Privacy Policy

SxRx PLLC d/b/a SXRX Health ("SXRX," "we," "us," or "our") respects your privacy. This Privacy Policy describes how we collect, use, share, and protect your information when you use the SXRX Health platform.

1. Information We Collect

Information you provide

• Account information: name, email address, phone number, password (hashed).
• Medical and health information: intake responses, symptoms, medical history, medications, allergies, biometric values (height, weight, BP), lab results, mental-health screener responses, and journal entries.
• Identity verification information: government ID image, selfie, and date of birth (processed by our identity verification provider).
• Payment information: billing name, address, and tokenized card details (card data is tokenized by our payment gateway; your full card number is never stored by SXRX).
• Communications: messages you send to providers, support tickets, and in-app interactions.

Information collected automatically

• Device and usage data: IP address, browser type, device identifiers, pages visited, timestamps, and referring URLs.
• Cookies and similar technologies: session cookies and security cookies. We do not currently use third-party advertising cookies.

2. How We Use Your Information

• Provide and maintain the Platform, including connecting you with a California-licensed physician and our dispensing pharmacy.
• Process payments and manage subscriptions.
• Verify your identity for medications requiring identity verification.
• Operate the patient portal, including goal tracking, lab visualization, refill management, and clinical follow-up.
• Communicate with you (account, clinical, and transactional communications and, with your consent, marketing communications).
• Comply with legal obligations, prevent fraud, and protect the rights and safety of users and the public.
• Improve and develop the Platform.

3. How We Share Your Information

We share your information only as follows:

• With licensed physicians who treat you, so they can provide care.
• With licensed pharmacies that fill your prescriptions, for fulfillment and shipping.
• With service providers who help us operate the Platform (electronic health records, payment processing, identity verification, hosting, email delivery, shipping, lab ordering, and error monitoring). These providers are contractually limited to using your information only on our behalf.
• For legal reasons, when required by law, subpoena, court order, or to protect rights, property, or safety.
• In a business transaction, such as a merger or acquisition, subject to the new entity honoring this Policy.
• With your consent, for any other purpose disclosed at the time of consent.

We do not sell your personal information.

4. Third-Party Services We Use

The following providers process information on our behalf. Each is contractually required to maintain confidentiality and appropriate security:

• Numbers Payments / NMI: card payment processing. Card data is tokenized by the payment gateway and is never stored by SXRX.
• Amazon Web Services: hosting, database, and document storage, and Amazon Bedrock for our AI features, all under AWS's Business Associate Addendum. See the "Artificial Intelligence and Automated Tools" section below.
• Mailgun: transactional email delivery.
• Healthie: electronic health records.
• Veriff: identity verification.
• EasyPost: shipping label generation.
• Rupa Health: diagnostic lab ordering and result delivery.
• Sentry: application error monitoring, configured to strip personal data.

5. Your Choices and Rights

• Access and update. You can review and update most of your information in your account.
• Delete. You may request account deletion by emailing privacy@sxrx.us. Note that we may retain certain records as required by law (e.g., medical records retention rules).
• Marketing opt-out. Every marketing email contains an unsubscribe link.
• Communication preferences. You may adjust your communication settings in your account.

6. Data Retention

We retain your information for as long as your account is active and as needed to provide services, comply with legal obligations, resolve disputes, and enforce our agreements. Medical and pharmacy records are retained per applicable state and federal record-retention rules (typically 6–10 years for medical records).

7. Security

We use industry-standard administrative, physical, and technical safeguards to protect your information, including TLS encryption in transit, encrypted storage at rest, role-based access controls, audit logging, and regular security review. No system is perfectly secure; we cannot guarantee absolute security.

8. Children

The Platform is intended for adults aged 18 and older. We do not knowingly collect information from children under 18. If you believe a minor has provided us with information, contact privacy@sxrx.us and we will delete it.

9. State Privacy Rights

California residents have rights under the California Consumer Privacy Act (CCPA) as amended by the CPRA, including the right to know, access, delete, correct, and limit use of sensitive personal information; the right to opt out of sale or sharing (note: we do not sell personal information); and the right to non-discrimination for exercising privacy rights.

Texas residents have rights under the Texas Data Privacy and Security Act (TDPSA), including the rights to access, correct, delete, and obtain a copy of their personal data and to opt out of targeted advertising, sale, or profiling.

To exercise any of these rights, email privacy@sxrx.us. We will verify your request before fulfilling it.

10. Updates

We may update this Privacy Policy. We will post the updated version with a new "Last updated" date and notify you of material changes by email or in-app notice.

11. Artificial Intelligence and Automated Tools

SXRX uses artificial intelligence (AI) tools to support your care, never to replace it. AI does not diagnose you, does not set or change dosing, and does not decide what treatment you receive. Prescribing criteria are set by a licensed physician.

We currently use two AI tools:

• Patient Care Assistant. A conversational assistant in your patient portal that answers general, non-individualized health questions, helps you understand information in your account, and helps you navigate the Platform. It is restricted by design from diagnosing, prescribing, or giving individualized medical advice, and it directs you to your licensed provider for anything requiring clinical judgment. If it detects language suggesting a medical or mental-health emergency, it surfaces emergency resources (911 and the 988 Suicide & Crisis Lifeline).
• Lab-document parser. When you upload a lab report, this tool extracts the values (test name, result, units, reference range) into a structured format, and those values are compared with the reference ranges our physician requires for your treatment. If every value is within range, the lab requirement for your order is satisfied automatically. If any value is out of range, or the report cannot be read reliably, it is sent to the physician for personal review. The tool does not diagnose you or interpret your results.

What information is processed. To provide these features, limited information you provide, which may include protected health information such as the contents of your questions or your lab values, is processed by a large language model (Anthropic's Claude) provided through Amazon Bedrock. Both features run within SXRX's own Amazon Web Services account.

How your information is protected. Amazon Web Services acts as our business associate under its Business Associate Addendum, which covers Amazon Bedrock and limits AWS to processing your information only to provide the service on our behalf. Your information is not used to train the AI models. Information is encrypted in transit, and we send only the minimum information necessary.

Human oversight. Your intake questionnaire was written by our physician and serves as your consultation. When your answers, and any lab results your treatment requires, meet the physician's prescribing criteria with nothing flagged, the prescription is issued under the physician's protocol and sent to the pharmacy. Controlled medications always receive the physician's personal review before release, as does any answer or result that falls outside those criteria. You can ask to speak with the physician at any time.

Your choice. Use of the Care Assistant is optional; you can use the Platform and receive care without it. Questions about our use of AI can be sent to privacy@sxrx.us.

12. Contact

Privacy questions: privacy@sxrx.us.
HIPAA questions: see our HIPAA Notice of Privacy Practices.
Mailing address: 6354 N Mesa St, El Paso, TX 79912