Privacy Policy

What RxSent holds about clinics, prescribers, staff and the patients whose orders pass through it, who receives it and why, and what we never do with it. Effective November 11, 2026. Applies to rxsent.com and the RxSent clinic portal at app.rxsent.com.

The short version

• We process patient information on behalf of clinics, to carry their orders to licensed pharmacies. The clinic decides; we act on its instructions.
• We do not sell or rent personal information, and we never use patient information for marketing or advertising.
• Order emails and texts to a clinic carry no patient information. Messages to a patient carry no medication detail.
• Each service provider receives only what it needs to do its job for us.
• rxsent.com uses no advertising trackers.

Who we are

RxSent is prescription ordering and pharmacy operations software for clinics and the groups that run them. In this policy, “RxSent”, “we”, “us” and “our” mean ImpactHealthUSA, Inc., doing business as RxSent, with its mailing address at 27466 N 86th Lane, Peoria, AZ 85383.

This policy covers the public website at rxsent.com, the RxSent clinic portal at app.rxsent.com that clinic staff and prescribers sign in to, and the information RxSent processes to carry a clinic’s patient prescriptions and office-use purchase orders to a licensed pharmacy and to bill the clinic for them.

Our role and the clinic’s

RxSent does not treat patients, does not practice medicine and does not dispense. A prescription on RxSent is written and signed by the clinic’s own prescriber, under that prescriber’s NPI and state licensure, and the clinic owns its relationship with the patient.

When we process a patient’s information, we do so on the clinic’s behalf and on its instructions. The clinic’s own notice of privacy practices is the notice that governs a patient’s health information, and the clinic decides how that information is used and shared. We use it only to provide RxSent to the clinic, as this policy describes, and as the law requires. Where HIPAA requires them, RxSent and the service providers that handle patient information do so under business associate agreements.

If you are a patient, the clinic that treated you is the right first contact for any question or request about your health information. We will help the clinic answer it.

Information we hold

Clinic staff who sign in

• Your email address, your clinic, your role in it, and whether your account is active. Your password is held by our service provider that operates sign-in, not in RxSent’s own tables.
• For an invitation, a one-way hash of the link we sent you, and a mobile number if your administrator asked for the invitation to be sent by text as well.

Prescribers and ordering providers

• Name, degree and title, NPI, email, phone, practice address, and a supervising physician where one applies.
• State licenses: state, number, type and expiry, and a copy if the clinic uploads one.
• DEA registrations, if a clinic records them. They are held as a record of the prescriber only: RxSent does not send them to a pharmacy or use them to allow any prescription.

Clinics

• The clinic’s legal name, address, business contacts and, where given, its NPI; the shipping addresses it orders to; and the prices, programs and payment terms of its account.
• For a card or bank payment, the details described in Payments.

Patients

• What the prescription and the pharmacy need: name, date of birth, sex and gender identity, residential and shipping address, phone and email.
• Clinical details the prescriber enters for the pharmacy: allergies, current medications, medical conditions, pregnancy status, weight and height, and statements of medical necessity.
• An image of the patient’s identification where the clinic uploads one, and an identifier from the clinic’s own record system where the clinic provides one.
• Whether the patient has agreed to receive text messages, when, and how that agreement was recorded.

Office-use and physician-use purchase orders are orders for the clinic’s own stock. They carry no patient information.

Prescriptions and orders

• The prescription itself, frozen at signature as an unchangeable record of exactly what the prescriber signed, with the time of signature and the network address it was signed from.
• Where each order went, the pharmacy’s responses, shipment status, and the price lines of the order.

The website request form

• What you type into the request form on rxsent.com: your clinic’s name, your name, your work email, your phone number, your state, and your message.
• We use this information only to reply to you and, if you proceed, to onboard your clinic. The form is protected by a bot check run by one of our service providers, which may set a cookie to work.
• The form is for business enquiries. Please do not put patient information in it.

