Legal
Privacy Policy
Last updated November 11, 2026
Draft for legal review. This text has not been reviewed by an attorney yet and is not in effect. The final version will be published here before launch.
This policy explains what information the company that operates BubbleTrack (“we”) collects and how we use it.
Who this applies to
- Pharmacy staff who use BubbleTrack at work.
- Patients whose pharmacy uses BubbleTrack, including patients who use the patient app.
- Visitors to this website.
For patient information, we act as a business associate of the pharmacy: the pharmacy decides what is collected and why, and our Business Associate Agreement with the pharmacy controls how we handle it.
What we collect
- Staff accounts: name, work email, role, sign-in activity.
- Pharmacy information: name, address, phone, settings and billing status. Card details are handled by Stripe, not stored by us.
- Patient information entered by the pharmacy: name, date of birth, phone, medications, packs and messages.
- Patient app: mobile number, sign-in activity and the requests and messages you send.
- Website visitors: page views counted without cookies or tracking across sites.
How we use it
To provide the service to the pharmacy, keep it secure, support it, and send the messages the pharmacy asks us to send. We don’t sell personal information, use patient information for advertising, or use it to train AI models.
Who we share it with
Only the service providers listed on our subprocessors page, under contracts that protect the information, or when the law requires it.
Text messages
We text a patient only after their pharmacy invites them to the patient app, and to send the sign-in codes they ask for. Messages are about their own pharmacy account and medications, never marketing. Message frequency varies; message and data rates may apply. Reply STOP to stop texts or HELP for help.
Mobile numbers and text-messaging consent are never sold, rented or shared with third parties or affiliates for their marketing. They are shared only with the providers that deliver the messages.
How long we keep it
As long as the pharmacy uses BubbleTrack, then for 90 days after its subscription ends, after which it is deleted unless the law requires us to keep it.
Security
Information is encrypted in transit and at rest, each pharmacy’s data is kept separate, and access is limited and logged. See Security & HIPAA.
Your choices
Patients: contact your pharmacy to see, correct or delete your information, or to stop texts. Staff and visitors: email hello@bubbletrack.app.