their separate commercial terms and tax notice; this privacy notice does not determine their individual tax obligations.

7a.4 Retention

Required tax records are kept for the jurisdiction-specific statutory period from the applicable reporting or accounting trigger; no blanket DAC7 period applies to records outside that duty.

8. Your Rights

Under GDPR, you have the right to:

Right to access — Request a copy of your personal data
Right to rectification — Correct inaccurate personal data
Right to erasure — Request deletion of your personal data (subject to legal retention requirements)
Right to data portability — Receive your data in a structured, machine-readable format
Right to restriction of processing — Restrict how we process your data
Right to object — Object to certain processing activities
Right to withdraw consent — Withdraw at any time without affecting the lawfulness of prior processing. Where a service needs that consent and no other applicable ground permits processing, that processing must stop; we explain resulting service limitations. Required records may remain restricted under an applicable legal duty.

To exercise any of these rights, please contact us.

Right to lodge a complaint — Contact your local data protection authority

We respond to data-rights requests without undue delay and within one month. Where the complexity or number of requests permits a lawful extension, we explain the reason within that month. A response deadline does not override lawful retention duties or mean that every provider copy has already been erased. Contact support@prescrivia.com for the applicable retention criteria, deletion status or transfer safeguards.

9. Data Retention

We retain personal data only while needed for its stated purpose or a separately established lawful retention ground. The applicable period, or criteria where a fixed period cannot be stated, must be disclosed for each category before collection.

Accounts and support: ordinary account data supports the account relationship; support records support resolution of the request and any necessary follow-up. Account closure or support resolution is a review trigger, not a reason to keep every related record indefinitely.

Assessments, prescriptions and orders: distinguish platform routing and fulfilment records from each independent practice’s or pharmacy’s own professional records. Completion, rejection or discontinuation of the relevant request triggers a review of continuing need. Those providers’ medical-record duties do not automatically apply to Prescrivia.

Verification: assess identity documents, raw facial captures, biometric templates, professional credentials and verification results separately. Completion, rejection, expiry or withdrawal triggers a review; retaining a minimal result does not automatically justify retaining the underlying capture.

Payments, consent and security: keep necessary transaction records for identified accounting or tax duties; necessary consent or acceptance evidence to demonstrate the relevant processing or contract; and proportionate security records for assessed detection or investigation needs. Each needs its own period and start event. A general security purpose does not justify permanent health-data retention. Optional marketing and attribution have their separately disclosed periods; withdrawal stops consent-dependent use.

Internal draft schedules have cited 10-year values for assessment/audit records, 7 years for prescription/order records and a 365-day cleanup rule for rejected or expired verification records. These values and their start events require category- and jurisdiction-specific review; they are not approved legal periods, permission to retain until the limit, or proof of deletion. A configured 30-day account-deletion grace period does not postpone a valid erasure request or extend statutory deadlines.

If an applicable law or a specific legal claim justifies retaining records after the ordinary purpose ends, retain only the necessary subset, restrict it to that purpose, and review the need when the duty or claim ends. A complaint alone does not justify retaining the entire account. Provider copies, logs and backups have separately verified deletion and expiry arrangements; account deletion does not prove their erasure. Any residual backup copy must be protected from ordinary use and a restoration must not revive data due for deletion. Specific periods, backup expiry and provider deletion evidence remain pending review. Contact support@prescrivia.com for applicable criteria and deletion status.

10. International Transfers

Storage and processing locations depend on configuration and applicable provider arrangements. European Economic Area (EEA) hosting is described where configured; this is not a guarantee that all processing takes place within the EEA. Transfers outside the EEA require an applicable legal mechanism and safeguards. OpenRouter and the selected OpenAI route's actual inference recipients, account settings, services, subprocessors, processing locations and transfer safeguards remain subject to evidence review before health-data use. Health-data processing approval for this route remains pending.

11. Changes to This Policy

This policy text, including this policy-only follow-up, was revised on 10 October 2026. We may update it from time to time and will notify you of material changes where required. Publication of this text does not establish qualified legal review or approval of the planned health-data processing using an OpenAI model through OpenRouter. Any translated notice must match the identified source revision and undergo qualified review. English availability does not displace applicable local-language or accessibility requirements.

AI-assisted assessment pre-screening

Prescrivia has selected an OpenAI model through OpenRouter for AI-assisted platform pre-screening of submitted assessment answers before a request is routed to an independent doctor. OpenRouter acts as the gateway; the actual inference providers and processing destinations require verification. Approval for this route to process health data remains pending. This disclosure describes the planned service and does not establish that health-data processing has been enabled or approved. AI output supports platform routing and does not prescribe, diagnose, treat, or replace independent doctor decision-making.

Prescrivia uses Supabase for platform storage and has selected an OpenAI model accessed through OpenRouter for planned assessment pre-screening. Before that planned transfer, direct identifiers such as name, date of birth, age, address, email, phone number and platform identifiers must be removed and free-text answers minimised. Remaining information can still be personal health data. Use requires review of the applicable processing agreements, health-data permission, actual account/service configuration, subprocessors, locations, no-training and retention safeguards, and applicable transfer safeguards and assessments for Supabase and the gateway/inference route. Data-protection approval remains pending until required evidence is reviewed. Model choice or a zero-retention request alone does not establish permission, compliance or a processing location.

For planned pre-screening, assessment answers and any requested medicine would be used to produce a score and reason codes. Depending on the reviewed routing thresholds, a request could proceed, be held for manual review, or be stopped before independent doctor review. A stopped request is a platform decision, not a doctor's rejection. Where a solely automated decision has legal or similarly significant effects, applicable law restricts its use and requires safeguards. You can contact support or support@prescrivia.com to request meaningful information about the decision, human intervention, an opportunity to express your view and to contest it. Health-data approval remains pending until the applicable legal grounds, decision safeguards and an effective human-review process have been reviewed and evidenced.

12. Children and minors

Prescrivia is intended for adults aged 18 and over. We do not knowingly collect health assessment data from children or minors, and prescription-treatment assessment flows must not be used by anyone under 18. If we learn that a minor has submitted personal data, we will restrict the account and handle deletion or retention according to applicable legal duties.

13. Contact

For privacy-related enquiries or to exercise your data rights, email support@prescrivia.com or visit our contact page.