Privacy Policy
At PillTok, protecting your personal data, medical history, and confidential healthcare interactions is our highest priority. This comprehensive policy details how we gather, utilize, protect, and handle your information across our web application, mobile platform, telehealth consultations, and pharmacy management network.
Key Privacy Commitments at a Glance
01. Introduction and Scope
Welcome to PillTok. PillTok provides an integrated digital healthcare ecosystem that connects patients with licensed healthcare practitioners, certified doctors, and accredited pharmacies. Our services include telehealth consultations (video, audio, and chat), electronic prescription generation, digital medication fulfillment and delivery tracking, and comprehensive pharmacy management systems.
This Privacy Policy applies to all users of our web platform (accessible at pilltok.com and related subdomains), our iOS and Android mobile applications, our APIs, and all associated tools, services, and features (collectively, the 'Platform' or 'Services').
02. Information We Collect
To deliver reliable telehealth care, accurate pharmacy operations, and regulatory compliance, PillTok collects specific categories of personal, clinical, and technical data:
A. Personal Identification & Contact Details
When registering an account as a patient, pharmacist, healthcare provider, or staff member, we collect:
- Full legal name, profile image, and username.
- Contact credentials including email address, phone number, and physical residential or delivery address.
- Demographic information including date of birth, biological sex, and gender identity.
- Government-issued identification and professional practice licensing numbers (strictly for verified medical practitioners and pharmacy administrators).
B. Protected Health Information (PHI) & Medical History
In the course of providing telehealth consultations and pharmacy services, we securely record:
- Health intake questionnaires, symptom descriptions, and pre-consultation vitals.
- Medical history, documented chronic conditions, known drug allergies, and current medications.
- Clinical notes, diagnostic summaries, and electronic prescriptions issued by consulting healthcare practitioners.
- Uploaded diagnostic documents, medical imagery, laboratory results, and previous medical records.
- Medication dispensing logs, dosage instructions, and prescription fulfillment status.
C. Pharmacy Management & Inventory Data
For pharmacy owners, staff, and dispensing partners:
- Pharmacy premise registration certificates and superintendent pharmacist credentials.
- Pharmacy branch locations, operating hours, and localized inventory listings.
- Staff role assignments, dispensing logs, transaction audits, and order processing logs.
D. Mobile Device, Sensor & System Permissions
When using our mobile and web applications, we request hardware and system permissions strictly necessary to execute core telehealth and security functions:
- Camera and Microphone Access: Required exclusively for live telehealth video/audio consultations and document scanning. Audio and video are never recorded or monitored without explicit prior notice and consent.
- Photo Library & File Storage: Required to allow you to upload lab tests, medical reports, and prescription images to your secure health record.
- Biometric Authentication: Support for Face ID, Touch ID, or fingerprint authentication. Biometric template data remains exclusively secured within your device's hardware Secure Enclave and is never transmitted to or stored on PillTok servers.
- Push Notification Tokens: To deliver urgent consultation reminders, practitioner messages, prescription readiness updates, and medication schedules.
- Location Data (Optional): Approximate location used with your permission to identify nearby partner pharmacies for rapid prescription fulfillment.
E. Payment & Transactional Data
For consultation fees, medication orders, and subscription tiers:
- Billing addresses, transaction amounts, invoice receipts, and order histories.
- All payment card details are processed directly by certified Level 1 PCI-DSS compliant payment gateways. PillTok never stores complete credit or debit card numbers on its servers.
03. How We Collect Your Information
We collect data through multiple secure channels during your interactions with the PillTok ecosystem:
- Direct User Input: Information provided during registration, profile completion, onboarding surveys, symptom checklists, and appointment scheduling.
- Clinical Consultations: Data and medical notes generated by licensed doctors and practitioners during encrypted video, audio, or chat telehealth visits.
- Pharmacy Fulfillment Operations: Information shared when a prescription is transmitted to and dispensed by an authorized partner pharmacy.
- Automated Technical Logging: Non-sensitive telemetry such as IP addresses, browser/device types, session timestamps, and crash diagnostic reports collected automatically for platform reliability and security monitoring.
04. How We Use Your Information
We use your data exclusively for legitimate medical, operational, and customer support purposes:
- Facilitating Telehealth Care: Enabling encrypted, low-latency peer-to-peer video, audio, and chat consultations with certified healthcare professionals.
- Electronic Prescribing & Dispensing: Transmitting verified electronic prescriptions to partner pharmacies and coordinating secure delivery or local pharmacy pick-up.
- Pharmacy Workflow Automation: Powering pharmacy inventory management, automated low-stock notifications, branch order queues, and dispensing compliance records.
- Authentication & Security: Implementing One-Time Password (OTP) verification, multi-factor authentication (MFA), fraud detection, and role-based access management.
- Clinical Compliance & Record Retention: Ensuring compliance with statutory healthcare documentation mandates, pharmacy board regulations, and legal audit requirements.
