Privacy Policy

1. Introduction

StagesRx ("Company," "we," "our," or "us") is committed to protecting the privacy and security of the information we collect from our users. This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you use our platform, website, and related services (collectively, the "Services").

By accessing or using our Services, you agree to the terms of this Privacy Policy. If you do not agree with any part of this policy, please do not use our Services.

For healthcare-related information that constitutes Protected Health Information (PHI) under the Health Insurance Portability and Accountability Act (HIPAA), our practices are governed by our HIPAA Notice of Privacy Practices, which is incorporated by reference into this Privacy Policy.

2. Information We Collect

We collect several types of information from and about users of our Services:

3. How We Use Your Information

We use the information we collect for the following purposes:

• Providing, maintaining, and improving our Services
• Processing and facilitating healthcare transactions and workflows
• Authenticating users and maintaining account security
• Communicating with you about your account, orders, and updates
• Sending administrative messages, technical notices, and security alerts
• Responding to your comments, questions, and support requests
• Complying with legal obligations, including HIPAA requirements
• Detecting, preventing, and addressing fraud, abuse, and security incidents
• Analyzing usage patterns to improve the platform

4. Cookies

We use the following categories of cookies:

• Strictly necessary cookies — Required for the Services to function. These include session authentication cookies and security tokens. They cannot be disabled.
• Analytics cookies — Help us understand how visitors interact with our website so we can improve it. We use aggregated, anonymized data only.
• Marketing cookies — Used to deliver relevant advertisements and measure campaign performance. Disabled by default; only enabled with your explicit consent.

You can manage your cookie preferences at any time using the cookie consent banner on our website, or by adjusting your browser settings. Note that disabling certain cookies may affect the functionality of the Services.

5. Information Sharing and Disclosure

We do not sell, trade, or otherwise transfer your personal information to third parties for their marketing purposes. We may share your information in the following circumstances:

• Service providers — We share information with trusted third-party vendors who assist us in operating our platform (e.g., cloud hosting, payment processors, communication services). These providers are contractually bound to protect your information and use it only to provide services on our behalf.
• Healthcare operations — We may share PHI with covered entities, business associates, and other authorized parties as permitted under HIPAA and your Business Associate Agreement with us.
• Legal compliance — We may disclose information when required by law, court order, or governmental authority, or to protect the rights, property, or safety of our company, users, or others.
• Business transfers — In the event of a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as part of that transaction.

6. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. For healthcare records and PHI, we follow applicable federal and state retention requirements, which typically require retention for a minimum of six (6) years from the date of creation or last effective date.

When we no longer need your personal information, we will securely delete or anonymize it.

7. Data Security

We implement comprehensive technical, administrative, and physical safeguards to protect your information, including:

• End-to-end encryption for data in transit and at rest
• Role-based access controls limiting data access to authorized personnel
• Regular security audits and vulnerability assessments
• Multi-factor authentication for platform access
• Secure, HIPAA-compliant cloud infrastructure
• Comprehensive audit logging of all data access and modifications

Despite our best efforts, no security system is impenetrable. We cannot guarantee the absolute security of your information. In the event of a data breach affecting your information, we will notify you in accordance with applicable laws.

8. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal information:

• Access — Request a copy of the personal information we hold about you.
• Correction — Request correction of inaccurate or incomplete information.
• Deletion — Request deletion of your personal information, subject to legal and regulatory retention requirements.
• Portability — Request a machine-readable copy of your information to transfer to another service.
• Opt-out — Opt out of non-essential cookies and certain marketing communications.

For patients seeking to exercise rights regarding your PHI (such as the right to access or amend your medical records), please contact your healthcare provider directly. We process such requests as directed by the covered entity.

9. De-Identified Data

We may de-identify personal information so that it can no longer reasonably be used to identify you, in accordance with applicable law, including HIPAA de-identification standards. De-identified information is not subject to this Privacy Policy and may be used for any purpose, including analytics, product improvement, and research.

10. Third-Party Links

Our Services may contain links to third-party websites and services. This Privacy Policy does not apply to those external sites. We encourage you to review the privacy policies of any third-party sites you visit, as we are not responsible for their privacy practices.

11. Children's Privacy

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal information from a child, we will take steps to delete that information promptly.

12. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to delete your information, and the right to opt out of the sale of your personal information. We do not sell personal information. To exercise your CCPA rights, contact us at the address below.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website with a new effective date, and where required by law, by providing additional notice (such as by email). Your continued use of our Services after the effective date constitutes your acceptance of the updated policy.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us: