Privacy Policy

This policy explains what information My-Rx Check (the "Service"), operated by SoftLOGiX, Inc., collects, how it is used, and the choices you have. It is written to reflect how the Service actually works.

Effective date: Oct 15,2026

Information we collect

We collect only what is needed to run the checker:

Account information — your email address and (if you register) your first name. Sign-in is passwordless: we email you a one-time verification code rather than storing a password.
Your lists — the medications, supplements, health conditions and lab values you choose to enter, and the name you give each list. This is health information, and we treat it as the most sensitive data we hold. You decide what to enter; nothing is collected from a pharmacy, insurer, or health record.
Subscription information — your subscription status and the identifier returned by our payment processor. We do not receive or store your full card or bank details.
Technical data — standard server logs (such as timestamps and error information) generated while operating and securing the Service. Logs do not contain the contents of your lists.

A guest list — one built without signing in — is held only in the server's memory for your browser tab and is never written to our database.

How we use your information

We use your information to authenticate you, to save and retrieve your lists, to run the interaction check you ask for, to process and manage subscriptions, and to keep the Service secure. We do not sell your personal information, we do not use it for advertising, and we do not share your lists with drug manufacturers, insurers, employers, or data brokers.

Counts of which medications are checked together

To decide which combinations to test the checker against, we count how often each pair of medications is checked on the Service (for example, “warfarin + aspirin: 14 times”). Only the two drug names, the count, the dates and the result the checker gave are kept. The count is not linked to your email address, your list, or anything else about you or the person a list belongs to.

What is sent to the National Library of Medicine

To run a check, our server asks public U.S. National Library of Medicine and NIH services (RxNorm, RxClass, DailyMed, the Clinical Table Search Service and the Dietary Supplement Label Database) about individual drugs, supplements and condition names. Those requests come from our server, not your browser, and contain only the drug identifier or the search text — never your name, email address, or which person a list belongs to. Responses are public reference data, which we cache.

HIPAA and the laws that do apply

My-Rx Check is a consumer tool that you choose to use. SoftLOGiX is not your health-care provider, health plan, or pharmacy, and does not operate the Service on behalf of one, so the information you enter is generally not covered by HIPAA. The same medication list held by your doctor or pharmacy is protected by HIPAA there; HIPAA applies to who holds the information, not to the information itself.

Not being covered by HIPAA does not mean your information is unprotected. Consumer health information is protected by other U.S. laws, which apply to us, including:

the Federal Trade Commission's Health Breach Notification Rule, which requires us to notify you if your health information is acquired or disclosed without your authorization (see If there is a data breach below);
the FTC Act, which requires the promises in this policy to be truthful and kept; and
state consumer health-data and privacy laws, such as Washington's My Health My Data Act and similar laws in Nevada, Connecticut, California and other states, which give residents rights over their health data.

If My-Rx Check is ever offered to you through a pharmacy, clinic, or health plan, this section will be updated to explain how HIPAA applies in that case.

Your consent for health information

Entering medications, supplements, conditions, or lab values is always your choice. By entering them and saving a list, you consent to our collecting and storing that information for one purpose: to run the checks you request and show you your saved lists. We will ask for your separate, explicit consent before using or sharing your health information for any other purpose — and we do not plan to. You can withdraw consent at any time by deleting your lists or asking us to delete your account.

Cookies

We use a small number of cookies that are necessary for the Service to function: a signed sign-in cookie that keeps you logged in, and a cookie that remembers which saved list you last selected. We do not use advertising or cross-site tracking cookies. You can clear these cookies in your browser at any time; doing so will sign you out.

Service providers

We rely on a few third parties to operate the Service, and share only what each needs to perform its function:

Payment processing — PayPal handles subscription billing. Your payment is made on PayPal's systems under PayPal's own privacy policy; we receive only your subscription status and a subscription identifier.
Email delivery — an email provider is used to send your verification codes and account messages, and to send our own staff operational alerts about subscriptions and billing (which may include your email address, never the contents of your lists).
Hosting and storage — the application and its database run on Microsoft Azure, using Azure SQL Database. The database is encrypted at rest by default (Transparent Data Encryption) and connections to it use encrypted TLS channels. This infrastructure protection is in addition to the field-level encryption we apply to your data ourselves, described below.

How your information is protected

Data is transmitted over encrypted (HTTPS) connections. Beyond securing the database itself, we apply field-level encryption to your information while it is stored ("at rest"):

Your lists — each saved list (its medications, supplements, conditions and lab values) is encrypted in our database using AES-256-GCM, a modern authenticated-encryption standard. It is not stored in readable form and cannot be read without a separate encryption key.
Name — your first name is encrypted at rest with the same AES-256-GCM encryption.
Email address — your email is stored only in encrypted form, and the records that make up your account are located using a keyed one-way cryptographic hash (HMAC-SHA256) of your email rather than by the readable address itself.
Encryption keys — the keys used for this protection are managed separately from the database, so access to the database alone does not reveal the protected information.

Sign-in verification codes are cryptographically signed and expire after a short period. Together, these measures substantially reduce what could be exposed if the database were ever accessed without authorization. No method of transmission or storage is completely secure, and while these safeguards protect your information they do not render it anonymous; we take reasonable measures to keep it secure.

If there is a data breach

If we discover that your health information or other personal information has been acquired or disclosed without your authorization — whether through a security incident or any sharing you did not agree to — we will notify you by email without unreasonable delay, and in any case within 60 days of discovering it. The notice will say what happened, what information was involved, what we are doing about it, and what you can do to protect yourself. Where the law requires, we will also notify the Federal Trade Commission, state authorities, and, for larger incidents, the media.

Data retention

We keep your account information, saved lists, and subscription records for as long as your account is active or as needed to provide the Service. When you delete a saved list, it is permanently removed from our database at that time — the deletion is immediate and cannot be undone. You may also ask us to delete your account, and we will do so unless we are required to retain certain records (for example, billing records) by law.

Your choices and rights

You can delete any saved list yourself at any time. You may also access, correct, export, or delete the information associated with your account, or withdraw your consent, by contacting us at support@softlogix.com or through the Contact page. We will not discriminate against you for exercising these rights. Depending on where you live, you may have additional rights under laws that specifically protect consumer health data — for example, the right to know which third parties have received your health data (we share it with none) — and we will honor those rights as required.

Lists about other people

Subscribers may keep lists for people they look after. Enter another adult's health information only with their permission.

Children's privacy

The Service is intended for adults and is not directed to children. We do not knowingly collect personal information from anyone under 18.

Not medical advice

The Service is an educational tool. What it shows comes from a text search of official drug labels and National Library of Medicine data; it is not medical advice, diagnosis, or treatment.

Changes to this policy

We may update this policy from time to time. When we do, we will revise the effective date above, and material changes will be reflected on this page.

Microsoft and Azure are trademarks of the Microsoft group of companies. PayPal is a trademark of PayPal, Inc. RxNorm, DailyMed and MedlinePlus are services of the U.S. National Library of Medicine. These names are used for identification only and do not imply any endorsement or affiliation.

This page is provided as general information about our data practices and is not legal advice.