Privacy notice
Medication information says something personal about you. SlashedRx is built around collecting as little of it as possible, and this notice describes exactly what that means in practice — field by field, and third party by third party.
There is a separate consumer health data privacy notice covering the medication information specifically, because some state laws require that notice to stand on its own.
The short version
- We ask for a medication, a strength, a quantity, what you pay today, and your ZIP code. That is what a search needs.
- You can search without an account at all.
- There is no advertising pixel and no third-party analytics script anywhere in this product.
- We never sell your information, and we have never shared medication information with an advertising network.
- We do send the medication name — never your identity — to public data sources, and to an AI provider that reads manufacturer savings pages for us.
- You can delete your account and your medication history yourself, at any time.
What we collect, and why
| What | When | Why |
|---|---|---|
| Medication name, strength, quantity, and what you currently pay | When you run a search | This is the search. Without it there is nothing to price. |
| 5-digit ZIP code | When you run a search | Some programs and prices vary by area. |
| Email address | If you create an account | To sign you in and to send account email. |
| Saved medications | If you choose to save one | So your dashboard can show what you pay against the best option found. |
| A household label, such as “Mom” | If you create one | To let you group medications you manage for someone else. It is a label you type — we do not ask who that person is. |
| Stripe customer and subscription identifiers, and whether the subscription is active | If you subscribe | To know whether to unlock membership features. |
| A short irreversible fingerprint of your browser and IP address | On each session and for rate limiting | To detect a stolen session and to stop automated abuse. The raw IP address is not stored. |
| Waitlist requests: the medication you searched for, and your email if you give one | If you ask us to add a medication | To decide what to add next, and to tell you when we do. The email is optional. |
Your password is not on that list. Account credentials are held by our authentication provider, and SlashedRx never receives or stores a password or a password hash.
What we never collect
None of the following are asked for anywhere in SlashedRx, and there is no field in which to enter them:
- Your diagnosis, condition, or medical history
- Your date of birth
- Your insurance member number
- The name of your doctor, prescriber, or pharmacy
- Your Social Security number or any government identifier
- Uploaded prescriptions, images, or medical records
- Your street address
- Your precise or GPS location
- Your card number
A record that was never created cannot be breached, subpoenaed, or sold. That is the main privacy protection this product offers, and it is deliberate.
Your medication information
We treat what you search for, what you save, and what you tell us you pay as sensitive information, regardless of whether a particular law requires us to. Someone’s medication list is a reasonable proxy for their health, and people expect it to be private.
SlashedRx is not a pharmacy, an insurer, a pharmacy benefit manager, or a healthcare provider, and it does not act on behalf of one. We believe that means HIPAA does not apply to us — but HIPAA not applying is not the same as your information not mattering, and the protections described on this page do not depend on it.
The dedicated consumer health data privacy notice covers this in more detail, including rights available under state health privacy laws.
Location
SlashedRx asks you to type a 5-digit ZIP code. That is the only location information we collect, and it is the level of detail the pricing data works at.
We do not request device location permission, we do not read GPS, and we do not derive your location from your IP address. A ZIP code is not precise location, and we will not describe it as one.
Artificial intelligence
SlashedRx uses AI, and your identity is not part of what it sees.
An earlier version of this notice said there was no AI in this product. That is no longer true, and this section was rewritten before the feature went live, which is what the earlier version promised would happen. It says what the system does, what information reaches it, and what it is not allowed to decide.
What it does. When you search, our server fetches the drug manufacturer’s own public savings page for that medication and sends the text of that page to an AI model, which reports back what the page says about the program: its name, the benefit, the eligibility rules, and any insurance restrictions. It reads those pages at the moment you search rather than relying on a summary someone wrote months earlier and never revisited.
What information reaches it. The medication’s brand and generic name, the strength and quantity you entered, the address of the page being read, and the text of that page. That is the complete list.
Your email address, your account, your ZIP code, your IP address, your saved medications, your search history and what you told us you pay today are not sent to the AI provider. The model is not asked about you. It is asked what a public web page says.
Who the provider is. Anthropic, through its commercial API. Under the commercial terms that apply to that API, Anthropic states that it does not use inputs or outputs to train its models. We rely on that published commitment; we do not independently audit it, and we are not going to describe a third party’s internal practice as something we have verified.
What it is not allowed to decide. Three things, enforced in code rather than requested politely:
- It cannot choose where to send you. Every link it produces is re-checked against the same fixed list of approved destinations that governs every outbound link on this site. A link that does not match is discarded and replaced with the page we actually read.
- It cannot quote you a price. Everything it produces is labelled an estimate, carries the page it came from, and says when it was read. A savings program is not a price quote, and we do not present one as the other.
- It cannot decide anything clinical. It is never asked whether a medication is right for you, whether to switch, or what to take. It is reading a pricing page.
