Security & HIPAA
How client information is protected
Medicare numbers and medication lists are protected health information. This page describes, in plain terms, what ShareMyRx does with it.
A Business Associate Agreement with every agent
Before an agent can send a single invitation, they sign a Business Associate Agreement with ShareMyRx inside the app. The signature is recorded with the exact agreement text (fingerprinted), the date and time, IP address and device details, and a copy is always available to the agent under Settings. Agents also accept an email sending policy: only their own clients, no purchased lists, opt-outs honored.
Private links that expire
Each client gets a unique, unguessable link to their own form. Links stop working 120 days after they are sent. If a link is opened from a new device at a different network than the first time, the client must confirm their Medicare number before anything is shown. Medicare numbers are never pre-filled in full; the form shows only the last four characters as a hint.
Data isolation
Every agent’s clients and submissions are isolated by database row-level security: an agent can only ever read their own records. Admin access to agent data is logged.
Invitations are sent from a dedicated, authenticated sending domain (SPF, DKIM and DMARC) with a one-click unsubscribe in every message. Sending is rate-limited and monitored for bounces and complaints so that one agent’s list cannot affect another’s deliverability.
Where data lives
Application data is stored in Supabase (Postgres, hosted in the United States) with encryption at rest and in transit. The application runs on Cloudflare. Email is delivered by Resend and payments by Stripe; Stripe never shares card numbers with ShareMyRx. Drug and provider lookups are proxied through ShareMyRx to the National Library of Medicine, openFDA and the CMS NPI Registry; those services receive search terms only, never client identities.
What we do not do
We do not sell or share client information, do not use it to market plans, and do not contact your clients except on your behalf when you send an invitation.
Questions
Email support@sharemyrx.com. See also the privacy policy and terms of service.