This policy explains how AmayaFlow, Inc. ("amayaFlow," "we," "us") collects, uses, shares and protects information when you visit our website, contact us, or use our services.
1. Who we are and what this policy covers
amayaFlow provides a cloud-based pharmacy management platform to independent pharmacies, along with related web and mobile applications. This policy applies to:
- our website at www.amayaflow.com and any pages that link to this policy;
- our mobile and desktop applications;
- emails and text messages we send, including messages sent on behalf of a pharmacy;
- information you give us when you request a demo, contact sales or support, or sign up for updates; and
- account and usage information from pharmacy staff who use the amayaFlow platform.
When amayaFlow processes patient health or prescription information for a pharmacy, we do so as that pharmacy's business associate under the Health Insurance Portability and Accountability Act (HIPAA). That information is governed by HIPAA, our business associate agreement with the pharmacy, and the pharmacy's own Notice of Privacy Practices. Patients with questions about their health information should contact their pharmacy. See Section 4.
2. Information we collect
Information you provide
- Contact and business details, such as your name, pharmacy or company name, job title, email address, phone number, number of locations and message content, when you request a demo or contact us.
- Account information for pharmacy customers, such as user names, login credentials, roles and professional license numbers where required to provide the service.
- Billing information for pharmacy customers, such as billing contacts and payment details. Payment card data is processed by our payment provider and is not stored on our servers.
- Communications, including support requests, survey responses and feedback.
- Mobile phone number and messaging preferences, when you agree to receive text messages. See Section 7.
Information collected automatically
- Device and usage data, such as IP address, browser type, operating system, pages viewed, referring pages, and the date and time of visits.
- Platform activity logs, such as sign-ins and actions taken in the platform, which we keep for security, auditing and support.
- Mobile app information, such as device model, operating system, unique device identifiers, and push notification tokens. With your permission, our apps may collect precise device location to support features such as delivery tracking. You can turn off location access and push notifications in your device settings at any time.
- Cookies, pixels and similar technologies, described in Section 6.
Information from other sources
We may receive business contact information from partners, event organizers or publicly available professional sources, and we may combine it with information you provide.
3. How we use information
- To provide, operate, maintain and support the amayaFlow website and platform.
- To respond to demo requests, questions and support tickets.
- To set up and manage customer accounts and process billing.
- To send service notices, security alerts and administrative messages.
- To send product updates and marketing emails, which you can opt out of at any time.
- To monitor, secure and improve our website and services, and to detect and prevent fraud or misuse.
- To comply with legal, regulatory and contractual obligations, including pharmacy and e-prescribing network requirements.
4. Health and prescription information
To deliver our services, the amayaFlow platform receives and processes protected health information (PHI) on behalf of pharmacies, including electronic prescriptions, patient profiles, medication histories, and insurance and claims data.
- We use PHI only to provide services to the pharmacy, as permitted by HIPAA and our business associate agreements.
- Electronic prescriptions and related messages are exchanged through certified e-prescribing networks, such as Surescripts, and insurance claims are submitted through pharmacy claims processors. These networks receive only the information needed to complete each transaction.
- We do not sell PHI, and we do not use PHI for advertising or marketing.
- We may use information that has been de-identified under HIPAA standards to operate and improve our services.
5. How we share information
We do not sell personal information. We share information only as described below:
- Service providers that host our systems, process payments, send email, provide analytics or support our operations. They may use information only to perform services for us and must protect it.
- Healthcare networks and processors, including e-prescribing networks and claims processors, when needed to process a pharmacy's transactions.
- Pharmacy customers, who can see information about their own users, patients and transactions within their account.
- Affiliates, meaning companies under common ownership or control with amayaFlow, which must handle the information consistently with this policy.
- Aggregate or de-identified information that does not identify you, for example the number of pharmacies using a feature or website traffic trends. We do not share health information in this way.
- Legal and safety reasons, when we believe disclosure is required by law, subpoena or court order, or is necessary to protect the rights, property or safety of amayaFlow, our customers, patients or others.
- Business transfers, such as a merger, acquisition or sale of assets, subject to this policy and any applicable business associate agreements.
- With your consent or at your direction.
6. Cookies, analytics and advertising
Our website and apps use cookies, pixels, software development kits and similar technologies ("cookies"). We group them as follows:
| Category | Purpose | Tools we use |
|---|---|---|
| Strictly necessary | Keep the site secure and working, remember your cookie choices, and keep you signed in. | First-party cookies |
| Analytics | Measure traffic and understand how visitors use the site so we can improve it. | Google Analytics |
You can learn how Google uses data from sites that use its services at policies.google.com/technologies/partner-sites, and you can opt out of Google Analytics with the browser add-on at tools.google.com/dlpage/gaoptout.
