Privacy Policy

1. Who we are

TrueRoute is prescription ordering and pharmacy operations software for medspas, wellness and IV clinics and the groups that run them. In this policy “TrueRoute”, “we”, “us” and “our” mean TrueEval Medical Group, PLLC, a North Carolina professional limited liability company doing business as TrueRoute, with its mailing address at 4030 Wake Forest Rd, Ste 349, Raleigh, NC 27609.

This policy covers the public website at trueroute.health, the TrueRoute console that clinic staff and prescribers sign in to, the TrueRoute enterprise API, and the information TrueRoute processes to carry a clinic’s patient prescriptions and office-use purchase orders to a licensed pharmacy in our network and to bill the clinic for them.

2. Our role and the clinic’s

TrueRoute does not treat patients, does not practice medicine and does not dispense. A prescription on TrueRoute is written and signed by the clinic’s own prescriber, under that prescriber’s NPI and state licensure, and the clinic owns its relationship with the patient.

When we process a patient’s information, we do so on the clinic’s behalf and on its instructions, as the clinic’s business associate under federal health privacy law. The clinic’s own notice of privacy practices is the notice that governs a patient’s health information, and the clinic decides how that information is used and shared. We use it only to provide TrueRoute to the clinic, as this policy describes, and as the law requires.

If you are a patient, the clinic that treated you is the right first contact for any question or request about your health information. We will help the clinic answer it.

3. Information we hold

Clinic staff who sign in

• Your email address, your clinic, your role in it, and whether your account is active. Your password is held by our sign-in provider, not in TrueRoute’s own tables.
• For an invitation, a one-way hash of the link we sent you, and a mobile number if your administrator asked for the invitation to be sent by text as well.

Prescribers and ordering providers

• Name, degree and title, NPI, email, phone, practice address, and a supervising physician where one applies.
• State licences: state, number, type and expiry, and a copy if the clinic uploads one.
• DEA registrations, if a clinic records them. They are held as a record of the prescriber only: TrueRoute does not send them to a pharmacy or use them to allow any prescription.

Clinics

• The clinic’s legal name, address, business contacts and, where given, its NPI; the shipping addresses it orders to; and the prices, programs and payment terms of its account.
• For a card or bank payment, the details described in Payments.

Patients

• What the prescription and the pharmacy need: name, date of birth, sex and gender identity, residential and shipping address, phone and email.
• Clinical details the prescriber enters for the pharmacy: allergies, current medications, medical conditions, pregnancy status, weight and height, and statements of medical necessity.
• An image of the patient’s identification where the clinic uploads one, and an identifier from the clinic’s own record system where the clinic connects one.
• Whether the patient has agreed to receive text messages, when, and how that agreement was recorded.

Office-use and physician-use purchase orders are orders for the clinic’s own stock. They carry no patient information.

Prescriptions and orders

• The prescription itself, frozen at signature as an unchangeable record of exactly what the prescriber signed, with the time of signature and the network address it was signed from.
• Where each order went, the pharmacy’s responses, shipment status, and the price lines of the order.

People who contact us through the website

• What you type into a form on this site: your name and email and, depending on the form, your role, phone, organization, states, practice size, interests, timeline and message. We also record which page you sent it from and your browser’s user-agent string. We do not store your network address.
• What you type into the website chat, where it is enabled, as described in Cookies and browser storage.
• These forms are for business enquiries. Please do not put patient information in them.

Records of what happened

• An audit record of significant actions, including each time a member of the TrueRoute team opens a patient’s record.
• A log of each notification sent, recording the template, channel and time and a one-way hash of the recipient, never the message itself.

4. How we use it

• To let a clinic write, sign and send prescriptions and place purchase orders, and to check each order against the eligibility gates before it is signed and again before it is sent.
• To transmit each order to the pharmacy that will fill it, and to tell the clinic, and where the clinic has recorded consent the patient, how the order is progressing.
• To charge the clinic for its orders and keep an accurate record of every charge, refund and payment.
• To verify a prescriber’s NPI with the national registry, and to confirm that the prescriber holds a licence on record for the state an order ships to.
• To run, secure, support and fix the service, to keep the records the law requires, and to answer people who contact us.

