Privacy Policy

RxPulse ("we", "us", or "the Platform") is an AI-native health platform. We take the protection of your personal information, especially health information, extremely seriously. This policy explains what we collect, why, how we protect it, and what rights you have.

RxPulse operates in the United States. We handle protected health information in line with the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules, and with the state privacy laws that apply where you live, including the California Consumer Privacy Act and the California Confidentiality of Medical Information Act for California residents.

We do not offer the service in the European Union or the European Economic Area, and this policy does not make GDPR commitments. If that changes, this policy changes with it before the service opens there.

1. Data We Collect

To provide clinical-grade health management, we collect and process the following categories of personal data:

2. Purpose and Legal Basis

We use your information for the purposes below. Where a purpose is not needed to provide the service, it is optional and you can decline it without losing the rest:

3. Data Processors and Sub-processors

We use the following third-party services to operate the Platform. Each processor is evaluated for GDPR alignment, and we execute a Data Processing Agreement (DPA) or Business Associate Agreement (BAA) with each one before it processes production personal or health data:

4. Data Retention

We retain your data in accordance with the following principles:

• Health records: Retained for the period required by the state whose medical-record retention law applies to you, commonly six to ten years after the last entry and longer for records created while you were a minor. Records are not permanently deleted during that period.
• Account data: Retained for the duration of your active account. Upon account deletion, direct account identifiers are removed within 30 days. Health and legally required records remain under a pseudonymous internal record ID for at least 10 years as required by law. Because clinical narrative can contain identifying context, those retained records are not treated as anonymous data without controlled de-identification review. Deletion starts from this page (works with or without the app installed) or from Settings within the app. Sessions end immediately; there is a 14-day window to cancel by signing back in before the removal above becomes irreversible.
• AI interaction logs: Conversation history with the AI companion is retained for 12 months to improve personalization, then automatically purged unless you choose to retain it.
• Audit logs: System access and modification logs are retained for at least 10 years, consistent with our clinical-record retention period, for security and compliance purposes.

5. Your Rights

HIPAA gives you rights over your health information, and your state may give you more. These apply to you wherever you live in the US:

6. Data Security

We implement technical and organizational measures to protect your health data, including:

• Encryption in transit (TLS) and at rest
• Fail-closed row-level security on clinical database tables
• A 12-character minimum password length and database-authoritative session expiry
• Server-controlled roles with invite-only account provisioning
• Append-only audit logging of protected health information access
• Automated dependency and vulnerability scanning in our build pipeline

7. Contact Information

For questions about this privacy policy, to exercise your rights, or to file a complaint, please contact:

If you believe your health information privacy rights have been violated, you may file a complaint with the US Department of Health and Human Services, Office for Civil Rights, at hhs.gov/hipaa/filing-a-complaint. We will never retaliate against you for filing one.