Privacy Policy

TruthRx, LLC (“TruthRx”, “we”) runs the prescription drug benefit for employer health plans. This policy explains what we collect on this website and in our client and broker portals, why we collect it, where it is kept, which companies process it for us, and how long we keep it. Health information about plan members is handled differently, as its own section below explains.

The short version

• We do not sell personal information, and we do not use it for advertising.
• The public website sets no cookies and runs no third-party trackers or ads.
• Member health information is handled under HIPAA and our agreements with each health plan, kept in our secure vault, and never used for marketing.
• You can ask us what we hold about you, and ask us to correct or delete it.

What we collect and why

When you visit the website

We count page views with our own simple counter. For each view it records the page, the website you came from (if any), and a code made from your IP address, your browser type and the date. Because the date is part of the code, it changes every day and cannot link one day’s visit to another. Your IP address itself is not stored. If your browser sends a Do Not Track or Global Privacy Control signal, nothing is counted. We use these counts only to see how the site is used.

Like any website, our hosting provider handles your IP address to deliver pages to you and to protect the site.

When you send us a form

The Request a Quote form, the broker partnership form and the Plan Design Questionnaire ask for your company or agency, your name, email address and phone number, and details about your health plan or your business (such as group size, current pharmacy benefit manager, target start date, coverage preferences and your message). The questionnaire also asks for the name and title of the person completing it.

• Your answers are emailed to our team, along with the time you sent the form and your IP address, so we can reply and screen out spam.
• We add your contact details and a short note to our list of business contacts so we can follow up. Emails we send from that list come from a TruthRx owner and include a link to unsubscribe.

When you use the lookup tools

• Find Your Formulary: the Rx group number you enter is used only to find your plan’s drug list. We do not store it.
• Find a Pharmacy: your browser downloads our pharmacy list for the state you search and matches your city or ZIP code itself. We do not store your search. The map images come from OpenStreetMap, so your browser contacts OpenStreetMap’s servers directly, and they see your IP address and the area of the map you view. OpenStreetMap’s own privacy policy applies to that.

Client and broker portals

• Your account: your name, email address and password (stored by our sign-in provider in a protected form that no one, including us, can read), any two-step sign-in you set up, and the times you sign in. Your sign-in session is kept in your browser’s local storage until you sign out.
• Portal setup links: when you ask for a sign-in link on your setup page, we email it only to your account’s own address.
• Onboarding: your organization’s legal name, tax ID (EIN), address and website; names, titles, email addresses and phone numbers of your contacts and administrators; your plan details and coverage choices; documents you upload, such as your current plan documents; and the typed name and title of the person who signs.
• Electronic signatures: when you sign a document in the portal, we record your typed name and title, the date and time, and your IP address on the signed copy, and keep it with your agreement.
• Activity: we keep a record of portal activity, such as documents signed or uploaded and documents opened from the broker portal.

Please do not upload member health information, such as lists of plan members or claims, through the portal. We will give you a secure way to send it.

Secure messages from us

When we send you a secure message or a one-time link, it opens on our secure vault. To read a message, you type your email address, and if it matches the address we entered, we email you a six-digit code. Sometimes we give you the code by phone or text instead. We record the IP address and browser used for each code request, sign-in, download and reply, to protect the message. Signing in sets a cookie for that one message, which lasts an hour. The message, its files and any replies are deleted when the conversation ends, usually after 14 days and never more than 90; the record of who signed in and what was downloaded is kept for security and audits.

Documents you email to us

When you email a signed document to our document address, we keep the sender’s address, the subject and the PDF, and file it with your organization’s records.

Business contacts from public sources

To find employers and benefits brokers who may be a good fit, we research public sources such as company websites, business directories and public plan filings. We keep the business contact details we find (such as a name, job title, and a work email address or phone number that the business has published) with notes on where each fact came from. An owner reviews every contact before any email is sent, and every email includes a link to unsubscribe.

Billing

For clients, we keep the billing contact’s name, email address and mailing address, and the invoices, payments and agreements that go with them.

Member health information

TruthRx works for employer health plans as a “business associate” under HIPAA, the federal health privacy law. Information about plan members, such as eligibility and prescription claims, comes to us from the health plan, its administrators and its claims processing partner. We handle it under HIPAA and under a written business associate agreement with each plan, and we use it only to run, check and report on that plan’s pharmacy benefit as those agreements allow.

• We never sell member health information and never use it for marketing.
• It is kept in our secure vault on encrypted Google Cloud servers, where only TruthRx’s owners can see member details, and every search and record opened there is logged.
• It is not kept on this website, in its database or file storage, or in email. If it reaches us some other way, we move it to the vault and delete the copy.
• Reports to employers carry totals, not information about individual members. An employer receives member-level information only after giving the certification the law requires to protect it.

