1. About this policy
This Privacy Policy explains how SandboxRX ("we", "us", "our") collects, uses, shares and protects information when you use the websites, applications and services we provide at sandbox.connectusrx.com (the "Service"), and the choices you have.
2. Health information
Practices, providers and pharmacies that use the Service are responsible for the health information of their patients. When we handle protected health information ("PHI") on their behalf we do so as a business associate, under agreements with them and in line with HIPAA and applicable state law. How a particular healthcare organization uses and discloses your PHI is described in its own Notice of Privacy Practices, which you can request from that organization. This policy covers the rest of the information we handle, such as account, device and usage information, and applies in addition to those notices.
3. Information we collect
- Account information: name, email address, mobile phone number, role, the organizations you belong to, and your sign-in credentials (passwords are stored hashed).
- Information you or your healthcare organization submit: for example profile details, prescriptions and orders, documents, messages and payment details needed to complete a purchase.
- Device and usage information: browser and device type, IP address, pages and features used, and security events such as sign-in attempts.
- Communications: records of the emails and text messages we send you (content, time and delivery status) and of your responses and opt-outs.
4. How we use information
- To provide, secure and maintain the Service, including verifying that it is really you signing in.
- To process orders and payments and to share information among the practices, providers and pharmacies involved in your care or your orders.
- To send service messages: verification links and codes, security alerts, and status updates for your orders, prescriptions and appointments.
- To detect and prevent fraud and abuse, to troubleshoot, and to improve the Service.
- To comply with the law and to enforce our Terms of Service.
We do not sell your personal information.
5. How we share information
- With the healthcare organizations you use: practices, providers and pharmacies you interact with through the Service.
- With service providers: vendors that help us run the Service (hosting, messaging, payment processing, email, security), who may only use the information to serve us and are bound by confidentiality and security obligations.
- For legal reasons: when required by law or legal process, to protect rights, safety and security, or in a merger, acquisition or sale of assets (with notice where required).
- With your direction or consent.
6. Text message (SMS) program
If you provide your mobile number, we use it to send account and service text messages such as sign-in verification links and codes, security alerts and status updates. Message frequency varies; message and data rates may apply. Reply STOP at any time to opt out and HELP for help.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties. Mobile numbers are shared only with the messaging providers that deliver our messages, for that purpose alone.
7. Cookies and similar technologies
We use cookies and browser storage that are needed for the Service to work, not for advertising:
- a session cookie that keeps you signed in and protects forms against forgery;
- a cookie remembering the company you selected on this domain, so the right sign-in page opens;
- a cookie remembering the companies you recently used on this browser, shown as shortcuts on the sign-in page;
- browser storage for your in-app display preferences.
You can clear these at any time from Preferences at the bottom of the sign-in pages, or in your browser settings. Blocking them may stop parts of the Service from working.
8. Security
We use administrative, technical and physical safeguards appropriate to the sensitivity of the information, including encryption in transit, access controls, audit logging and verification of sign-ins. No system is perfectly secure, so we cannot guarantee absolute security. Keep your credentials private and tell us at once if you suspect a problem.
9. Retention
We keep information for as long as needed to provide the Service and meet legal, accounting and record-keeping obligations (health records are often subject to minimum retention periods), then delete or de-identify it.
10. Your choices and rights
Depending on where you live, you may have the right to access, correct or delete personal information, or to know how it is used and shared. Requests about health records are generally handled by the healthcare organization that holds them, and we will help route them. To make a request, or to ask a question, contact us at no-reply@go.mypracticeconnect.com. We may need to verify your identity first. You may opt out of text messages by replying STOP.
11. Children
The Service is not directed to children under 13 and we do not knowingly collect their information. A parent or legal guardian may use the Service on behalf of a minor patient.
12. Changes to this policy
We may update this policy from time to time. The effective date above shows the latest version, and we will give notice of material changes where the law requires it.
13. Contact
SandboxRX
Email: no-reply@go.mypracticeconnect.com
See also our Terms of Service.