Privacy

This platform is for licensed practitioners and their practices. It is not offered to patients or the general public, and patients do not have accounts.

From the public request forms: your name, practice, role, business email, phone, state, the services you describe and your timeframe.

From practice accounts: the practice's name, address and contact details; each user's name, username, email and role; prescriber credentials such as NPI and license details used to verify the practice; and the orders, invoices and messages the practice creates.

Patient information entered by the practice in order to prescribe: the patient's name, date of birth, contact and shipping details, allergies, and the prescriptions written for them. The practice enters this information and remains responsible for having the right to do so.

Basic technical data such as IP address, browser type and sign-in times, used to keep accounts secure.

To verify practices, route each prescription to the dispensing pharmacy, ship and track orders, issue invoices, answer messages and provide practice support services.

We do not sell personal information, and we do not use patient information for marketing.

When GC Scientific handles patient information on behalf of a practice, it does so as a business associate of that practice under HIPAA.

Patient information is used only to fulfill the prescriptions a practice submits. It is shared with the partner pharmacy that dispenses the prescription and the carrier that delivers it, and with no one else except as the law requires or the practice directs.

Within the portal, a practice can see only its own patients, orders and invoices. Access is limited to individually named accounts, enforced at the database level rather than only in the interface.

Practices that require a business associate agreement should contact contact@gcscientific.com to put one in place before submitting patient information.

Patient information is never used for marketing, and is never sold.

We use a small number of service providers to run the platform: Supabase for database hosting and sign-in, Vercel for application hosting, and Resend for transactional email. When card payments are enabled, card details will be collected and stored by our payment processor, not by GC Scientific.

We keep account, order and invoice records while the practice's account is open, and afterwards for at least seven years — in line with the periods states commonly require for prescription and financial records.

To correct or delete business contact information, or to close an account, email contact@gcscientific.com. Requests about a patient's records should come through the treating practice.

Access is limited to verified practices with individual sign-ins. Data is encrypted in transit, access inside the platform is restricted by practice and by role, and pricing and cost data are separated from clinical users who do not need them.

Privacy questions can be sent to contact@gcscientific.com.