Privacy Policy

We may collect the following types of information when you register and use MedXchange P2P:

• Business name and contact details
• Pharmacy license number and DEA registration information
• Email address and phone number
• Transaction-related data (orders, listings, pricing)
• Technical data (IP address, browser type, device information)
• Payment and banking information (processed securely via Stripe)
• NPI (National Provider Identifier) number, if provided

We use collected data to:

• Operate, maintain, and improve the MedXchange P2P platform
• Verify user identity, pharmacy licenses, and DEA registrations
• Facilitate secure transactions and connections between licensed pharmacies
• Process payments and manage delayed settlement via Stripe
• Generate DSCSA-compliant T3 transaction documents
• Communicate with users about orders, updates, and platform changes
• Send notifications related to listings, price alerts, and order status
• Prevent fraud, misuse, and unauthorized access
• Comply with applicable federal and state pharmaceutical regulations

We may share your information in the following circumstances:

• With other verified platform users as necessary to complete transactions (e.g., pharmacy name, state, contact details)
• With service providers such as Stripe (payments), Shippo (shipping), and cloud infrastructure providers
• If required by law, court order, or regulatory authorities including the DEA, FDA, or state pharmacy boards
• In connection with a merger, acquisition, or sale of assets (users will be notified)

We implement industry-standard security measures to protect your data, including:

• TLS/SSL encryption for all data in transit
• Secure payment processing via Stripe (PCI-DSS compliant)
• Role-based access controls limiting data access to authorized personnel
• Regular security monitoring and vulnerability assessments

Note: No system is 100% secure. We encourage users to use strong passwords and report any suspected security issues immediately.

We retain your data for as long as necessary to:

• Provide and operate the MedXchange P2P platform
• Meet legal and regulatory obligations (including DSCSA record-keeping requirements)
• Resolve disputes and enforce our terms of service
• Comply with applicable federal and state pharmaceutical laws

Upon account closure, we may retain certain records as required by law for up to 7 years.

As a MedXchange P2P user, you have the right to:

• Request access to the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request deletion of your data (subject to legal retention requirements)
• Opt out of non-essential communications at any time
• Lodge a complaint with a relevant data protection authority

To exercise any of these rights, please contact us at the email address below.

We may use cookies and similar tracking technologies to improve your experience on the platform, maintain session state, and analyze usage patterns. You can control cookie settings through your browser, though disabling cookies may affect platform functionality.

MedXchange P2P operates in the regulated pharmaceutical industry. In compliance with the Drug Supply Chain Security Act (DSCSA) and applicable state pharmacy laws:

• All users must be licensed pharmacies verified through our KYC process
• Transaction records (T3 data) are maintained for regulatory compliance
• We may be required to disclose transaction data to regulatory authorities upon request
• Users are responsible for compliance with their own state pharmacy board regulations

MedXchange P2P is a B2B platform intended solely for licensed pharmacy professionals. We do not knowingly collect information from individuals under the age of 18.

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email or an in-app notification. Continued use of the platform after changes constitutes acceptance of the updated policy.