PinBallCo LLC (d/b/a “PharmacyAI”) (“we,” “our,” or “us”) provides software, including our desktop assistant, Raichel, that automates manual processes for pharmacies, and related technical services, support, or other ancillary service or content (the “Services”) to pharmacies. This Privacy Policy describes how we collect, use, disclose and protect personal information of individuals who use the Services as or on behalf of the pharmacies (“User” or “you(r)”), including downloadable elements of our Services. It also explains our handling of data related to other customer personnel whose information might be processed as part of our Services.
For residents of California, please see the Notice at Collection provided below.
If you do not agree with our policies and practices, please do not use our Services. If you have any questions or concerns, please contact support@pharmacyai.com.
Scope and Roles
Our Services are intended for pharmacies to automate and streamline their internal operations, analytics and reporting with respect to managing and filling prescriptions, filing insurance claims, and other tasks. The Services are intended solely as a pharmacy workflow automation tool for administrative and data-entry functions and do not perform any clinical decision support, drug utilization review, allergy or interaction checking, or therapeutic judgment functions. A licensed pharmacist must independently verify all outputs of the Services and all prescriptions processed with the assistance of the Services before dispensing.
This Privacy Policy applies to:
Personal information we collect and use as a “business” or “controller,” for example about website visitors and business contacts.
Personal information we process as a “service provider” or “processor” to our customers, for example information contained in diagnostic or debugging data, or customer support requests or inquiries. In those cases, our customers’ privacy policies govern, and we process information according to our contracts and customers’ instructions.
If we are acting as a service provider/processor, we will process such information pursuant to a data processing addendum or Business Associate Agreement that we enter into with our customer. We will not sell or share that personal information, nor use it for purposes unrelated to the contracted services, except as permitted by law and our agreements.
Personal Information We Collect
The categories of personal information we collect as business/controller may include the following:
Information You Provide Directly
Identifiers and contact information: Name, business email address, business phone number, employer, job title, and business mailing address. We collect this directly from you, your employer or colleagues, from our service providers, from publicly available sources, from social media, and from our website or event interactions. We use it to provide and support the Services; manage customer and vendor relationships; respond to inquiries; send service communications; authenticate users; and comply with legal obligations. Retention generally aligns to the duration of your business relationship with us plus a reasonable period to comply with legal, tax, and audit requirements.
Commercial and transactional information: Account history, communication preferences, and records of interactions with us. We use it to operate, maintain, secure, and improve the Services; provide support; and for billing, audit, and compliance. Retention corresponds to contractual and legal requirements.
Payment information: Information necessary to complete billing transactions, including your full name, credit card information, and a billing address, which may be your personal address or the address of the company you are associated with. We use third parties to process our payments and to collect payment data. We use it to operate, maintain, secure, and improve the Services; provide support; and for billing, audit, and compliance. Retention corresponds to contractual and legal requirements.
Professional or employment-related information: Work address, employer information, role, and business contact details. We use this for recruiting, hiring, HR administration, compliance, and workforce safety. Retention follows applicable employment and recordkeeping laws.
Audio, electronic or similar information: Recordings or transcriptions of calls placed or received by our Services when enabled by a customer and permitted by law. We use this for quality assurance, training purposes and to provide you with customer support. We provide required recording notices and obtain or rely on customer consents as applicable. Retention is limited to the purpose and duration necessary for operations, quality, dispute resolution, or compliance.
Sensitive Information: Healthcare information about your consumers received by our Services when included in diagnostic or debugging data, or related to customer support requests or inquiries. All Protected Health Information is stored offline on the server of the computer on which the Services are installed, and except in limited instances for technical or customer support, such data is not shared with us, transmitted to us or processed by us in any way. To the extent technically feasible, the Services also remove Protected Health Information before diagnostic data is shared with us. If Protected Health Information is shared with us, we will use the information solely as necessary for us to perform our Services and in compliance with all applicable laws including HIPAA and applicable state privacy laws. Retention is limited to the purpose and duration necessary for operations, quality, or compliance. We do not intend to collect sensitive personal information except where necessary for lawful and disclosed purposes (for example, to provide technical assistance or customer support). We will not use sensitive personal information for additional purposes without notice and, where required, consent. We will offer the ability to limit certain uses as required by law.
Feedback or Support Information: Personal information included in your communications with us, e.g., surveys, customer support communications, or inquiries. This may include your name, contact information, voice recording, and any other content or communication that you send to or share with us. We use this to provide you with customer support, and to solicit feedback to improve our products and services. Retention is limited to the purpose and duration necessary for operations, quality, dispute resolution, or compliance.