Records of what happened

• An audit record of significant actions, including each time a member of the RxSent team, or of a service provider that supports the platform, opens a patient’s record.
• A log of each notification sent, recording the template, channel and time and a one-way hash of the recipient, never the message itself.

How we use it

• To let a clinic write, sign and send prescriptions and place purchase orders, and to check each order against the eligibility gates before it is signed and again before it is sent.
• To transmit each order to the licensed pharmacy that will fill it, and to tell the clinic, and where the clinic has recorded consent the patient, how the order is progressing.
• To charge the clinic for its orders and keep an accurate record of every charge, refund and payment.
• To verify a prescriber’s NPI with the national registry, and to confirm that the prescriber holds a license on record for the state an order ships to.
• To run, secure, support and fix the service, to keep the records the law requires, and to answer people who contact us.

We do not sell or rent personal information to anyone. We do not use patient information for marketing or advertising, and we do not use it to build profiles of patients.

Who receives it

We share information with the following kinds of recipients, each for the purpose given, and with no one else except as described at the end of this section. We give each service provider only the information it needs to do its job for us, and we require it to protect that information.

• The licensed pharmacy that fills the order, directly or through the pharmacy’s own ordering system: the prescription; the patient details it needs to fill and ship it (name, date of birth, sex, address, phone, email and the clinical details above); and the prescriber’s name, NPI, license, phone, email and address. A pharmacy without a system connection receives the order by secure email. For an office-use purchase order, the pharmacy receives the clinic’s order, its shipping address and, where the program requires one, the ordering provider’s name, NPI and license.
• Our payment service provider and our bank: what is needed to take and record a payment, as described in Payments.
• Our service providers: the companies that host and operate the platform, hold our database, sign-ins and stored files, send our email, send and receive our text messages, deliver the website and run the bot check on our form, and protect the site. Each receives only what it needs for its part.
• Our error-reporting service: receives reports of faults so we can fix them. Reports are configured to exclude personal information and are scrubbed before they leave our servers.
• The national NPI registry, when a prescriber’s or clinic’s NPI is looked up.
• Our professional advisers, such as lawyers, accountants and auditors, under a duty of confidentiality, where they need it to advise us.

We describe our service providers by category rather than by name. A clinic that needs the current list of service providers that handle its patients’ information may ask for it at [email protected].

We may also disclose information where the law requires it, such as in response to a valid subpoena, court order or request from a regulator; where it is needed to protect the safety of a patient or another person, or to protect our rights or the security of the service; and, under the same protections this policy gives, to a buyer or successor if all or part of our business is sold, merged or reorganized. Patient information is disclosed only where federal health privacy law and the clinic’s agreement with us allow.

Payments

Card numbers are typed into fields served by our payment service provider, not by RxSent, and turned into a token in your browser. RxSent’s servers never receive or store the full card number or security code. We keep the token, the card’s brand, last four digits and expiry, the name and billing address entered with it, and what the payment service provider reports about each charge.

When a clinic pays by bank transfer, the payment is made against an invoice from our bank. We keep the invoice, its amount and status, and the business details of the clinic it was issued to. We do not receive or store the clinic’s bank login.

Email and text messages

• To clinics. Order emails and texts sent to a clinic, such as receipts, payment notices, order status and shipping updates, carry no patient information. They carry the order number, its status, the items of an office-use or physician-use order, amounts and tracking, and a link into the clinic portal, where a signed-in user sees the rest.
• To patients. When a clinic’s order ships, the patient may receive an email, or a text if the clinic has recorded the patient’s consent, saying that their order from the clinic has shipped, with tracking and a link to its shipment status. These messages carry no medication name, dose, strength or product code, and the status link shows logistics only and expires.
• Texts. Consent to receive texts is checked before every text is sent. During our beta, portal notifications by text may come from a shared number operated by a service provider; these messages carry no patient information. Replying STOP withdraws consent in our own records as well as the carrier’s and stops the messages. Mobile numbers and text-message consent are not shared with third parties or affiliates for their marketing or promotional purposes.

