Privacy Policy

Effective Date: October 7, 2026

Operator: Drug Analytics LLC ("Company," "we," "us," or "our")

Application: RxOra (iOS and iPadOS) and related backend APIs

At Drug Analytics LLC, we take your privacy seriously. This Privacy Policy details how personal information, account credentials, and technical data are collected, utilized, and protected when you access the RxOra mobile client application and our associated backend services (collectively, the "Service").

1. Information Collection and Purpose of Use

1.1 Account and Authentication Data (Sign in with Apple)

While Apple’s authentication handshake may transmit an email address or relay address upon your initial sign-in, we do not log, retain, or store your email address, name, or Apple ID profile details. When you register or sign in using Apple’s "Sign in with Apple" service, we collect only the unique, stable and pseudonymous user identifier provided by Apple. We use this identifier solely to:

·       Authenticate your identity with our backend servers;

·       Validate and administer your subscription status and feature entitlements; and

·       Enforce account security and prevent unauthorized access.

1.2 In-App Purchases and Payment Information

All financial transactions, payments, renewals, and refunds are processed exclusively through Apple’s StoreKit framework via your Apple ID. Drug Analytics LLC does not receive, collect, or store your credit card numbers, billing addresses, or bank account information. We receive only cryptographically signed digital receipts and transaction identifiers from Apple to verify your subscription entitlement.

1.3 Quota Tracking During Promotional / Free Tiers

To administer our free trial and ensure users receive their full entitlement of five unique drug lookups within a 30-day period, the Service does not retain plain-text search terms or drug names. Instead, queries executed under the promotional tier are converted on the server into a non-reversible, cryptographically keyed hash (HMAC) using an internal server master key. The sole purpose of retaining these one-way hash digests alongside your remaining balance is to recognize previously viewed formulations and enforce the free trial limit. All associated promotional hashes are permanently deleted from our servers at the conclusion of the trial period—triggered by reaching the five-lookup limit, the expiration of the 30-day window, the activation of a paid subscription, or an account deletion request.

1.4 Anonymized and De-Identified Usage Logs

Outside of the promotional quota counter described in Section 1.3, search queries and ingredient lookups submitted to our servers are dissociated from your user account. We collect de-identified technical query strings and performance metrics in aggregate to improve search heuristics, audit text extraction pipelines, and optimize database indexing. This technical data cannot be used to reconstruct your personal identity.

1.5 Network Security and Abuse Monitoring

To safeguard our proprietary databases, protect backend availability, and enforce our Terms of Service, our servers collect technical network metadata, including:

·       Originating Internet Protocol (IP) addresses;

·       Traffic volume;

·       Request timestamps and query frequency; and

·       API client handshake metadata.

This information is processed exclusively to identify, throttle, and block automated scrapers, denial-of-service attempts, brute-force exploits, or API tampering.

1.6 Device Hardware, Camera Usage, and Optical Tools

To facilitate rapid drug identification and label legibility, RxOra may request permission to access your device’s camera for optical lookup and visual assistance:

·       Barcode Scanning and Query Resolution: You may use the camera to scan Universal Product Code (UPC) barcodes on packaging. The optical feed is analyzed strictly on-device in real time to decode the numeric value. Once decoded, the resulting numeric barcode string is transmitted to our backend servers solely to resolve the corresponding National Drug Code (NDC) and return drug formulation details, processed identically to a standard search as described in Section 1.4.

·       Optical Magnification and Manual NDC Entry: RxOra provides an in-app magnified camera preview to assist you in visually reading small NDC numbers, lot identifiers, and fine print directly on medicine bottles or packaging. This visual magnification runs entirely on-device as a live, temporary camera feed. Any numeric NDC or drug identifier you manually enter into the search interface—whether read using the magnifier or typed directly—is transmitted to our backend servers to retrieve the requested drug records, subject to the unlinked search provisions in Section 1.4.

·       Zero Media Retention: Drug Analytics LLC does not capture, record, store, or transmit raw camera video feeds, magnified frames, photographs, or image files to our servers or any third parties. All camera processing is strictly transient and remains entirely on your device.

2. Information Sharing, Disclosure, and Tracking

·       No Sale or Third-Party Sharing: We do not sell, rent, license, or monetize your personal information or technical query logs to data brokers, marketers, or external commercial entities.

·       No Cross-App Tracking: RxOra does not utilize tracking cookies, third-party advertising SDKs, or Apple’s Identifier for Advertisers (IDFA). We do not track your activity across other companies' apps or websites.

·       Legal and Safety Compulsion: We may disclose information only if required by a valid subpoena, court order, or binding legal process, or to defend the legal rights, safety, and network security of Drug Analytics LLC against active cyberattacks or fraud.

3. Data Security and Healthcare Privacy Boundaries

3.1 Technical Safeguards

We implement industry-standard administrative, organizational, and technical safeguards to protect data in transit and at rest. All communication between the RxOra application and our backend servers is encrypted using modern Transport Layer Security (TLS/HTTPS).

3.2 Not Protected Health Information (PHI)

The Service is an informational and reference utility indexing publicly available pharmaceutical filings. We do not provide clinical services, medical diagnoses, or pharmacy fulfillment. The Service does not collect, store, or process Protected Health Information (PHI) subject to the Health Insurance Portability and Accountability Act (HIPAA).

4. Account and Data Deletion Rights

You have full control over your account data. You may delete your account and associated personal data at any time:

·       In-App Account Deletion: Open the application, tap the Menu, and select Delete Account. Confirm the prompt to immediately initiate the deletion of your account.

·       Deletion Processing: Deletion permanently removes your Apple user identifier, active authentication tokens, and promotional trial hashes from our active user databases.

·       Abuse and Fraud Prevention Exemption: In accordance with statutory privacy exceptions for fraud and abuse prevention, when an account is deleted, our backend retains a one-way, irreversible cryptographic salted hash of the Apple user identifier. This hashed string cannot be reversed, decrypted, or linked back to your identity; it exists solely to verify that previously redeemed promotional trial quotas are not reset through repeated account deletion cycles.

5. Age Restriction & Children's Privacy

The Service is strictly intended for and restricted to individuals who are at least eighteen (18) years of age (or the age of majority in your jurisdiction of residence). In alignment with our App Store age designation and Terms of Service, RxOra is not directed toward, marketed to, or permitted for use by minors or children under the age of eighteen (18).

We do not knowingly collect, solicit, or maintain personal information or account credentials from anyone under the age of 18. If we discover or are notified that an individual under the age of 18 has created an account, utilized Sign in with Apple, or submitted information to the Service, we will immediately delete that account, revoke all session tokens, and purge any associated user records from our active databases. If you believe a minor has accessed the Service, please contact us at contact@druganalytics.ai.

6. Modifications to This Policy

We reserve the right to revise this Privacy Policy periodically to reflect updates in application functionality, technical architecture, or regulatory obligations. When changes are made, the "Effective Date" at the top of this document will be updated. Continued use of the Service following posted modifications constitutes acceptance of the revised policy.

7. Contact Information

For questions regarding this Privacy Policy, your data rights, or account deletion inquiries, please contact:

·       Entity: Drug Analytics LLC

·       Contact Email: contact@druganalytics.ai

·       Jurisdiction: Gainesville, Georgia, USA