Privacy Policy

1. Information We Collect

Information You Provide Directly

We collect information you provide when you register for an account, use our platform, or communicate with us. This includes:

• Account registration information such as name, email address, job title, and firm name
• Profile information and preferences you set within the platform
• PBM proposal documents and RFP data you upload for analysis
• Communications you send to our support team
• Payment information processed through our PCI-compliant payment processor

Information Collected Automatically

When you use our platform, we automatically collect certain technical information, including:

• Log data such as IP address, browser type, pages visited, and timestamps
• Device information including hardware model, operating system, and unique device identifiers
• Usage data about features accessed and actions taken within the platform
• Performance data to monitor and improve service reliability

2. How We Use Your Information

We use the information we collect for the following purposes:

• Provide and improve our services — to operate, maintain, and enhance the Rx Contract IQ platform
• Account management — to create and manage your account and authenticate your identity
• Customer support — to respond to your inquiries and resolve issues
• Analytics and research — to understand usage patterns and improve product features
• Communications — to send service-related notifications, updates, and (with your consent) marketing communications
• Legal compliance — to comply with applicable laws, regulations, and legal obligations
• Security — to detect, prevent, and address fraud, abuse, and security incidents

We do not sell your personal information to third parties, and we do not use your uploaded PBM proposal data for any purpose other than providing you with the requested analysis.

3. Sharing of Information

We may share your information in the following limited circumstances:

• Service providers — with trusted vendors who assist in operating our platform (e.g., cloud infrastructure, payment processing, analytics), subject to strict data processing agreements
• Business transfers — in connection with a merger, acquisition, or sale of assets, with appropriate notice to affected users
• Legal requirements — when required by law, court order, or governmental authority
• Protection of rights — to protect the rights, property, or safety of Rx Contract IQ, our users, or the public
• With your consent — for any other purpose with your explicit consent

We require all third-party service providers to maintain appropriate security measures and to use your information only for the purposes for which it was disclosed.

4. Data Retention

We retain your personal information for as long as your account is active or as needed to provide services. You may request deletion of your account and associated data at any time by contacting us at [email protected].

Certain information may be retained for longer periods as required by law or for legitimate business purposes such as fraud prevention, dispute resolution, and enforcement of our agreements. Aggregated and anonymized data may be retained indefinitely for analytical purposes.

5. Security

We implement industry-standard technical and organizational measures to protect your information against unauthorized access, disclosure, alteration, and destruction. Our security practices include AES-256 encryption at rest, TLS 1.3 in transit, role-based access controls, and regular third-party security assessments.

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials.

6. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access — the right to request a copy of the personal information we hold about you
• Correction — the right to request correction of inaccurate or incomplete information
• Deletion — the right to request deletion of your personal information
• Portability — the right to receive your data in a structured, machine-readable format
• Objection — the right to object to certain processing activities
• Restriction — the right to request restriction of processing in certain circumstances

To exercise any of these rights, please contact us at [email protected]. We will respond to all requests within 30 days.

7. HIPAA Compliance

To the extent our services involve Protected Health Information (PHI) as defined under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), we operate as a Business Associate and maintain safeguards consistent with HIPAA's Privacy Rule and Security Rule. We enter into Business Associate Agreements (BAAs) with applicable customers upon request.

PHI uploaded to the platform is encrypted at rest and in transit, access is strictly role-controlled, and audit logs are maintained for all PHI access events. We do not use or disclose PHI except as permitted under applicable HIPAA provisions and as specified in our BAA.

8. Cookies & Tracking Technologies

We use cookies and similar tracking technologies to operate and improve our platform. These include:

• Essential cookies — required for platform functionality, authentication, and session management
• Analytics cookies — to understand how users interact with our platform (e.g., page views, feature usage)
• Preference cookies — to remember your settings and preferences

You can control cookie preferences through your browser settings. Disabling certain cookies may affect platform functionality.

9. Children's Privacy

Our platform is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a minor, please contact us immediately at [email protected] and we will promptly delete such information.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by email or through a prominent notice on our platform at least 30 days before the changes take effect. Your continued use of our platform after the effective date constitutes acceptance of the updated policy.

11. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Privacy Team:

• Email: