Privacy Policy & Notice of Privacy Practices

ClinicRX · www.clinicrxmed.com
Effective Date: November 5, 2026
Last Reviewed: November 5, 2026

IMPORTANT NOTICE TO ALL PATIENTS

This Notice of Privacy Practices describes how Clinic RX ("Clinic RX," "we," "us," or "our") may use and disclose your Protected Health Information (PHI) and how you can access this information. This document is required under the Health Insurance Portability and Accountability Act (HIPAA) and applicable state privacy laws. PLEASE REVIEW THIS NOTICE CAREFULLY.

On this page

  1. Introduction & Scope
  2. Information We Collect
  3. How We Use Your Information
  4. Data Storage & Security
  5. Who Has Access to Your Information
  6. Data Retention
  7. Your Patient Rights
  8. State-Specific Privacy Rights
  9. Contact for Privacy Inquiries
  10. Cookies & Website Tracking
  11. Changes to This Privacy Policy
  12. Governing Law

1. Introduction & Scope

Clinic RX is an online-based pharmacy operating at www.clinicrxmed.com, serving patients across the United States, including but not limited to residents of Texas, Florida, and California. We are committed to protecting the privacy, confidentiality, and security of your personal information and Protected Health Information (PHI) in compliance with all applicable federal and state laws.

This Privacy Policy and Notice of Privacy Practices applies to:

  • All patients who use or register for services at www.clinicrxmed.com
  • All personal and health-related information collected through our website, mobile applications, phone, or any other channel
  • All employees, contractors, business associates, and agents of Clinic RX who handle patient information

This document governs our practices with respect to your information and outlines your rights as a patient. By using our services, you acknowledge that you have read and understood this Privacy Policy.

2. Information We Collect

We collect several categories of information necessary to provide you with safe, accurate, and personalized pharmacy services. The table below summarizes the categories and specific types of data collected.

Category

Personal Identifiers

Specific Data Elements

Full legal name, date of birth, gender, email address, phone number, mailing address

Purpose

Patient identity verification; order fulfillment; communication

Category

Government-Issued ID

Specific Data Elements

State-issued ID or driver’s license number, last 4 digits of Social Security Number (when required by state law)

Purpose

Identity verification; controlled substance dispensing compliance

Category

Prescription Information

Specific Data Elements

Prescriber name, NPI number, drug name, dosage, quantity, fill dates, refill history, allergy information, medical conditions relevant to prescriptions

Purpose

Dispensing accuracy; drug interaction checks; regulatory compliance

Category

Payment Information

Specific Data Elements

Credit/debit card number (encrypted), billing address, insurance carrier and policy/group number, insurance ID number, co-pay and reimbursement data

Purpose

Payment processing; insurance billing; claims adjudication

Category

Account & Login Data

Specific Data Elements

Username, hashed password, account creation date, login history, IP address, device identifiers

Purpose

Account security; fraud prevention; audit logging

Category

Communications

Specific Data Elements

Records of calls, emails, or chat interactions with our pharmacy staff

Purpose

Service delivery; quality assurance; dispute resolution

Category

Technical Data

Specific Data Elements

Browser type, operating system, pages visited, session duration, referring URLs

Purpose

Website functionality; analytics; security monitoring

2.1 How Information Is Collected

We collect information through the following means:

  • Directly from you when you create an account, submit a prescription, or contact us
  • From your prescribing healthcare provider when they electronically transmit prescriptions
  • From your health insurance plan or pharmacy benefit manager (PBM) for billing purposes
  • Automatically via cookies, web beacons, and similar tracking technologies on our website (see Section 10 for cookie details)
  • From third-party identity verification services as required by law

3. How We Use Your Information

We use your Protected Health Information (PHI) and personal data only as permitted under HIPAA and applicable law. Your information is used for the following purposes:

3.1 Treatment, Payment & Healthcare Operations (HIPAA Permitted Uses)

  • Dispensing, fulfilling, and delivering prescription medications accurately and safely
  • Verifying prescriptions with licensed prescribers and checking for drug interactions or contraindications
  • Processing insurance claims and coordinating benefits with your insurer or PBM
  • Conducting quality assurance reviews, staff training, and improving our pharmacy operations
  • Maintaining accurate medication histories and profiles for patient safety

3.2 Legal & Regulatory Compliance

  • Reporting to the Drug Enforcement Administration (DEA) and state boards of pharmacy as required
  • Complying with state-mandated Prescription Drug Monitoring Programs (PDMPs) in Texas, Florida, California, and other states
  • Responding to lawful court orders, subpoenas, or government investigations
  • Detecting, preventing, and reporting fraud, abuse, or diversion of controlled substances

3.3 Communications

  • Sending prescription-ready notifications, refill reminders, and delivery updates
  • Providing customer service and responding to your inquiries
  • Sending safety alerts or drug recall notifications that may affect your medications

3.4 Business Operations (De-Identified Data Only)

We may use de-identified, aggregated data (from which all personal identifiers have been removed in compliance with HIPAA’s de-identification standards under 45 CFR § 164.514) for business analytics and service improvement purposes. This data cannot be used to identify you.

We Do Not Sell Your PHI

Clinic RX does not sell, rent, or monetize your Protected Health Information or personal health data to any third party for their own marketing or commercial purposes. This applies regardless of your state of residence.

4. Data Storage & Security

4.1 Storage Infrastructure

All patient data and PHI is stored using HIPAA-compliant cloud infrastructure hosted within the United States. Our storage practices include:

  • Encrypted databases using AES-256 encryption at rest for all patient records and PHI
  • TLS 1.2 or higher encryption for all data transmitted between your browser and our servers
  • Logically isolated, access-controlled environments for PHI separate from general business data
  • Geographically redundant backups to ensure data availability and disaster recovery
  • All cloud service providers are under executed Business Associate Agreements (BAAs) as required by HIPAA

4.2 Security Controls

We implement a comprehensive, multi-layered security program that includes:

Administrative Safeguards

  • Designated HIPAA Privacy Officer and Security Officer
  • Annual HIPAA training for all workforce members with access to PHI
  • Background checks for employees handling PHI
  • Formal information access management policies and sanction policies
  • Regular security risk assessments and remediation plans (per 45 CFR § 164.308)

Physical Safeguards

  • Restricted physical access to server infrastructure and workstations containing PHI
  • Workstation use policies and screen lock requirements
  • Secure media disposal procedures for devices storing PHI

Technical Safeguards

  • Role-based access controls (RBAC) limiting access to the minimum necessary PHI
  • Multi-factor authentication (MFA) required for all systems containing PHI
  • Automated session timeouts and activity monitoring
  • Intrusion detection systems and 24/7 security monitoring
  • Audit logs maintained for all access to and modifications of PHI
  • Vulnerability scanning and penetration testing performed regularly

Data Breach Notification

In the event of a breach of unsecured PHI, Clinic RX will notify affected individuals without unreasonable delay and within 60 days of discovery, as required by the HIPAA Breach Notification Rule (45 CFR Part 164, Subpart D). Notifications will include a description of the breach, types of information involved, steps you should take to protect yourself, and actions we are taking. We will also notify the Secretary of HHS and, for breaches affecting 500+ individuals in a state, the prominent media outlets in that state.

5. Who Has Access to Your Information

5.1 Internal Access

Access to your PHI within Clinic RX is strictly limited on a “minimum necessary” basis. The following roles may access PHI only to the extent required to perform their job duties:

Role

Licensed Pharmacists

Scope of PHI Access

Full prescription, medication history, allergy, and clinical information necessary for dispensing

Role

Pharmacy Technicians

Scope of PHI Access

Prescription data and medication history required to process and fill orders (under pharmacist supervision)

Role

Billing & Insurance Staff

Scope of PHI Access

Payment, insurance, and prescription data required for claims processing

Role

Customer Service Representatives

Scope of PHI Access

Account information and order status; prescription data only as needed to assist with service inquiries

Role

IT / Security Staff

Scope of PHI Access

System-level access for maintenance, under strict audit logging; PHI access minimized and monitored

Role

Compliance & Privacy Officers

Scope of PHI Access

Access to records as needed to investigate incidents, audits, or patient rights requests

5.2 Business Associates

We may share your PHI with third-party Business Associates who perform services on our behalf. All Business Associates are required to sign a Business Associate Agreement (BAA) that obligates them to protect your PHI in compliance with HIPAA. Business Associate categories include:

  • Cloud infrastructure and hosting providers (who store encrypted data on our behalf)
  • Payment processors and pharmacy benefit managers (PBMs)
  • Pharmacy management software and electronic health record (EHR) vendors
  • Identity verification and fraud prevention services
  • Delivery and logistics partners (limited to name and address only)
  • Legal, audit, and compliance consultants operating under confidentiality obligations

5.3 Permitted Disclosures Without Your Authorization

HIPAA permits us to disclose your PHI without your written authorization in limited circumstances:

  • To public health authorities for disease reporting, adverse event reporting, or PDMP compliance
  • To law enforcement officials when required by law or in response to a lawful court order or subpoena
  • To the Secretary of Health and Human Services (HHS) for HIPAA compliance investigations
  • In situations involving a serious and imminent threat to health or safety
  • To coroners, medical examiners, or funeral directors as permitted by law
  • For workers’ compensation claims as authorized by state law

5.4 Disclosures Requiring Your Written Authorization

For uses and disclosures not described in this Policy, we will obtain your written authorization before sharing your PHI, including:

  • Marketing communications involving your PHI
  • Sale of PHI to any third party
  • Disclosure of psychotherapy notes
  • Most disclosures of PHI for purposes unrelated to your treatment, payment, or our healthcare operations

You may revoke any previously granted authorization in writing at any time, and we will honor your revocation for future disclosures.

6. Data Retention

We retain patient records and PHI for the periods required by federal and applicable state law, after which records are securely destroyed in accordance with HIPAA-compliant media disposal procedures.

Record Type

Prescription records (non-controlled)

Retention Period

Minimum 5 years from last fill (TX, FL); minimum 3 years from dispense (CA)

Governing Authority

State boards of pharmacy; HIPAA

Record Type

Controlled substance prescription records

Retention Period

Minimum 5 years (TX, FL, CA)

Governing Authority

DEA 21 CFR § 1304; State law

Record Type

Patient PHI / medical records

Retention Period

10 years from creation or last encounter (best practice; minimum 6 years per HIPAA)

Governing Authority

HIPAA 45 CFR § 164.530(j); State law

Record Type

Billing & payment records

Retention Period

7 years (aligned with IRS and state tax requirements)

Governing Authority

IRS; State law

Record Type

HIPAA security risk assessments & policies

Retention Period

6 years from creation or last effective date

Governing Authority

HIPAA 45 CFR § 164.316(b)

Record Type

Breach notification records

Retention Period

6 years

Governing Authority

HIPAA Breach Notification Rule

Record Type

Website logs & technical data

Retention Period

12 months, then de-identified or deleted

Governing Authority

Internal policy

Record Type

Account information (inactive accounts)

Retention Period

3 years after last activity, then deleted upon request

Governing Authority

Internal policy; state law

Upon expiration of applicable retention periods, PHI is destroyed using methods such as shredding (for paper), cryptographic erasure, or certified secure deletion (for digital records), ensuring data is rendered irrecoverable.

7. Your Patient Rights

As a patient, you have specific rights regarding your PHI under HIPAA (45 CFR §§ 164.520–164.528) and applicable state law. To exercise any of the rights below, please contact our Privacy Officer using the information in Section 9.

7.1 Right to Access & Copy Your Records

You have the right to inspect and obtain a copy of your PHI maintained in our designated record sets, including your prescription records, billing information, and profile data. Requests will be fulfilled within 30 days (one 30-day extension permitted with written notice). We may charge a reasonable cost-based fee for copies.

7.2 Right to Request Amendment

If you believe your PHI is inaccurate or incomplete, you may request that we amend it. We will respond within 60 days. We may deny your request if the information was not created by us, is not part of our designated record set, or is accurate and complete.

7.3 Right to an Accounting of Disclosures

You may request an accounting of certain disclosures of your PHI made in the prior six years. This right does not apply to disclosures made for treatment, payment, healthcare operations, or disclosures made with your authorization.

7.4 Right to Request Restrictions

You may request that we restrict certain uses or disclosures of your PHI. We are not required to agree to your request, except that we must honor a request to restrict disclosure to a health plan for services you paid for out-of-pocket in full.

7.5 Right to Confidential Communications

You may request that we contact you using a specific method (e.g., email only) or at a specific location. We will accommodate reasonable requests.

7.6 Right to Receive a Paper Copy of This Notice

You may request a paper copy of this Notice at any time, even if you have agreed to receive it electronically.

7.7 Right to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with Clinic RX’s Privacy Officer or with the U.S. Department of Health and Human Services, Office for Civil Rights, at:

  • Online: www.hhs.gov/ocr/privacy/hipaa/complaints
  • Phone: 1-800-368-1019
  • Mail: 200 Independence Avenue, S.W., Washington, D.C. 20201

You will not be retaliated against for filing a complaint in good faith.

8. State-Specific Privacy Rights

In addition to HIPAA rights, patients residing in certain states have additional privacy rights under applicable state law. The following provisions apply by state.

TEXAS RESIDENTS — Texas Medical Records Privacy Act (TMRPA) & Texas Health & Safety Code Ch. 181

Under Texas Health & Safety Code Chapter 181, Texas residents have additional protections for health information:

  • Authorization required before disclosing your PHI to most third parties not involved in your direct care
  • Right to access your records within 15 business days of request (stricter than federal HIPAA’s 30 days)
  • Complaints may also be filed with the Texas Health and Human Services Commission (HHSC) and the Texas Medical Board
  • Texas law may impose civil and criminal penalties for unauthorized disclosure of PHI in addition to federal HIPAA penalties

FLORIDA RESIDENTS — Florida Information Protection Act (FIPA) & Florida Statutes Ch. 395, 456, 765

