What the system enforces, and what we do not claim.
Every control on this page is a property of the system — the database, the signature, the message template — rather than a screen that chooses not to show something. Where we do not do a thing, we say so.
Who can see what.
One clinic cannot read another’s
A clinic session reads its own clinic’s patients, prescribers and orders, and that boundary is enforced by the database rather than by the screen. An organization running several clinics decides which pharmacies each one can see; access is opt-in, and a missing row means no.
Fees are documented
Fee and clinic-price configuration is fully versioned — who changed it, when, from what, to what, and why.
The ledger decomposes
Drug cost, platform fee, pharmaceutical fee, fulfillment and shipping are each their own immutable line, and the card is charged their sum — never a separately computed total.
Frozen at signature, checked again before it leaves.
An immutable snapshot
Everything on the review panel is frozen into an immutable snapshot at signature. That snapshot, not a later join, is what the pharmacy receives and what an auditor reads.
Nine gates, twice
The server re-runs the nine gates at signature and again at send. An ineligible order is refused with a reason, never silently re-routed.
Non-controlled only
No DEA workflow and no EPCS. Gate 0 refuses a controlled substance before any pharmacy is considered.
The minimum a patient needs, and nothing a lock screen should show.
No medication detail
Shipment texts and email subject lines carry no medication name, dose, strength or SKU — the template has no parameter for one.
Consent, re-checked
A text is sent only if prior express consent is recorded, checked on every send. Replying STOP flips the consent record in our own system, not just the carrier’s.
A signed, expiring status link
Logistics only — no medication, price, patient record or login. An expired link and an order that does not exist render the same page, so the link cannot be used to probe for one.
Said precisely.
Prescriptions are written under the clinic’s own NPI and state licensure, and no TrueEval provider is ever enrolled at a pharmacy on a clinic’s behalf — the database refuses it.
What we claim about a prescriber is exactly what we do: NPI-validated and clinic-attested. We do not offer live license verification, and we do not describe it as something it is not.
The enterprise API is off by default.
Every request carries a tenant-scoped service credential, a signature over the raw bytes, a timestamp inside a five-minute window and an idempotency key.