We do not sell or rent personal information to anyone. We do not use patient information for marketing or advertising, and we do not use it to build profiles of patients.

5. Who receives it

We share information with the following kinds of recipients, each for the purpose given, and with no one else except as described at the end of this section. We give each service provider only the information it needs to do its job for us, and we require it to protect that information.

• The licensed pharmacy in our network that fills the order, directly or through the pharmacy’s own ordering system: the prescription; the patient details it needs to fill and ship it (name, date of birth, sex, address, phone, email and the clinical details above); and the prescriber’s name, NPI, licence, phone, email and address. A pharmacy without a system connection receives the order by secure email. For an office-use purchase order, the pharmacy receives the clinic’s order, its shipping address and, where the program requires one, the ordering provider’s name, NPI and licence.
• Our payment processors and our bank: what is needed to take and record a payment, as described in Payments.
• Our database and sign-in provider: holds our database, sign-ins and stored files.
• Our hosting provider: runs the servers that run TrueRoute.
• Our website delivery provider: delivers this website, runs the bot check on our forms where it is enabled (which receives your network address to do so), and counts page views on the public site.
• Our email provider: sends email, including invitations, order notices and orders to pharmacies without a system connection.
• Our text-message provider: sends and receives text messages, as described in our SMS terms.
• Our CRM provider: runs the chat on our public website where it is enabled, and stores what you type into it, as described in Cookies and browser storage.
• Our error-reporting provider: receives reports of faults so we can fix them. Reports are configured to exclude personal information and are scrubbed before they leave our servers.
• The national NPI registry run by the Centers for Medicare and Medicaid Services, when a prescriber’s or clinic’s NPI is looked up.
• A clinic’s connected systems: where a clinic or its group connects its own system through the enterprise API, that system receives the order updates the clinic has authorized.
• Our professional advisers, such as lawyers, accountants and auditors, under a duty of confidentiality, where they need it to advise us.

We describe our service providers by category rather than by name. A clinic that needs the current list of service providers that handle its patients’ information may ask for it at privacy@trueroute.health.

We may also disclose information where the law requires it, such as in response to a valid subpoena, court order or request from a regulator; where it is needed to protect the safety of a patient or another person, or to protect our rights or the security of the service; and, under the same protections this policy gives, to a buyer or successor if all or part of our business is sold, merged or reorganized. Patient information is disclosed only where federal health privacy law and the clinic’s agreement with us allow.

6. Payments

Card numbers are typed into fields served by our payment processor, not by TrueRoute, and turned into a token in your browser. TrueRoute’s servers never receive the full card number or security code. We keep the token, the card’s brand, last four digits and expiry, the name and billing address entered with it, and what the processor reports about each charge.

When a clinic pays by bank transfer, the payment is made against an invoice from our bank. We keep the invoice, its amount and status, and the business details of the clinic it was issued to. We do not receive or store the clinic’s bank login.

7. Email and text messages

• To clinics. Order emails and texts sent to a clinic, such as receipts, payment notices, order status and shipping updates, carry no patient information. They carry the order number, its status, the items of an office-use or physician-use order, amounts and tracking, and a link into the console, where a signed-in user sees the rest.
• To patients. When a clinic’s order ships, the patient may receive an email, or a text if the clinic has recorded the patient’s consent, saying that their order from the clinic has shipped, with tracking and a link to its shipment status. These messages carry no medication name, dose, strength or product code, and the status link shows logistics only and expires.
• Texts. Consent to receive texts is checked before every text is sent. Replying STOP withdraws it in our own records as well as the carrier’s. Mobile numbers and text-message consent are not shared with third parties or affiliates for their marketing or promotional purposes. Our SMS terms describe the text-message program in full.

