Privacy Policy
Effective October 30, 2026 · version 2026-10-30
Who we are
Pharma OS is operated by Joshi Ventures, Inc. ("Pharma OS", "we"). This policy explains what information we collect when pharmacies and their staff use Pharma OS and the pharmaos.health website, how we use it, and the choices you have. Patient information that pharmacies store in Pharma OS is also protected by our HIPAA Business Associate Agreement.
What we collect
- Account information: names, usernames, email addresses, roles and store assignments of the people who use Pharma OS, and hashed passwords (we never store passwords in readable form).
- Pharmacy information: business names, addresses, NPI, licenses, phone numbers, hours and the settings you enter.
- Information you put into the modules: invoices, vendor details, compliance records, training records, store tasks, social media posts and pictures, P&L entries and uploaded documents. HR records you enter about your employees; sensitive HR details (such as date of birth and home address) are encrypted separately.
- Patient information, only where a feature is designed for it and only under the Business Associate Agreement. CMR uploads are checked for patient identifiers and rejected when they contain them.
- Card and bank details are collected and kept by Stripe; we receive only the status of the subscription.
- Technical information: sign-in times, IP addresses, the pages and features used, and errors, kept in security audit logs.
- Enrollment form information from pharmacies that apply.
How we use it
To provide Pharma OS to your pharmacy; to secure it (detecting misuse, keeping audit logs); to support you (Help conversations are read by Pharma OS support when you choose "Talk to a person"); to send service emails such as expiration reminders, receipts and security notices; to bill; and to improve the product using aggregated, de-identified statistics. We don't sell personal information, we don't share it for advertising, and we don't use cookies for tracking. The app stores your sign-in token and display preferences in your browser.
Who we share it with
Only the service providers we need to run Pharma OS, each bound to protect the information and use it only for us:
- Microsoft Azure (hosting, database, file storage and email), in United States data centers.
- Anthropic (AI used for invoice reading, CMR drafts, Ask, Help and social captions). Information is sent only for the request being processed; API data is not used to train their models under their commercial terms.
- OpenAI (AI pictures). Only the picture description is sent, never patient or staff information.
- Stripe (payments).
- Meta and Google, only when you connect your own Facebook, Instagram or Google account and publish to it.
We may also disclose information when the law requires it, to protect people's safety, or as part of a sale or merger of our business with notice to customers.
Security
Information is encrypted in transit (HTTPS) and at rest. Each pharmacy's data is separated by store. Access is limited by role, two-step login is available for every user and required for Pharma OS administrators, security events are written to tamper-proof audit logs, and we monitor the service around the clock. No system is perfectly secure; if a breach affects your information we will notify you as the law and our agreements require.
How long we keep it
While your account is active, and then as described in the Terms of Service: customer data is deleted within 30 days after an account ends, backups expire within 35 days, and security audit logs are kept for their required retention period. Enrollment requests that are not approved are deleted within 12 months.
Your choices and rights
Account owners can view, correct, export and delete their pharmacy's data in the app. Anyone can ask us to access, correct or delete their personal information by writing to support@pharmaos.health; employees of a pharmacy should usually ask their employer first, because the pharmacy controls that data. New York residents also have the protections of the New York SHIELD Act. Patients should contact their pharmacy about their health information.
Children
Pharma OS is a business tool and is not directed to children under 16.
Changes
We will post changes here with a new effective date and email account owners about material changes.
Contact
Joshi Ventures, Inc. (Pharma OS), support@pharmaos.health