Privacy Policy

Who this policy covers

This policy applies to four distinct populations:

• Pharmacy users: pharmacists, technicians, owners, and administrators of compounding pharmacies and outsourcing facilities who use Nuro to manage their operations and to supply practices.
• Practice users: owners, staff, and prescribers of medical practices that order from a pharmacy through Nuro. Each practice has its own workspace.
• Applicants and prescribers: people who submit a practice application on a pharmacy's public application page before they have an account, and prescribers whose details a practice or pharmacy enters, whether or not they sign in themselves.
• Patients: individuals whose information reaches Nuro because a pharmacy enters it. Nuro does not currently maintain patient records or prescriptions. Patient information appears in the Service chiefly as the recipient name and address on a package a pharmacy ships, and in anything a user types into a free-text field. Patients are NOT our direct customers; where that information is protected health information (“PHI”), we process it as a HIPAA Business Associate to the pharmacy.

Information we collect

Account information: name, email address, phone number, profile photo, organization and workspace membership, role and permissions, notification and interface preferences, and Amazon Cognito authentication identifiers. Passwords are verified by Amazon Cognito and are not stored by Nuro.

Session information: IP address, browser user-agent, sign-in and last-seen times, and an approximate location (city, region, and country) derived from the IP address using a database we host ourselves, so the address is not sent to a third party for the lookup.

Activity and audit records: a record of actions taken in the Service, including who took each action and when, and electronic signatures, with a drawn signature mark where one is captured.

Practice applications: practice name, type, and specialty; website; contact name, email, and phone; practice, billing, and shipping addresses; accounts-payable contact; the practice's NPI and DEA number; the name and email of the administrator the practice nominates; the prescribers it lists; its answers to the pharmacy's screening questions; and how it heard about the pharmacy. We may email the contact address to confirm it.

Prescriber information: name, credential, email, phone and fax numbers, NPI, state licenses (state, number, type, and expiry), DEA registrations (number, state, schedules, and expiry), whether the prescriber prescribes controlled substances or is authorized for electronic prescribing of controlled substances, supervising prescriber, documents uploaded about the prescriber, and each pharmacy's verification of their licenses.

NPI registry results: when an NPI is entered, and about once a day after that, Nuro looks it up in the National Plan and Provider Enumeration System (“NPPES”), the public registry run by the Centers for Medicare & Medicaid Services, and records the registry's answer and the name it lists for that number.

Orders, invoices, and shipping: purchase and sales orders, line items, prices and fees, invoices and receipts, shipping addresses, tracking numbers, carrier delivery events, packing slips, and photographs of packages.

Payment information: card and bank account details are entered into fields hosted by the pharmacy's payment gateway and are converted into a token by the gateway in your browser, so the full card number never reaches Nuro. We store the gateway's token, the card brand, the last four digits, the expiry date, a record of the cardholder's consent to store the card, and the charges made and their outcome.

Pharmacy operations data: licenses and their documents, products and catalogs, inventory and lots, suppliers, package scans, and readings, such as temperature, humidity, and pressure, from the environmental sensors a pharmacy connects.

Integration credentials: the keys a pharmacy provides for its own payment gateway, shipping carrier, and sensor accounts. These are stored in AWS Secrets Manager and are used only to act on that pharmacy's account.

Cookies & local storage: one session cookie for authentication (httpOnly, Secure, SameSite=Lax), a short-lived cookie that carries a sign-in step from one screen to the next, and preference cookies and local storage for interface settings such as theme and layout (non-httpOnly, client-readable). Nuro uses no analytics, advertising, or tracking cookies, and the marketing website at nurohq.com sets no cookies.

How we use information

• To provide, maintain, and improve the Service.
• To send transactional emails (account invitations, sign-in and password-reset links, application confirmations, order, invoice, and shipping notices, and monitoring and reminder notifications). We do not send marketing emails to users without separate consent.
• To check NPIs against the NPPES registry and shipping addresses against carrier address data, and to show the results to the pharmacy reviewing an application or order.
• To process payments, buy shipping labels, and retrieve sensor readings on a customer's own third-party accounts, at that customer's instruction.
• To detect, prevent, and respond to security incidents, fraud, and abuse.
• To comply with legal obligations (HIPAA, state pharmacy laws, DEA reporting requirements where applicable).

Nuro does not currently send text messages through the Service. See SMS Consent for the terms that apply to any text messaging program operated through Nuro.

Pharmacies, practices, and the information they share

Pharmacies and practices are both our customers, and Nuro processes the information they enter on their behalf. When a practice applies to a pharmacy or orders from it, the application, the practice's prescribers and their credentials, and the practice's orders and invoices are made available to that pharmacy, which uses them to decide the application, verify the prescribers, and fulfil and bill the orders. Nuro does not share a practice's information with a pharmacy the practice has not applied to or been linked to.