Social Media: If you interact with us on our social media accounts or pages, we will collect certain profile information from your social media account provider, such as your username, profile picture, as well as content in your social media posts or comments. Please note that we do not control, and are not responsible for, other uses of your personal information by your third-party social media provider. We recommend that you review their privacy notice to understand how they collect, use, and share your personal information, and how you can set your privacy preferences on their sites and apps. We store and use this information to provide and maintain our Services. Retention corresponds to the duration of your business relationship with us.
Inferences: We may derive personal information about you in the form of inferences, which are derivations of information, data, assumptions, or conclusions from facts, evidence or other sources of information or data about you. We use this to improve and provide the Services to you. Retention is limited to the purpose and duration necessary for operations, quality, dispute resolution, or compliance.
By voluntarily providing us with personal information, you represent that the personal information you provide is true, accurate, current, and complete, and that you are authorized to provide it to us.
Information We Collect Automatically
When you use our Services, some information is collected automatically and is not provided directly by you:
Internet or Other Network Activity: IP addresses, device information, browser type, operating system, website usage patterns, and interaction data, including the content, features, and activities that you access, and the time, frequency, and duration of those activities, collected through cookies and similar technologies when you use our Site. We use it for security, to analyze performance, to improve the Site and/or Services, to remember preferences, and for fraud prevention. Retention varies by signal type and is typically short for security logs unless needed to investigate or comply with law.
Third-Party Product Integrations: At your direction or your instruction, our Services may be integrated with third-party products and services. The Services may collect information about you through these integrations, including usage data, account settings and preferences, data that you’ve submitted to those third-party products and services for processing, and other associated information. Except for limited instances when we provide technical assistance or customer support services to you, this data lives on your local server and is not shared with us. Any data you share with third-party products and services or their providers are subject to privacy policies between you and their providers and is outside the scope of this Privacy Policy.
We may collect and use aggregated and deidentified usage data and analytics to understand engagement patterns, improve the Services, and for other internal business purposes. Aggregated and deidentified data is not Personal Information and is not subject to this Privacy Policy.
Information You Send to Us About Others
The privacy of your information and of your customer data are of vital importance to us. Except for limited instances where we provide you with technical assistance or customer support services at your direction or request, your customer data lives locally on your server and is not transmitted to us or processed by us in any way. In these instances, you may provide us with data, including personal information, you collect from your customers. You are responsible for collecting any and all consents and authorizations required by applicable law before you share such end-user’s personal information with us through the Services.
Cookies and Other Technologies
We may use cookies and similar technologies for functionality, security, analytics. We do not currently use such technologies for targeted advertising or cross-context behavioral advertising. On most web browsers, you will find a “help” section on the toolbar. Please refer to this section for information on how to receive notifications when you are receiving a new cookie and on how to turn cookies off. We recommend that you leave cookies turned on because they allow you to take advantage of some of the Site’s features, and, if you block or delete cookies, the Site may not work properly.
How We Use Personal Information
We use personal information for the following business purposes:
Providing Services: To deliver, improve, and support our Services, and for billing, audit and compliance.
Account Management: To create and manage user accounts, process transactions, and provide customer support.
Communication: To communicate with you about your account, services, updates, and respond to inquiries, or to solicit feedback.
Compliance with Legal Obligations: To comply with applicable state and federal laws, including healthcare or privacy laws and regulations, or to respond to legal, government, or regulatory requests.
Analytics and Improvement: To analyze usage patterns, improve our Services, develop new features, and enhance user experiences.
Security and Fraud Prevention: To protect our Services, detect and prevent fraud, and maintain the security of our systems and data.
Marketing: To provide information about our Services to business prospects and existing customers, including industry insights and product updates.
Machine Learning. To train AI and machine learning models for improved risk assessment, safety predictions, and service enhancements. We do not use your customer data or Protected Health Information for AI training purposes, but may use aggregated and anonymized data, for example, on usage or diagnostics, for training. The Services do not perform any clinical decision support functions and are intended solely for administrative pharmacy workflow automation.
Research and Development: For internal product development purposes to conduct testing and research, to develop new products and services, and to improve existing ones.
Analytics. To conduct analytics, including to better understand you and our other users, user needs, and usage trends.
Exercise Our Rights: To prevent or take action against activities that are, or may be, in violation of our Terms, MSA, or applicable law, or to investigate disputes and claims related to our Services.
When you communicate with us using one of the methods described in this Privacy Policy, we may also keep a record of the time and date of any correspondence and organize this correspondence in one or more electronic filing systems, an email system, or a customer relationship management system.
Automated Decision-Making and AI
The Services do not provide, and nothing related to the Services should be construed as, clinical decision support, drug utilization review, allergy or interaction checking, therapeutic judgment, or medical, pharmaceutical, or healthcare advice of any kind. The Services do not replace or substitute for the professional judgment of a licensed pharmacist or other licensed healthcare professional.
