Privacy Policy

Scope and how this policy relates to HIPAA

Statmeds is a pharmacy and a “covered entity” under the Health Insurance Portability and Accountability Act of 1996 and its regulations (“HIPAA”). Protected health information (“PHI”) you give us, including information submitted through our refill, transfer and new patient forms, is governed by our Notice of Privacy Practices, applicable federal law and New York law, including the confidentiality obligations that apply to New York-licensed pharmacies. If this policy and our Notice of Privacy Practices conflict regarding PHI, the Notice of Privacy Practices controls.

This policy also covers technical information about website visits and information such as general questions sent through our contact form. If a message includes health information about you, we protect it as PHI.

Information we collect

Information you provide

Contact details: name, phone number, email address and mailing or delivery address.
Prescription and health information: date of birth, medication names, prescription numbers, allergies, prescriber and pharmacy details, insurance information and notes you choose to include.
Text messaging consent records: whether you opted in, the date and time, the consent language shown, and the phone number provided.
Messages: anything you write to us through the contact form, by phone or by text.

Information collected automatically

Our hosting provider records standard server logs, such as IP address, browser type, pages requested and the date and time of a request, to deliver and secure the website. We don’t use advertising cookies, tracking pixels, session-replay tools or third-party analytics on this website, and we don’t use tracking technologies to send your health information to technology vendors.

We don’t use advertising or analytics tracking on pages where you submit health information. If Google reCAPTCHA is turned on, our forms use it only to block spam and automated abuse, as described below.

Third-party services on our pages

Google Maps shows our location on the home page, the contact page and our delivery area pages. The map loads when you scroll to it, and Google may then set cookies and collect information, such as your IP address, under Google’s privacy policy. Nothing you type into our forms is shared with the map.
Google reCAPTCHA may protect our forms from spam and automated abuse. It loads when you start filling in a form and collects information about your device and how you use the page, such as your IP address and browser details, under Google’s privacy policy and terms. What you type into the form is not sent to Google.
Health news headlines are collected by our server from public news feeds. Your browser doesn’t contact those sources until you click a headline.

How we use information

To fill, refill, transfer and deliver prescriptions, and to provide pharmacist counseling.
To bill your health plan, check benefits, quote cash prices and coordinate prior authorizations with your prescriber and plan.
To contact you about your requests by your preferred method, and to send text messages if you opted in.
To operate, secure and improve the website and to prevent fraud, spam and misuse.
To meet legal, regulatory and professional obligations, including record-keeping and reporting required by federal and New York law.

We use PHI only as permitted by HIPAA and described in our Notice of Privacy Practices. We don’t use PHI for marketing without your written authorization.

We don’t sell your personal information or PHI. We share information only as needed for the purposes above, for example with:

your prescribers and their staff, and pharmacies you ask us to transfer from or to;
health plans, pharmacy benefit managers and payment processors, to obtain payment and coverage decisions;
service providers that support our operations, such as hosting, secure email, phone, text messaging and delivery providers, under written agreements, including HIPAA business associate agreements where required;
government agencies and others when required or permitted by law, such as the New York Prescription Monitoring Program, the Board of Pharmacy, or public health authorities; and
a successor entity in a merger, sale or transfer of the pharmacy, subject to the same protections.

Text messaging (SMS) privacy

If you opt in to text messages from Statmeds Pharmacy, we use your mobile number only to send the messages you agreed to receive (refill reminders, order and delivery status updates, and replies to your requests) and to keep records of your consent and opt-out.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information may be shared with subcontractors that help us provide the messaging service, such as our text messaging platform and phone carriers, solely to deliver messages. Mobile opt-in data and consent are never shared with third parties: all of the categories of sharing described in this policy exclude text messaging originator opt-in data and consent.

You can opt out at any time. Reply STOP (or QUIT, END, CANCEL, UNSUBSCRIBE, REVOKE or OPT OUT) to any message, or tell us any other reasonable way, and we’ll honor it within 10 business days. Reply HELP for help, or call (516) 900-0636. See our SMS Terms for full program details. Text messages aren’t encrypted, so we keep health details in texts to a minimum.

How we protect information

We use administrative, technical and physical safeguards designed to protect information, consistent with the HIPAA Security Rule and New York’s SHIELD Act (General Business Law § 899-bb). Our website uses HTTPS encryption for all pages and form submissions. Access to PHI is limited to staff and service providers who need it.

No system is perfectly secure. If a breach of unsecured PHI or private information occurs, we will notify affected individuals and regulators as required by the HIPAA Breach Notification Rule and New York General Business Law § 899-aa.

How long we keep information

We keep prescription and pharmacy records for at least as long as federal and New York law require, and HIPAA-related documentation for at least six years. Contact-form messages that aren’t part of a patient record are kept only as long as needed to respond and for reasonable business records. Text messaging consent and opt-out records are kept for at least as long as needed to show compliance with the Telephone Consumer Protection Act.

Your choices and rights

Health information: under HIPAA you can access, get a copy of and request amendments to your PHI, request an accounting of disclosures, ask for restrictions and confidential communications, and get a paper copy of our Notice. See the Notice of Privacy Practices for how to make these requests.
Other information: you can ask us to access, correct or delete contact information that isn’t part of your pharmacy record. We’ll respond within a reasonable time, subject to our legal record-keeping obligations.
Text messages: reply STOP to any message, or tell us any other reasonable way, at any time.
Browser signals: because we don’t sell or share personal information for targeted advertising, there is nothing to opt out of. We treat Global Privacy Control and Do Not Track signals as a request not to sell or share, which we already honor.

Children

This website isn’t directed to children under 13, and we don’t knowingly collect information online from them. A parent or legal guardian may submit prescription requests for a minor. Text messaging is available only to people 18 or older, or to a parent or guardian on a minor’s behalf.

Links to other websites

Our health news page and other pages link to websites we don’t control, such as government agencies and news publishers. Their privacy practices are governed by their own policies.

Changes to this policy

We may update this policy from time to time. We’ll post the new version here with a new “last updated” date. If we make a material change to how we use text messaging data, we’ll ask for your consent again where the law requires.

Contact us or file a complaint

Duffy Rx LLC dba Statmeds
Attn: Privacy Officer
399 W John St, Ste 100
Hicksville, NY 11801
Phone: (516) 900-0636
Fax: (877) 961-1116
Email: info@stat-meds.com

If you believe your health privacy rights have been violated, you can file a complaint with our Privacy Officer or with the U.S. Department of Health and Human Services, Office for Civil Rights, at hhs.gov/ocr/complaints or 1-800-368-1019. You can also contact the New York State Attorney General’s Bureau of Internet and Technology. We won’t retaliate against you for filing a complaint.