It can still be wrong. A model reading a web page can misread it, and a manufacturer can change a program the day after we read the page. That is why every AI-sourced result links to the manufacturer’s own page and is marked as an estimate rather than a quote. Check the source before you rely on it.
Everything else about a search is still ordinary, deterministic software: we convert options to your quantity, group them by type, and sort each group by price. Ranking means “the cheapest option we found, of the options we checked.” It has never meant, and will never mean, a judgement about which medication is medically right for you.
If what reaches the model changes, or if AI is used for something other than reading a public page, this section changes first.
Advertising and analytics
There is no Meta Pixel, no Google Ads tag, no TikTok pixel, and no third-party analytics script anywhere on this site. We have never sent medication information to an advertising network, and we do not sell search histories.
We do keep our own usage counts, stored in our own database and sent nowhere: how many searches ran, how often savings were found, which of our own internal medication identifiers were involved, and roughly how large the savings were as a coarse band rather than an exact figure. These records carry a visitor identifier that is re-salted every day, so they cannot be joined together from one day to the next to build a profile.
We should be precise rather than flattering about that last point: because those records include an internal identifier for the medication, an entry is not anonymous in the strict sense. It is unlinked from your account, unlinked across days, never sold, and never leaves our database — but we are not going to claim it is impossible to reason about.
How long we keep things
| What | Kept for |
|---|---|
| Searches run without an account | 7 days, then deleted automatically |
| Searches run while signed in | 90 days, then deleted automatically |
| Saved medications and household labels | Until you delete them or your account |
| Account record and email address | Until you delete your account |
| Sessions | Until they expire or you sign out; cleaned up within 7 days |
| Security and administrative logs | DECISION REQUIRED — retention period not yet set |
| Waitlist requests | DECISION REQUIRED — retention period not yet set |
| Usage counts described above | DECISION REQUIRED — retention period not yet set |
| Billing records | Held by Stripe for as long as financial and tax rules require |
| Database backups | REQUIRES VERIFICATION — provider backup window |
The two search figures are enforced by a scheduled job that runs daily, not merely written down here.
Deleting your data
Sign in and use the delete option on your account. Deleting your account removes:
- Your account record and email address
- The identity held by our authentication provider, including your password and any two-factor setup
- Your saved medications and household labels
- Your search history and its results
- Your sessions
What we keep is billing history held by Stripe, which financial and tax rules require and which contains no medication information. Backups are cycled out on their normal schedule.
If deletion cannot be completed in full at the moment you ask — for example if our authentication provider is unreachable — the request fails visibly and nothing is removed, so that you can try again rather than being told your data is gone when part of it is not.
Your rights
Depending on where you live, you may have the right to confirm what we hold, get a copy of it, correct it, delete it, withdraw consent, or appeal a decision we make about such a request.
We will honour access, correction and deletion requests from anyone who asks, regardless of their state, because operating two standards would be more work than operating one.
To make a request, contact us at [PRIVACY EMAIL]. We aim to respond within 45 days. We may need to verify that the request comes from you — usually by asking you to send it from the email address on the account — because handing someone else’s medication history to a stranger would be its own privacy failure.
Security
Information is encrypted in transit. Access is denied by default and granted only where required: the application connects to the database as a role that cannot read another person’s rows, and row-level security is enforced by the database itself rather than by application code remembering to check. Card details never reach our servers. Administrative access requires a second factor.
No online service can promise it will never be breached, and we are not going to tell you otherwise. What we can do is hold as little sensitive information as possible so that there is less to lose, and that is the approach we took.
If a breach affecting personal information occurs, we will notify affected people and the appropriate regulators as required by law.
Children
SlashedRx is intended for adults aged 18 or over. It is not directed at children, we do not knowingly collect information from children, and we do not market to them.
An adult may use SlashedRx to look up a medication for someone else in their household, including a child. In that case the only thing recorded is the medication and a label you type — we do not ask for that person’s name, age, or any other detail about them.
If you believe a child has created an account, contact us at [PRIVACY EMAIL] and we will delete it.
Changes to this notice
When this notice changes, the effective date and version at the top of the page change with it. If a change is material — if we begin collecting something new, sharing with someone new, or using information for a new purpose — we will say so clearly rather than quietly revising the text.
Internally, any new integration involving health data, analytics, advertising, AI, location, payment, referral compensation, or family access requires a privacy review before it ships. That is a written rule, not an intention.
Contacting us
SlashedRx is operated by [LEGAL ENTITY NAME].
Privacy questions and requests: [PRIVACY EMAIL]
Postal address: [BUSINESS MAILING ADDRESS]
SlashedRx provides medication pricing and savings information and does not provide medical advice. Never change or stop a prescribed medication without speaking with your healthcare professional.
These pages describe how SlashedRx actually works. They are not legal advice, and they do not create rights beyond those the law already gives you.