While the Services include automation to assist with data entry, processing, managing and filling prescriptions, and managing the insurance claims process, among others, the Services are also built intentionally to ensure that there is always a human in the loop in every single process, and there may be multiple human touchpoints. The Services are intended solely as a pharmacy workflow automation tool for administrative functions and do not provide clinical decision support, drug utilization review, allergy or interaction checking, therapeutic judgment, or medical advice. A licensed pharmacist must independently verify all outputs of the Services and all prescriptions processed with the assistance of the Services before dispensing. The Services also automate administrative processes, but are not designed to exercise professional judgment. The offline nature of the Services further enables you as our customer to customize the Services, including individual workflows, based on your comfort levels. Therefore, the Services, as designed, do not engage in automated decision-making. If this changes in the future, we will provide required disclosures and offer mechanisms to exercise applicable rights under laws and regulations.
In addition, we do not use personal information to train large language models, although we may use aggregated and anonymized data (provided that it cannot be re-identified or otherwise be attributed to you, any particular Customer, or any particular individual).
How We Share Personal Information
We share personal information in the following circumstances:
Customers: We share personal information with our customers when we are processing information on their behalf. These entities enter into agreements directly with consumers or business entities, and their processing of personal information is governed by their own privacy policies.
Service Providers: We share personal information with third-party service providers who perform functions on our behalf, including cloud hosting, data analytics, payment processing, customer support, and technology services. These providers are contractually required to protect your information and use it only for the specific services they provide to us.
Integration Partners: We may share personal information as requested or directed by you to enable a requested functionality.
Government Authorities: We may disclose personal information to regulatory bodies, law enforcement, or other government entities when required by law, to comply with legal process, or to protect our rights and the safety of others.
Corporate Transactions: Information about our users, including personal information, may be disclosed and otherwise transferred to an acquirer, successor, or assignee as part of any merger, acquisition, debt financing, sale of company assets, or similar transaction, as well as in the event of an insolvency, bankruptcy, or receivership in which personal information is transferred to one or more third parties as one of our business assets.
Legal and Compliance: We also disclose personal information if we believe that doing so is legally required, or is in our interest to protect our property or other legal rights (including, but not limited to, enforcement of our agreements) or the rights or property of others, or otherwise to help protect the safety or security of our Services and other users of the Services.
We may share personal information for other purposes with your explicit consent or at your direction. We do not sell personal information to third parties. We do not share personal information for cross-context behavioral advertising or targeted advertising purposes.
We may create and use de-identified or aggregated information for analytics, service improvement, and other lawful purposes. We take reasonable measures to ensure that de-identified information cannot be associated with a particular individual and we maintain information as de-identified and do not attempt to re-identify it, except as permitted by law to test our processes.
Text Messaging
If you opt in to receive text messages from PharmacyAI, we use your mobile number and consent record only to send the messages you agreed to receive. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties. You can opt out at any time by replying STOP, or reply HELP for help.
How long do we keep your personal information for?
We retain each category of personal information for no longer than is reasonably necessary and proportionate to achieve the purposes for which the information was collected or processed, or for other disclosed, compatible purposes. We determine retention periods based on factors such as the minimum data needed to provide and improve our Services, for security and fraud-prevention needs, to meet legal obligations, and recordkeeping requirements.
The downloadable software has a default data retention policy of 90 calendar days; after this 90-day period, all completed workflows and other cleaned data entries would be removed, leaving only unfinished or delayed workflows. However, this data lives locally on your computer server and is not shared with us. You can back up this data at any time. This data is also permanently deleted upon the termination of the Services pursuant to the MSA or the Terms.
Your Privacy Rights
Depending on your state of residence, you may have the following data rights:
Right to Know/Access: Request information about our collection, use, and disclosure of your personal information and obtain a copy in a portable format.
Correct: Request that we correct inaccuracies in your personal information.
Delete: Request that we delete personal information, subject to legal exceptions.
Opt Out: Opt out of the sale of your personal information and the sharing or processing of personal information for cross-context behavioral advertising or targeted advertising, as applicable.
Appeal: In states that provide an appeal right, appeal our decision if we decline to act on your request.
Non-Discrimination: We will not unlawfully discriminate against you for exercising your rights.
You may submit a request by using our privacy request webform, available on our website, or by emailing support@pharmacyai.com. We will verify your identity consistent with applicable law before fulfilling a request. You may designate an authorized agent to make a request on your behalf, subject to verification and authorization requirements. If we deny your request, you may appeal by contacting support@pharmacyai.com; we will provide a written explanation of our decision and how you may contact your state attorney general if you remain unsatisfied.
For requests relating to personal information we process solely as a service provider/processor for a customer, please direct your request to that Customer. We will support Customer in responding to your request as required by our agreement and applicable law.