Your cookie choices
When you first visit our website, a banner lets you accept or decline cookies that are not strictly necessary. You can change your choice at any time through the Cookie settings link in the footer. You can also block or delete cookies in your browser settings, though some parts of the site may not work as a result.
Our website honors Global Privacy Control signals as a request to opt out of any sale or sharing of personal information. Because there is no common industry standard for "Do Not Track" signals, we do not currently respond to them.
We do not use advertising cookies or pixels, and we do not use personal information for targeted advertising.
We never use cookies, pixels or advertising tools inside the amayaFlow platform or on any page where patient health information is entered or displayed.
7. Text messages
If you give us your mobile number and agree to receive texts, we or a pharmacy using amayaFlow may send you text messages such as refill reminders, pickup and delivery updates, account alerts and, only if you separately agree, product updates.
- Consent to receive text messages is not a condition of any purchase.
- Message frequency varies. Message and data rates may apply.
- Reply STOP to any message to opt out, or HELP for help. You can also contact us using the details in Section 15.
- Wireless carriers are not liable for delayed or undelivered messages.
- We do not share mobile numbers or text messaging consent with third parties or affiliates for their marketing or promotional purposes.
Text messages about a patient's prescriptions are sent on behalf of the patient's pharmacy and are handled as protected health information under Section 4.
8. Data retention
We keep personal information only as long as needed for the purposes described in this policy, including to provide our services, meet legal, tax, audit and regulatory requirements, resolve disputes and enforce agreements. Prescription and pharmacy records are retained according to our customer agreements and applicable federal and state pharmacy record retention laws. When information is no longer needed, we delete or de-identify it. If information cannot be deleted right away, for example because it is stored in backup archives, we securely store it and isolate it from further use until it can be deleted.
9. Security
We use administrative, technical and physical safeguards designed to protect information, including encryption of data in transit and at rest, role-based access controls, multi-factor authentication, activity logging and regular security reviews. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we learn of a security incident affecting your information, we will notify you and the appropriate parties as required by law and our agreements.
You also play a part in keeping accounts secure. Pharmacy users are responsible for keeping their passwords and multi-factor authentication devices confidential, must not share login credentials, and should tell us right away at security@amayaflow.com if they suspect unauthorized access to their account.
10. Your choices and rights
- Marketing emails: use the unsubscribe link in any marketing email or contact us.
- Text messages: reply STOP to any text message.
- Cookies and advertising: use the Cookie settings link in the footer or a Global Privacy Control signal. See Section 6.
- Access, correction and deletion: you may ask to access, correct or delete personal information we hold about you, subject to legal exceptions.
- State privacy rights: depending on where you live, including California, Virginia, Colorado, Connecticut and other states with privacy laws, you may have additional rights, such as the right to know what we collect, to request deletion, to correct information, and to opt out of sale or targeted advertising. We do not sell personal information, and we do not use it for targeted or cross-context behavioral advertising. We will not discriminate against you for exercising these rights.
- Patients: requests about prescription or health records should go to your pharmacy, which controls that information. We will assist the pharmacy in responding.
California "Shine the Light": California residents may ask us once a year, free of charge, for information about any personal information we disclosed to third parties for their own direct marketing purposes in the prior calendar year. We do not disclose personal information to third parties for their own direct marketing purposes. To make a request, email security@amayaflow.com.
To make a request, email security@amayaflow.com. We will verify your identity before responding and reply within the time required by law. An authorized agent may submit a request on your behalf with proof of authorization.
11. Children's privacy
Our website is intended for pharmacy owners and professionals and is not directed to anyone under 18. We do not knowingly collect personal information through our website from anyone under 18. If you believe a child has provided us information, contact us and we will delete it. Minors' health information that a pharmacy processes through our platform is handled as PHI under Section 4.
12. Where we process data
amayaFlow is based in the United States, and we store and process information in the United States. Our services are intended for pharmacies in the United States.
13. Third-party sites
Our website may link to sites and services we do not control. Their privacy practices are governed by their own policies, and we encourage you to review them.
14. Changes to this policy
We may update this policy from time to time. When we do, we will change the effective date above, and for material changes we will provide additional notice, such as a notice on our website or an email to customers.
15. Contact us
For questions about this policy or our privacy practices, contact:
AmayaFlow, Inc.
Attn: Privacy Officer
Email: security@amayaflow.com