8. Cookies and browser storage

• TrueRoute’s servers set no cookies.
• When you sign in to the console, your browser keeps your sign-in session in its local storage so you stay signed in, along with a few display preferences, such as whether the side menu is collapsed, a chosen shipping state for the catalog, and your place in the prescription list.
• The public website installs a small service worker that keeps copies of public pages and files, so the site loads quickly and can show a page when you are offline. It never keeps console pages or anything from your account, and signing out of the console clears it.
• Our website delivery provider adds a page-view counting script to the public website, and the bot check on our forms, where it is enabled, is that provider’s. The console is configured so that the counting script is not added to it.
• Website chat. Where it is enabled, the public website shows a chat window provided by our CRM provider. It appears only on public marketing pages, never in the console, on a shipment status page or on our legal pages. What you type into it, and the name, email or phone you give it, is stored by our CRM provider and by us so we can answer you. An automated assistant answers from the questions and answers we publish on this site and hands the conversation to a person on our team when it cannot answer or when you ask for one. Please do not share patient information in the chat. The chat is loaded from our CRM provider and may set its own cookies or use your browser’s local storage to keep the conversation open between pages.
• We load no advertising trackers and do not sell or share browsing information for advertising.

9. Where it is stored

TrueRoute’s database, the servers that run it, and our error reports are held in the United States. Database backups are taken daily. TrueRoute is offered only in the United States.

10. How we protect it

• One clinic cannot read another’s patients, prescribers or orders. The database enforces that boundary, not the screen.
• Each person has their own sign-in, and each role sees only what it needs; clinic sessions cannot read what an order costs TrueRoute.
• Information travels to and from TrueRoute encrypted, and the order data we send to a pharmacy is also kept encrypted by the application.
• The prescription is frozen at signature, and the frozen copy is what the pharmacy receives.
• The signed prescription, the ledger of charges and the audit record cannot be altered or deleted by the application; the database refuses it.
• Each time a member of the TrueRoute team opens a patient’s record, it is recorded.

No system is perfectly secure, but these controls are built into how TrueRoute works. The security page describes them in more detail.

11. Security incidents

If we learn of a security incident that affects information we hold for a clinic, we will notify that clinic without unreasonable delay, and in any case within the time the law and our agreement with the clinic require. We will tell the clinic what we know about what happened and what information was involved, and help it meet its own obligations, including any notice owed to its patients. Where the law requires us to notify individuals or a regulator directly, we will.

12. How long we keep it

• Permanent records. Signed prescriptions, order and payment records, the ledger of charges and the audit record are kept permanently. Pharmacy, tax and audit rules require these records, and TrueRoute is built so they can be added to but never rewritten.
• Accounts. When a clinic or a person leaves, their account is deactivated rather than erased, so the record of what was done, and by whom, stays accurate. A staff member’s account is deactivated on request by the clinic’s administrator, or by us.
• Website enquiries. On request, we delete the content of an enquiry you sent us through the website, unless a legal obligation requires us to keep it.
• Notification logs record that a message was sent and never the message itself.

13. Your rights and requests

Depending on where you live, you may have the right to ask us what personal information we hold about you, to receive a copy of it, to have it corrected, or to have it deleted.

• Patients. Your clinic controls your health information on TrueRoute, and your rights over it are exercised through the clinic. If you send a request about patient information to us, we will refer it to your clinic and help the clinic answer it.
• Clinic staff and prescribers. Your clinic’s administrator can correct your details or deactivate your account. You can also write to us.
• Everyone else, including people who contacted us through the website: write to us.
• Texts. Reply STOP to any text from TrueRoute to stop them.

To make a request, email privacy@trueroute.health or write to us at the address in Contact us. We will ask you for information that lets us confirm who you are, such as the email address we hold for you, before we act; an authorized agent must also show that you have authorized them. We will respond within 45 days, and tell you if we need longer, as the law allows. Where we cannot delete something because the law requires us to keep it, as with the permanent records above, we will tell you so. We will not treat you differently for making a request.

14. Children

The TrueRoute website and console are for clinic staff and other businesses, and are not directed to children. We do not knowingly collect information from children through them. A clinic may prescribe for a patient who is a minor; that patient’s record belongs to the clinic, is handled on the clinic’s instructions like every other patient record, and requests about it go to the clinic.

15. Changes to this policy

If we change this policy, we will post the new version on this page with its effective date. If a change is material, we will also email each clinic’s account administrators at least 30 days before it takes effect.

16. Contact us

Questions or requests about privacy: privacy@trueroute.health. Anything else: support@trueroute.health, (844) 528-0044, or the contact form.

TrueEval Medical Group, PLLC, doing business as TrueRoute
Attn: Privacy
4030 Wake Forest Rd, Ste 349
Raleigh, NC 27609