Other Important Information
Children
We do not collect personal information of children under 16. Our Services are not directed to users under the age of 16. If we learn that we have collected personal information from a child under the age of 16 on our Services, we will delete that information as quickly as possible. If you believe that we may have collected any such personal information on our Services, please notify us at support@pharmacyai.com.
Jurisdiction; Data Transfers
The Services are hosted and intended solely for customers and users in the United States. The Software shall only be downloaded onto and operated from a Customer-owned computer server and used only by workstations that are physically located in the United States. All Personal Information is stored on servers in the United States and is subject to United States law. All of our data processing activities occur within the United States using U.S.-based infrastructure and services.
If you are visiting the Services from the European Union or other regions with laws governing data collection and use, please note that you are agreeing to the transfer of your information to the United States and the global processing of such information. By providing your Personal Information, you consent to any transfer and processing in accordance with this Privacy Policy.
Third-Party Products
This Privacy Policy applies only to the Services. The Services may be integrated with other websites, products and services provided or operated by entities not affiliated with or related to PharmacyAI (“Third-Party Products”). The policies and procedures we described here do not apply to Third-Party Products. The integrations do not imply that PharmacyAI endorses or has reviewed the Third-Party Products. We suggest contacting those providers directly for information on their privacy policies.
Data Security
We employ administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction, consistent with the requirements of the HIPAA Security Rule (45 C.F.R. Part 164, Subpart C) where applicable. These measures include access controls, encryption in transit and at rest where appropriate, network and application security, logging and monitoring, personnel training, and vendor due diligence. No security program is perfect; we regularly evaluate and enhance our controls.
Changes to this Privacy Policy
We may update this Privacy Policy periodically to reflect changes in our practices, Services, or legal requirements. We will post updates with a new effective date and take additional steps where required by law.
CALIFORNIA PRIVACY NOTICE
This section describes how we collect, use, and share the Personal Information of California residents in our capacity as a “business” under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA”) and the rights these users may have with respect to their Personal Information.
For purposes of this section, the term ‘Personal Information’ has the meaning given in the CCPA and does not include information exempted from the scope of the CCPA. This section does not apply to our collection, use, and sharing of personal information of our internal staff.
Categories of personal information we collect and disclose: We are a new company and may not have collected all of the categories of personal information as provided in this Privacy Policy. See “What information do we collect” for more information.
Sensitive Personal Information: We do not collect or process sensitive personal information for purposes of inferring characteristics about consumers, and we do not use or disclose sensitive personal information for purposes other than those permitted by the CCPA regulations. Accordingly, the consumers’ “Right to Limit” under the CCPA does not apply to our current practices. If that changes, we will provide a Notice of Right to Limit and honor requests as required by law.
Sales and Sharing: Under the CCPA, ‘sales’ and ‘sharing’ are broadly defined, respectively, and include disclosing or making available personal information in exchange for monetary or other valuable consideration or for purposes of cross-context behavioral advertising. We do not sell your personal information or share your personal information as those terms are defined by the CCPA. We also do not have actual knowledge that we sell or share personal information of consumers under 16 years old. If we ever engage in selling or sharing, we will provide the required California notices or process opt-out preference signals in a manner as required by law.
Recordkeeping: We maintain records of consumer requests and our responses as required by law and will implement any additional requirements that become effective under forthcoming California regulations.
Automated Decisionmaking Technology (ADMT): We do not currently use ADMT to make significant decisions about consumers. If we begin doing so, we will provide a pre-use notice as required by law.
California Shine the Light
A California resident who has provided personal information to a business with whom he/she has established a business relationship for personal, family, or household purposes (“California Customer”) is entitled to request information about whether the business has disclosed personal information to any third parties for the third parties’ direct marketing purposes, subject to certain exceptions, as defined in California Civil Code Sec. 1798.83. We do not share Personal Information with third parties for the third parties’ direct marketing purposes.
OTHER STATE PRIVACY RIGHTS
Residents of states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Tennessee, Indiana, Iowa, Delaware, and others as they become effective) may have rights similar to those described above. Where these laws impose additional or different requirements, e.g., consent for certain sensitive data, data protection assessments for targeted advertising or profiling, or disclosures about automated decision-making, we will comply and provide state-specific supplements as necessary.
To the extent we process de-identified personal information, we will maintain and use it in a de-identified form and will not attempt to re-identify it unless permitted by applicable law.
Contact Us
For privacy-related questions, requests, or complaints, please contact:
Email: support@pharmacyai.com
Address: 547 Carcaba, Saint Augustine, FL 32084
For privacy rights requests, please use the subject line “Privacy Rights Request” in your email.
Response Time: We will acknowledge receipt of your inquiry within 10 business days and provide a substantive response within 45 days (or as otherwise required by applicable law).