Florida residents have rights under FIPA and applicable health statutes, including:

  • Right to access your medical records within 30 days at a reasonable cost (Fla. Stat. § 456.057)
  • Right to receive a Notice of Privacy Practices before treatment or prescription services are first provided
  • Data breach notification required within 30 days of determination of breach (FIPA; stricter than HIPAA’s 60-day standard)
  • Right to inspect and correct your health records; records involving mental health, HIV status, or substance abuse have heightened protections under Florida law

CALIFORNIA RESIDENTS — CCPA/CPRA, CMIA & California Health & Safety Code

California residents have rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), and the Confidentiality of Medical Information Act (CMIA):

Rights Under CCPA/CPRA:

  • Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you, as well as categories of sources, business purposes, and third parties with whom we share it (Cal. Civ. Code § 1798.100)
  • Right to Delete: Request deletion of personal information we hold about you, subject to legal exceptions (Cal. Civ. Code § 1798.105)
  • Right to Correct: Request correction of inaccurate personal information (CPRA; Cal. Civ. Code § 1798.106)
  • Right to Opt-Out: Opt out of the “sale” or “sharing” of your personal information. Clinic RX does not sell or share your PHI or personal information for cross-context behavioral advertising.
  • Right to Limit Use of Sensitive Personal Information: Limit our use of sensitive personal information (including health information) to purposes reasonably necessary for providing services (Cal. Civ. Code § 1798.121)
  • Right to Non-Discrimination: You will not receive discriminatory treatment for exercising any of your CCPA/CPRA rights

Rights Under CMIA (California Health & Safety Code § 56 et seq.):

  • Your medical information may not be disclosed without written authorization except as permitted under CMIA (which is largely consistent with HIPAA but may be stricter in some areas)
  • You have the right to inspect and copy your pharmacy records within 5 business days of request
  • CCPA/CPRA rights may be submitted via our Privacy Officer (see Section 9) or by calling our toll-free number. We will verify your identity before processing requests and respond within 45 days (one 45-day extension permitted).

9. Contact for Privacy Inquiries

For all privacy-related questions, requests to exercise your rights, or to report a concern, please contact our designated Privacy Officer:

Organization

Clinic RX Online Pharmacy

Attention

HIPAA Privacy Officer

Website

www.clinicrxmed.com

Email

info@clinicrxmed.com

Mailing Address

239 Coal Kiln Road, Medina, TX 78055

Phone

(512) 791-1564

Response Time

Within 30 days of receipt of a written request (45 days for California residents under CCPA/CPRA)

10. Cookies & Website Tracking

Our website at www.clinicrxmed.com uses cookies and similar tracking technologies to support website functionality, security, and analytics. We do not use tracking technologies to target you with advertising based on your prescription or health information.

Cookie Type

Strictly Necessary

Purpose

Required for website functionality (login sessions, security tokens, cart)

Opt-Out Available?

No — required for service

Cookie Type

Analytics / Performance

Purpose

Aggregate, anonymized usage statistics to improve site performance

Opt-Out Available?

Yes — see Cookie Settings

Cookie Type

Functional

Purpose

Remember your language or display preferences

Opt-Out Available?

Yes — see Cookie Settings

Cookie Type

Marketing / Advertising

Purpose

Not used for PHI-related targeting; limited to general website promotion

Opt-Out Available?

Yes — see Cookie Settings

California residents may also exercise opt-out rights under CCPA/CPRA with respect to any personal information processed via cookies. A "Do Not Sell or Share My Personal Information" link is available in the footer of www.clinicrxmed.com.

11. Changes to This Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time to reflect changes in our practices, legal requirements, or services. When we make material changes, we will:

  • Post the updated policy at www.clinicrxmed.com/privacy with the revised effective date
  • Send email notification to registered patients for material changes affecting their rights
  • Display a prominent notice on our website homepage for at least 30 days following a material update

Your continued use of our services after the updated policy is posted constitutes your acknowledgment of the changes. We encourage you to review this Policy periodically.

12. Governing Law

This Privacy Policy is governed by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Health Information Technology for Economic and Clinical Health (HITECH) Act, and applicable state laws including but not limited to the Texas Medical Records Privacy Act, the Florida Information Protection Act (FIPA), and the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

In the event of any conflict between this Policy and applicable law, the applicable law will control.

Acknowledgment

By using the services of Clinic RX Online Pharmacy, creating an account, or submitting a prescription at www.clinicrxmed.com, you acknowledge that you have read, understood, and agree to the terms of this Privacy Policy and Notice of Privacy Practices. A copy of this document is available in English and, upon request, in additional languages or accessible formats.

Clinic RX — www.clinicrxmed.com — info@clinicrxmed.com

This document should be reviewed by a licensed healthcare attorney before publication.