AlephQR is the smart-label service of Aleph Practice Solutions, Inc. It was designed to work without knowing who you are. This notice explains exactly what the service processes. Pharmacies that create a portal account should also read the section Pharmacy portal accounts below.
For patients: no accounts, no names, no dates of birth, no health records. The QR code on your bottle contains the medication's public drug code (NDC), the printed directions for taking it (for example, "take one tablet twice a day"), and your pharmacy's prescription number, never your name, your address, your date of birth, or anything else that identifies you. We show those directions back to you on the page so they match your bottle. For a printed QR label we do not keep the directions in our own database, except as described under Fill verification where a pharmacy has turned it on; they are sent to the providers named below to be translated and read aloud, and our hosting provider caches those results as described under Technical processing. The tap labels described below hold the directions by design.
Your pharmacy's prescription number works like a serial number on the bottle: only your pharmacy can connect it to a person, and your pharmacy is bound by its own privacy obligations. When you open the link, that number passes through our servers and may appear briefly in our hosting provider's standard request logs. The same is true once when your pharmacy prints the label: the label printer asks our server for the QR picture, and that request carries the prescription number. For a printed QR label we do not keep it in our own records, except as a keyed scramble where fill verification is on (described below), and the page itself carries it in the part of a web address that browsers never send to any server. For a tap-to-read label it is held in the VialTap registry as described below.
If you use the chat, your typed messages and the directions from your label are sent to Anthropic (our AI provider) to generate the answer, subject to Anthropic's commercial API terms; we ask you not to include personal details. The directions from your label are also sent to Anthropic to be translated into the language you choose. The translation is cached by the directions text and the language, never by person, so the next patient with the same directions receives the same translation. We do not save conversations in our own database after your session and do not use them to build a profile of you. We record only an anonymous topic category (for example "side-effect question"), the medication code, the language, and the hour, never your words. That topic line is kept by our hosting provider (Vercel) in its standard request logs for its normal retention period, and we keep daily counts of topics, languages and medication codes in our own database for 90 days. If you ask about another medication, its name is looked up by our server in the FDA's public openFDA label database; your device does not contact that service.
Some pharmacies offer a voice mode. When you tap to start it, the audio from your microphone and the directions from your label are sent to OpenAI (our voice provider) to be understood and answered, subject to OpenAI's API terms; we do not store that audio. That voice connection is made from your device directly to OpenAI, which therefore also receives your IP address. If you dictate a chat message, for most languages your browser's own speech recognition turns your voice into text on the browser maker's servers (for example Google's in Chrome or Apple's in Safari), under that company's terms. For Farsi, Armenian and Egyptian Arabic, and in browsers that have no built-in speech recognition, the audio clip is sent to Microsoft (Azure Speech) to be turned into text. When the page reads aloud in a language our voice service supports (most of the languages we offer), the text being read, including the directions from your label, is sent to Microsoft to be turned into speech; in the other languages, or when that service is unavailable, your device's own built-in voice reads the page on the device. We do not store that audio or text. Audio clips of the directions are cached by the directions text, never by person, as described under Technical processing.
If you send us feedback (for example, reporting something that looks wrong on a page), we keep what you need us to see and nothing more: your message, the medication's public drug code and page name, your pharmacy's code, the page's language, the page address (reduced to the page name and pharmacy code before anything is stored), and a coarse device type such as "phone" (never a full device fingerprint). We use reports only to find and fix problems with the service. Each report is stored in our database and deleted 365 days after you send it; a copy is also delivered to our staff mailbox so a person sees it promptly; mailbox copies are removed by hand and are not covered by the automatic 365-day deletion. Please do not include your name, date of birth, or other personal details in a report; we automatically redact common identifier patterns, but the safest identifier is the one never typed.
Some pharmacies use a label with a small chip you tap instead of a QR code. For those labels the directions are not printed inside the code. At fill time the VialTap registry (operated by us for your pharmacy) creates a record against the chip's serial number holding your pharmacy's prescription number, the medication's public drug code, the printed directions exactly as your pharmacy printed them, and the label language. The tap itself is served by vialtap.com, whose hosting provider (Vercel) records your address and the chip serial in its standard request logs for its standard retention. That record exists so a tap shows the directions your pharmacy actually printed. It never contains your name or any other identity, and it is readable only by your pharmacy and by us on your pharmacy's behalf. The record is kept until your pharmacy releases or voids the label, at which point it is deleted; we do not currently delete it on a fixed schedule. The registry holds no lot or batch identifier for the bottle, so a manufacturer or FDA safety notice for a tap label is matched by drug code only, never by lot. Each time you tap, the registry hands our medication page a short-lived reference (valid for 10 minutes) instead of the directions themselves, and our page keeps no copy of the record. The registry also records each tap: the chip serial, whether the label was active at the time, a coarse device type (iPhone, Android or other) and the time; never your address or anything that identifies you. While the record exists, a tap record can be matched to the prescription number through the chip serial. Your pharmacy sees only counts built from those tap records. We have not yet set an automatic deletion period for tap records. After a release or a void, only the chip serial, whether it was a release or a void, the reason given, the pharmacy station identifier, the helper program version and the time are kept for audit.