Cookies and browser storage

• RxSent’s servers set no cookies.
• When you sign in to the clinic portal, your browser keeps your sign-in session in its local storage so you stay signed in, along with a few display preferences, such as whether the side menu is collapsed, a chosen shipping state for the catalog, and your place in the prescription list.
• The bot check on the website request form may set a cookie, as described in Information we hold.
• rxsent.com loads no advertising trackers, and we do not sell or share browsing information for advertising.

Where it is stored

RxSent’s database, the servers that run it, and our error reports are held in the United States. Database backups are taken daily. RxSent is offered only in the United States.

How we protect it

• One clinic cannot read another’s patients, prescribers or orders. The database enforces that boundary, not the screen.
• Each person has their own sign-in, and each role sees only what it needs.
• Information travels to and from RxSent encrypted, and the order data we send to a pharmacy is also kept encrypted by the application.
• The prescription is frozen at signature, and the frozen copy is what the pharmacy receives.
• The signed prescription, the ledger of charges and the audit record cannot be altered or deleted by the application; the database refuses it.
• Each time a member of the RxSent team, or of a service provider that supports the platform, opens a patient’s record, it is recorded.

No system is perfectly secure, but these controls are built into how RxSent works.

Security incidents

If we learn of a security incident that affects information we hold for a clinic, we will notify that clinic without unreasonable delay, and in any case within the time the law and our agreement with the clinic require. We will tell the clinic what we know about what happened and what information was involved, and help it meet its own obligations, including any notice owed to its patients. Where the law requires us to notify individuals or a regulator directly, we will.

How long we keep it

• Permanent records. Signed prescriptions, order and payment records, the ledger of charges and the audit record are kept permanently. Pharmacy, tax and audit rules require these records, and RxSent is built so they can be added to but never rewritten.
• Accounts. When a clinic or a person leaves, their account is deactivated rather than erased, so the record of what was done, and by whom, stays accurate. A staff member’s account is deactivated on request by the clinic’s administrator, or by us.
• Website enquiries. On request, we delete the content of an enquiry you sent us through the website, unless a legal obligation requires us to keep it.
• Notification logs record that a message was sent and never the message itself.

Your rights and requests

Depending on where you live, you may have the right to ask us what personal information we hold about you, to receive a copy of it, to have it corrected, or to have it deleted.

• Patients. Your clinic controls your health information on RxSent, and your rights over it are exercised through the clinic. If you send a request about patient information to us, we will refer it to your clinic and help the clinic answer it.
• Clinic staff and prescribers. Your clinic’s administrator can correct your details or deactivate your account. You can also write to us.
• Everyone else, including people who contacted us through the website: write to us.
• Texts. Reply STOP to any text from RxSent to stop them.

To make a request, email [email protected] or write to us at the address in Contact us. We will ask you for information that lets us confirm who you are, such as the email address we hold for you, before we act; an authorized agent must also show that you have authorized them. We will respond within 45 days, and tell you if we need longer, as the law allows. Where we cannot delete something because the law requires us to keep it, as with the permanent records above, we will tell you so. We will not treat you differently for making a request.

Children

The RxSent website and clinic portal are for clinic staff and other businesses, and are not directed to children. We do not knowingly collect information from children through them. A clinic may prescribe for a patient who is a minor; that patient’s record belongs to the clinic, is handled on the clinic’s instructions like every other patient record, and requests about it go to the clinic.

Changes to this policy

If we change this policy, we will post the new version on this page with its effective date. If a change is material, we will also email each clinic’s account administrators at least 30 days before it takes effect.

Contact us

Questions or requests about privacy, and anything else: [email protected].

ImpactHealthUSA, Inc., doing business as RxSent
Attn: Privacy
27466 N 86th Lane, Peoria, AZ 85383