Information an applicant submits on a pharmacy's application page is collected for that pharmacy. The pharmacy decides whether to approve the application; if it is approved, Nuro creates the practice's workspace and invites the applicant or the administrator they named.

HIPAA & PHI

When Nuro processes PHI on behalf of a pharmacy, the pharmacy is the Covered Entity and Nuro is the Business Associate. A signed Business Associate Agreement (“BAA”) governs our handling of PHI. The pharmacy is responsible for obtaining patient consent for any uses of PHI beyond treatment, payment, and healthcare operations.

Nuro will not use, disclose, or sell PHI for any purpose other than providing the Service to the pharmacy, except as permitted or required by the BAA, HIPAA, or other applicable law.

Subprocessors and third parties

We use the following subprocessors to operate the Service:

• Amazon Web Services: infrastructure hosting (ECS and Lambda), database (Aurora PostgreSQL), authentication (Amazon Cognito), object storage (S3), secrets storage (Secrets Manager and Parameter Store), content delivery (CloudFront), queues (SQS), and logging.
• Resend: transactional email delivery. Receives each recipient's email address and the content of the message.
• Sentry: error monitoring for the Nuro application. Error reports are built from a fixed list of fields, and Sentry's collection of personal information is turned off.
• EasyPost: shipping address verification on Nuro's own account. Receives the address being checked, with the name, company, and phone number on it.

Some services act on a customer's own account with a third party, using credentials the customer provides. The customer contracts with these providers directly:

• Payment gateways: card and bank payments are processed by the payment gateway the pharmacy contracts with, which today runs on the NMI platform, sometimes under a reseller's name. The gateway receives the payment details you enter in its fields and the charges Nuro asks it to make on the pharmacy's behalf.
• EasyPost: for pharmacies that connect their own EasyPost account, shipping rates, labels, tracking, and shipment insurance on that account. Receives the recipient's name and shipping address and the parcel's details.
• TempStick and SensoScientific: environmental sensor readings, retrieved from the pharmacy's own sensor account. No PHI involved.

Nuro also looks up NPIs in the NPPES public registry. Only the NPI being checked is sent.

Text messaging opt-in data

Mobile opt-in information and consent collected for any patient SMS program operated through Nuro are never sold, rented, transferred, or shared for any third party's marketing.

All the above categories exclude text messaging originator opt-in data and consent; this information won't be shared with any third parties.

Data security

Encryption at rest: Aurora PostgreSQL is encrypted via AWS KMS. S3 objects encrypted server-side. Secrets stored in AWS Secrets Manager + Parameter Store with restricted IAM access.

Encryption in transit: TLS 1.2+ for all HTTPS endpoints and database connections.

Access control: per-workspace row-level security on every tenant-scoped database table; per-user permissions within each workspace; and an append-only, hash-linked audit trail on regulated records, whose recent entries are re-verified every day.

User authentication: Amazon Cognito with an enforced password policy and optional multi-factor authentication. Sessions end after 30 minutes without activity and after 12 hours in all, and changing your password signs out your other sessions.

Nuro staff access customer workspaces only through a separate staff console, which has its own sign-in and requires multi-factor authentication, to provision workspaces and provide support.

Data retention

User account data is retained for the duration of the workspace's active subscription plus 7 years (matches pharmacy record-retention requirements). PHI is retained per the pharmacy's data-retention policy specified in the BAA. Audit logs are immutable and retained for the life of the workspace.

Some records are kept for shorter, fixed periods. Session records, including the IP address and approximate location, are deleted a day after the session expires. Invitation and password-reset links expire and are retired. Raw data received from sensor vendors is deleted after 90 days unless the pharmacy has placed a retention hold on it. Production database backups are kept for 35 days.

Patients may request that a pharmacy delete their PHI from Nuro's systems. Direct deletion requests from patients should be sent to the pharmacy; Nuro will action the pharmacy's written instruction.

Your rights

Users may access, update, or request deletion of their account data by contacting us at privacy@nurohq.com. Workspace administrators can deactivate members directly from the Members page in Settings.

Prescribers and practice contacts whose information a practice or pharmacy entered may ask that customer to correct or remove it, and we will help the customer do so.

Patient PHI rights (access, amendment, accounting of disclosures) are honored by the pharmacy as the Covered Entity, with Nuro's cooperation as required by HIPAA.

Children

The Service is not directed to children under 13. Pharmacies may enter PHI for pediatric patients as part of normal operations; that processing is bound by HIPAA and the pharmacy's consent practices, not by COPPA.

International users

Nuro's infrastructure is hosted in the United States (AWS us-east-1). The Service is offered to US-based pharmacies and practices. We are not currently configured to handle cross-border PHI transfers; non-US use cases require advance written approval.

Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email to active workspace owners and posted to this page. Continued use of the Service after the effective date constitutes acceptance.

Contact

Privacy questions or concerns: privacy@nurohq.com.

General inquiries: hello@nurohq.com.