Privacy Policy

1. Introduction

This Privacy Policy explains how Prescrivia ("we", "us", "our") collects, uses, stores, and protects your personal data when you use our platform. We are committed to protecting your privacy in accordance with the General Data Protection Regulation (GDPR) and applicable EU data protection laws.

2. Data Controller

Prescrivia is the data controller for platform data. Independent doctors and pharmacies act as joint or independent controllers for the medical data they process in the course of providing healthcare services.

3. Data We Collect

3.1 Account Data

When you create an account, we collect: name, email address, date of birth, and delivery address.

3.2 Health Assessment Data

When you submit a health assessment, we collect medical information including: current symptoms, medical history, current medications, allergies, and lifestyle factors. This data is classified as special category data under GDPR and receives additional protections.

3.3 Payment Data

We collect payment information necessary to process your transaction. Full payment card details are processed by our PSD2-compliant payment provider and are not stored on our servers.

3.4 Technical Data

We automatically collect: IP address, browser type, device information, and usage analytics to improve our service.

3.5 Referral & Attribution Data

Prescrivia operates a partner referral programme. When you visit our platform via a partner referral link (e.g., /partner/:identifier or a URL containing ?ref=), we collect limited attribution data — but only after you have given consent to marketing cookies via the cookie banner.

3.5.1 What we collect (with consent)

When a visitor arrives through a partner referral link and marketing-cookie consent has been given, we collect: the fact of the visit and the partner identifier, the referral URL, UTM parameters, IP address, and user-agent string. These data points are used solely to determine whether the visitor later registers an account and whether that registration can be attributed to a referring partner, and for fraud prevention. Without consent, no referral data is collected.

3.5.2 The attribution token

If marketing-cookie consent is in place, we store a short-lived attribution token in your browser's local storage under the key partner_attribution. The token lasts 30 days. If you register a Prescrivia account within those 30 days, your account may be attributed to the referring partner. The token does not track browsing behaviour on other websites and contains no personal data in itself.

3.5.3 What the partner sees

Partners can view only:

• Aggregate referral counts — the number of attributed registrations and completed orders
• Referral dates — the date each attribution occurred

Partners cannot see:

• The visitor's identity, name, email address, or contact details
• The visitor's IP address
• Any health data, medical history, symptoms, medications, or clinical information
• Any payment or financial information belonging to the visitor

3.5.4 Commission basis

Partner commission is calculated exclusively on the Prescrivia platform service fee component of an order. It is never calculated on medication costs, doctor consultation fees, pharmacy dispensing charges, or any other healthcare-related line items.

3.5.5 Lawful basis

3.5.6 Retention

• partner_attribution token (local storage): 30 days from visit
• Referral attribution records (account-level link): per the applicable partner terms and tax/financial retention periods
• Partner commission records: per statutory tax retention requirements (typically 5–10 years depending on member state)

See the Cookie Policy for details on the partner_attributionlocal-storage entry, and the "Tax Reporting (DAC7)" section below for tax reporting of partner earnings.

4. Legal Basis for Processing

• Consent — For processing health data and marketing communications
• Contractual necessity — For providing our platform services
• Legitimate interest — For security, fraud prevention, and service improvement
• Legal obligation — For regulatory compliance and record-keeping

5. How We Use Your Data

• Facilitating the connection between you and healthcare professionals
• Processing your health assessments and transmitting them to reviewing doctors
• Processing payments and managing orders
• Communicating with you about your assessments and orders
• Improving our platform and services
• Complying with legal and regulatory requirements

6. Data Sharing

We share your data only as necessary:

• Independent doctors — Your health assessment for medical review
• Licensed pharmacies — Prescription and delivery details
• Payment providers — Payment processing data
• Delivery services — Delivery address and tracking

6.1 Sub-processors and recipients

Prescrivia uses vetted service providers only where needed to operate the platform, process payments, verify identity, send transactional communications, monitor security, and support de-identified platform pre-screening. Current sub-processors include Wise for payment-related workflows, Didit for identity verification, Anthropic for AI-assisted assessment pre-screening, Resend for transactional email, Apify for regulated-data collection workflows, Sentry for error monitoring, and Supabase for database, authentication, storage, and edge-function hosting.