Some pharmacies print a tap label whose serial number is issued by us; its web address starts with /t/. For those labels we hold the medication code, the lot number and the directions exactly as printed, supplied by the pharmacy's label system, never the prescription number or any identity. The lot number lets the page show a recall notice for that lot the next time the label is tapped. We also record when the label was tapped, which language was chosen, whether the on-page notice was accepted, whether read-aloud, chat or a refill request was used. Your pharmacy can read those records for its own bottles. Those tap records are deleted 400 days after the label was last used. The label record itself (medication code, lot number and directions) is kept so the label keeps working and a recall for that lot can still be shown.
Some pharmacies turn on fill verification so a scan can be checked against what the pharmacy actually printed, which protects you from a forged or altered label. When it is on, a small helper program on the pharmacy's own computer sends us, every few minutes, a record for each new fill containing only the prescription number, the medication's public drug code, the printed directions, and the fill time. It never sends your name, date of birth, address, phone number, or prescriber, and we discard those fields if they arrive anyway. The prescription number is stored only as a keyed scramble (an HMAC) that cannot be turned back into the number without a server secret, and the directions are stored as a hash for comparison. During a pharmacy's initial setup the directions may be held readable for the same period so mismatches can be diagnosed. Every fill record is deleted automatically after 30 days.
This section is about pharmacy staff, not patients. When a pharmacy opens a portal account we keep the pharmacy name and city and the contact email addresses the pharmacy gives us; those are the addresses we send sign-in links and billing notices to, and a pharmacy can add more of them later. Those details are held in our database (Neon) for the life of the account. To sign in, a member of staff asks for a sign-in link and we email it to one of those addresses; that message is sent through Resend, or through Google when Resend is not available, so the address and the link pass through whichever of those services delivers it. Signing in sets a session cookie in that person's browser that lasts 30 days and that the pharmacy, or we, can revoke at any time. Asking for a sign-in link also sets a short-lived waiting-room cookie in the browser that asked, holding only a random request identifier, for 15 minutes, and writes a matching waiting-room record in our key-value store (Upstash) holding the pharmacy identifier, a scrambled form of the address and a short pairing code. When the link is approved from another device, that record also holds the address for up to 5 minutes so the waiting browser can be signed in, and it is deleted as soon as that happens. If the pharmacy orders station kits we keep a record of each order: which pharmacy placed it, what was ordered, the total, any note typed with it, and the email address of the person who placed it, so we can ship it and answer questions about it. The payment is taken by Stripe, and we pass Stripe the pharmacy identifier, a summary of the items, the ordering person's email address and that note as order metadata; card numbers never reach us. Support messages sent from the portal are delivered to our staff mailbox, together with the portal email address of the person who sent them, so a person can answer. Stations a pharmacy runs report their own health to us (heartbeats): the station identifier, the software version and when it was last seen. That is machine information only and never contains patient information. To keep sign-in and sign-up safe from abuse we keep a short ledger of notable sign-in events holding the pharmacy identifier and a short scrambled form of the address, never the address itself, and counters of how many sign-in and sign-up requests arrive each hour, keyed by a scrambled form of the address and held for up to 2 hours. Both of those live in our key-value store (Upstash). When we set a pharmacy up by hand instead of through the form, our intake record, held in that same store, also holds the store address, the phone number and the billing email address the pharmacy gave us, and Stripe holds the billing side. To close a portal account and have these records removed, write to Info@AlephPS.com. The one exception to transient handling: when a pharmacy creates an account we keep the accepting user's IP address, the time, and the terms version as evidence of acceptance for the life of the account.
Your IP address is used to limit how fast the service can be called (rate limiting) and by our hosting provider (Vercel) to deliver the page. A scrambled (hashed) form of the address, not the address itself, is held for up to 2 hours to count requests per hour; this applies to chat, translation, read-aloud, feedback, dictation, voice and medication page views. For medication page views the scrambled address is also held, for the same 2 hours, with a count of the different medication pages it opened in that hour, stored as scrambled codes rather than medication names, so that bulk automated copying can be detected. If bulk copying is detected, an internal alert to our staff includes the first part of the address and a scrambled form of it, the full address is written to our hosting provider's runtime logs, and a record of the alert holding the scrambled form of the address is kept for 3 days. Translations and audio of your directions are cached by our hosting provider for up to 7 days, keyed by the directions text, never by person, and the directions appear in its standard request logs. Your language choice and your choice not to see the entry notice again may be kept in your browser's local storage, on your device only. Medication images and label data are fetched from U.S. government services (DailyMed, openFDA). We use no advertising trackers and no analytics cookies.
Links to FDA MedWatch or a manufacturer's savings program take you to those organizations' sites, which have their own privacy practices.
Questions: call your pharmacy (the number is on your bottle and on the medication page) or write to Info@AlephPS.com.