- Platform Enhancement & Support: Resolving technical issues, optimizing application performance, and maintaining system uptime without analyzing personally identifiable health data for commercial algorithms.
05. Data Sharing and Disclosures
We maintain strict boundaries regarding who has access to your information. We disclose information only under the following defined circumstances:
A. Healthcare Professionals & Telehealth Providers
Your health records, symptoms, and consultation histories are accessible strictly to the licensed practitioners you schedule consultations with, or who are directly involved in your care continuum.
B. Accredited Partner Pharmacies & Couriers
When you request prescription fulfillment, relevant medication orders, delivery addresses, and contact phone numbers are shared with the assigned dispensing pharmacy and authorized logistics couriers solely for order fulfillment and package delivery.
C. Vetted Infrastructure & Service Providers
We partner with trusted cloud hosting providers, WebRTC communication infrastructure services, SMS/email transactional delivery gateways, and PCI-DSS payment gateways. All providers are bound by strict Business Associate Agreements (BAA) and Data Processing Agreements (DPA) that enforce equal or higher privacy protections.
D. Legal, Regulatory, and Safety Requirements
We may disclose limited information if legally required by valid court order, subpoena, statutory reporting obligation (such as reportable infectious disease mandates), or when necessary to prevent imminent physical harm or a life-threatening medical emergency.
06. Data Security and Safeguards
We implement multi-layered administrative, physical, and technical safeguards designed to exceed industry security standards for digital healthcare platforms:
- In-Transit Encryption: All network communications are encrypted using Transport Layer Security (TLS 1.3/HTTPS), secure WebSockets (WSS), and WebRTC DTLS-SRTP protocols.
- At-Rest Encryption: Stored health records, electronic prescriptions, patient databases, and document attachments are protected with Advanced Encryption Standard (AES-256) encryption.
- Role-Based Access Control (RBAC): Strict least-privilege policies guarantee that only authorized personnel have access to specific datasets based on their authenticated role.
- On-Device Biometric Safety: Face ID and fingerprint verifications are executed entirely on your hardware device without transmitting biometric keys across the network.
- Audit Logging & Threat Monitoring: Continuous monitoring of application infrastructure, rate limiting against brute-force attacks, and immutable audit logging for clinical record access.
07. Data Retention and Deletion
We retain your data only for as long as necessary to fulfill the purposes outlined in this policy and satisfy statutory healthcare obligations:
A. Statutory Medical Record Retention
Healthcare laws and pharmacy regulatory boards mandate the retention of clinical consultation notes, diagnostic records, and prescription dispensing histories for statutory periods (typically 5 to 10 years depending on jurisdiction and patient age). These clinical archives cannot be erased prior to statutory expiration.
B. Account Deletion and Non-Clinical Data
You can request account deletion at any time through the Settings page on our web or mobile application. Upon confirmed account deletion, non-clinical personal data, marketing preferences, and active session tokens are permanently expunged or anonymized from our live databases.
08. Your Privacy Rights and Choices
Depending on your jurisdiction (including rights under GDPR, NDPR, and healthcare privacy regulations), you are entitled to exercise the following rights regarding your personal information:
- Right of Access: Request a copy of the personal and health data PillTok holds concerning you.
- Right to Rectification: Update or correct inaccurate or incomplete profile and contact information directly in your account dashboard.
- Right to Data Portability: Request an export of your health history and consultation records in a structured, machine-readable format.
- Right to Withdraw Consent: Revoke previously granted permissions (such as camera, microphone, or push notification access) at any time through your device settings.
- Right to Object & Restrict Processing: Object to non-essential data processing activities or restrict processing in specific circumstances.
09. Children's Privacy
PillTok does not knowingly allow individuals under the age of 18 (or the age of majority in your jurisdiction) to create independent accounts without parental supervision.
Pediatric telehealth consultations and prescription management for minors must be managed through a verified parent or legal guardian's primary account, with the guardian providing informed consent for clinical care.
10. Cookies and Tracking Technologies
Our web platform uses strictly necessary cookies and functional session tokens to provide secure login, remember user preferences, and safeguard against cross-site request forgery (CSRF).
We do not utilize invasive cross-site tracking cookies, third-party advertising pixels, or behavior-tracking tools that profile your browsing across other websites.
11. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect enhancements to our platform, updates in healthcare technology, or changes in legal regulations.
When material revisions occur, we will notify you by updating the 'Last Updated' timestamp at the top of this page, delivering an in-app notice, or sending an email notification prior to the changes taking effect. Continued use of PillTok after notice constitutes your acknowledgment of the updated terms.
12. Contact Us & Data Protection Inquiries
If you have questions, feedback, or wish to exercise your data privacy rights, please contact our team:
- Email Support: [email protected]
- Platform Help Center: Accessible directly via the Mobile and Web App Settings