We do not sell your personal data to third parties. We do not share your data for marketing purposes without your explicit consent.

7. Data Security

We protect your data using:

• Encrypted transport for sensitive workflows
• EU-hosted infrastructure and restricted access controls where configured
• Role-based access controls with multi-factor authentication
• Regular security audits and penetration testing
• Automatic session timeouts for clinical data access

7a. Tax Reporting (DAC7)

Prescrivia operates a partner referral programme in which partners may receive commission payments. Under Council Directive 2021/514 (DAC7), digital platforms that facilitate payments to sellers — including partner programme participants — must collect and report certain information about those sellers to EU member-state tax authorities annually where statutory thresholds are met.

7a.1 What data may be reported

Where DAC7 reporting applies, the following partner data may be reported:

• Partner identity — full legal name, date of birth, and primary address
• Tax Identification Number (TIN) and country of tax residence
• Annual gross commission earnings received through the Prescrivia partner programme

This reporting is limited to partner programme participants. Patient data, health data, visitor data, and referral attribution data (other than the partner's own earnings total) are not included in DAC7 reports.

7a.2 Lawful basis

The collection, retention, and reporting of partner data for DAC7 purposes is a legal obligation under GDPR Art. 6(1)(c).

7a.3 Partner notification

Partners are separately informed of their DAC7 reporting obligations via the Partner Terms and Conditions and their partner dashboard.

7a.4 Retention

Partner identity, TIN, and earnings data processed for DAC7 purposes is retained for the period required by applicable tax law in the relevant member state, typically 5 to 10 years from the end of the reporting period.

8. Your Rights

Under GDPR, you have the right to:

• Right to access — Request a copy of your personal data
• Right to rectification — Correct inaccurate personal data
• Right to erasure — Request deletion of your personal data (subject to legal retention requirements)
• Right to data portability — Receive your data in a structured, machine-readable format
• Right to restriction of processing — Restrict how we process your data
• Right to object — Object to certain processing activities
• Right to withdraw consent — Withdraw consent at any time without affecting prior processing

To exercise any of these rights, please contact us.

9. Data Retention

We retain your personal data for as long as necessary to provide our services and comply with legal obligations. Medical records may be retained for the period required by applicable healthcare regulations. When you request deletion, we process it within 30 days, subject to legal retention requirements.

10. International Transfers

Your data is stored and processed within the European Economic Area (EEA). We do not transfer personal data outside the EEA unless required and only with appropriate safeguards in place.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email. The date at the top of this page indicates when it was last updated.

AI-assisted assessment pre-screening

Prescrivia may use Anthropic Claude, with OpenAI available only as a documented fallback, to support initial platform pre-screening of submitted assessment answers before a request is routed to an independent doctor. The AI output is used as a routing support signal and does not prescribe, diagnose, treat, or replace independent doctor decision-making.

Before any assessment data is sent for this pre-screening, Prescrivia removes direct identifiers such as name, date of birth, age, address, email, phone number, user IDs, order IDs, and similar platform identifiers. Anthropic and fallback OpenAI processing for production require a data processing agreement, no-training or Zero Data Retention equivalent terms, and a documented Transfer Impact Assessment.

If platform pre-screening prevents a request from proceeding, you may contact support or the Data Protection Officer to request review of the decision-support record.

12. Children and minors

Prescrivia is intended for adults aged 18 and over. We do not knowingly collect health assessment data from children or minors, and prescription-treatment assessment flows must not be used by anyone under 18. If we learn that a minor has submitted personal data, we will restrict the account and handle deletion or retention according to applicable legal duties.

13. Contact

For privacy-related enquiries or to exercise your data rights, email our Data Protection Officer at dpo@prescrivia.com or visit our contact page.