If you are a plan member: your health plan’s Notice of Privacy Practices explains your rights, such as seeing or correcting your records. Contact your health plan to use those rights, or call us and we will help. The Patient Portal link on this site opens a member website run by our claims processing partner, under its own privacy terms.

Where it is stored and who processes it

We use these companies to run our services. Each processes information only to provide its service to us. Only the companies marked “under a business associate agreement” may receive member health information.

• Netlify: hosts this website and runs its server functions. Its form service also receives a copy of each client’s completed onboarding questionnaire and sends it to us.
• Supabase: our database and portal sign-in. It holds form inquiries, our business contact list, portal accounts, onboarding answers, page counts and activity records.
• Cloudflare: stores our documents and files, such as agreements, signed copies, uploaded plan documents, drug lists, invoices and database backups, and routes email sent to our document address.
• Resend: sends the email our website and portals send, such as form notices to our team, sign-in links, access codes and follow-up emails.
• Our business email provider: where form notices and your replies to us arrive.
• Google Cloud: hosts our secure vault, which holds member health information and secure messages, under a business associate agreement.
• Anthropic: an AI service, used under a business associate agreement, that reads business documents and records for us (such as partner invoices, plan documents and our bookkeeping) and helps research public business information about prospective clients. We do not send it website form entries or member health information.
• Intuit QuickBooks: our accounting system, for invoices, bills and payments, with each client’s billing contact.
• OpenStreetMap: supplies the map images on Find a Pharmacy, which your browser loads directly.
• Our claims processing partner: processes the plan’s pharmacy claims and runs the member Patient Portal, under a business associate agreement.

How long we keep it

• Page counts: kept as traffic history. They contain no name, address or IP address.
• Emails with your inquiry: generally up to 3 years.
• Business contact list: until the contact is no longer useful to us or you ask us to remove it. If you unsubscribe, we keep your email address only so that we never email you again.
• Portal accounts: for as long as your organization works with us.
• Agreements and signed documents, including a signed onboarding questionnaire: for the length of the agreement plus 6 years.
• Invoices and billing records: 7 years.
• Activity and approval records: 6 years.
• Secure messages: deleted when the conversation ends (usually 14 days, never more than 90). The access record is kept with our security records.
• Database backups: about 6 months (26 weeks), then deleted.
• Member health information: as long as the law and the plan’s agreements require (generally at least 6 years after the plan year), then securely destroyed.

Some of these periods follow legal requirements. If advice from our attorneys or accountants changes one, we will update this page.

How we share information

• We do not sell or rent personal information.
• Customer data is not shared with 3rd parties for promotional or marketing purposes.
• We share information only with the companies listed above so they can provide their services to us, with the health plan we serve as our agreement with it allows, and when the law requires it.
• Mobile opt-in and consent are never shared with anyone for any purpose. Any information sharing that may be mentioned elsewhere in this policy excludes mobile opt-in data.

Messaging Terms and Conditions

By providing your phone number and agreeing to receive texts, you consent to receive text messages from TruthRx, LLC, from 1-866-878-8479, regarding customer care. Consent is not a condition of purchase. Message frequency varies. Message & data rates may apply.

You can opt out at any time by replying STOP to a text message, requesting removal via a phone call, or verbally notifying a TruthRx representative. You may also reply HELP for assistance.

For questions or support, contact us at 1-866-878-8479 or customerservice@truthrxpbm.com.

Mobile opt-in information is never shared with third parties.

How we protect information

• Every page and portal is served over an encrypted (HTTPS) connection.
• Portal accounts can use two-step sign-in, and access inside TruthRx is limited to the people who need it.
• Member health information and secure messages are kept only in our encrypted vault, and every access to member information is logged.

No system is perfectly secure. If a breach affects your information, we will tell you as the law and our agreements require.

Your choices

• Ask us what information we hold about you, and ask us to correct it or delete it. We will delete it unless the law or an agreement requires us to keep it, and we will tell you if so.
• Use the unsubscribe link in any email from us, or ask us, to stop our emails.
• Turn on Do Not Track or Global Privacy Control in your browser and our page counter will skip you.
• Plan members: use the rights in your health plan’s Notice of Privacy Practices by contacting your plan, or call us for help.

Children

This website is for businesses and is not directed to children. We do not knowingly collect information from children through it.

Changes to this policy

When we change how we collect or use information, we will update this page and the effective date at the top.

Contact us

TruthRx, LLC
4601 E. Douglas Ave, Suite 150
Wichita, KS 67218

Phone: 1-866-878-8479
Email: customerservice@truthrxpbm.com