Dhruani Privacy Policy

Draft for attorney review. Not in effect. Version 2026-11-15. Effective date: [to be set]. Provider: [Company name].

Dhruani never receives prescription information. It stays on the tag attached to the bottle, and in the pharmacy's own app on the pharmacy's own device. This policy covers the Dhruani app and website, for pharmacy staff and caregivers who write tags, and patients who read them.

Your pharmacy handles your health information under its own privacy practices. Ask your pharmacy for its Notice of Privacy Practices.

Prescription information on tags

A tag holds the information on the printed label: patient name, drug, directions, quantity, refills, dates, Rx number, prescriber, warnings, pharmacy details, and the initials of the pharmacist who checked the label. It can also describe what the medicine looks like, if the pharmacy adds that. When a label is too long for one tag, a second tag holds only the patient name, Rx date, drug, and directions, encrypted the same way. A patient code issued by the pharmacy protects the encryption. It is not stored on the tag or sent to us.

Where it goes: the app writes this information to the tag and reads it from the tag. A patient's app does not save it on the phone. No app sends it to us.
Encryption: the information is encrypted on the tag, so general NFC apps cannot read it as text. Each tag is also signed by the pharmacy device that wrote it, so the app can warn about altered or unapproved tags.
Who can still read it: anyone with the Dhruani app who has the patient code for that tag. A code can be shared or copied, so this is a safeguard, not a guarantee that only the patient can read it.

Records kept on the pharmacy's device

The pharmacy app saves each patient's name and patient code, and each label written for them, so staff can find them again. It also keeps the names, initials, and PINs of the pharmacy's pharmacists. PINs and the admin passcode are stored only in protected, scrambled form.

Encrypted on that device only: records are kept in an encrypted database whose key stays in the device's secure storage. They are not backed up to us, synced, or sent anywhere, and we cannot read them.
The pharmacy is responsible for them: they're part of the pharmacy's own records, under its own privacy practices. Staff can delete a patient or label at any time. Removing access from a device erases every record on it.
Protected by PINs: opening saved patients needs a pharmacist's PIN or the admin passcode, and locks again after 10 minutes.

Data stored on a patient's phone

The patient app keeps your patient codes, including any for people you help, and your language choice, in the phone's secure storage. They are not sent to us.

If you use dose tracking, the app keeps the names of the medicines you scan, their directions, and the times you record taking a dose. This dose log is encrypted and kept only on your phone. It is never sent to us, and never to a caregiver account.

Your pharmacy gets it only if you show it to them in person. You choose Share with my pharmacist, pick which medicines, and the app shows a code with up to 30 days of the doses you recorded. A staff member scans the code from your screen at the counter; nothing goes over the internet or through us. The code stops working after 30 minutes. The pharmacy keeps the copy it scanned, encrypted, on its own computer, as part of its records.

Dose reminders are scheduled on your phone. They name the medicine unless you turn that off, so they may show on your lock screen. You choose when to share a summary, and with whom.

If you use voice commands, the app listens only after you press Speak a command or open it with a voice shortcut, and only for one short phrase. Your phone turns your speech into words, on the phone itself when it can; on some phones, Apple's or Google's speech service does this under their own privacy policies. Dhruani never records, keeps, or sends us your voice or what you said.

Tag counts and balances

Each pharmacy has a balance of tags. Each time a tag is written or a QR label is printed, the pharmacy device sends us a random ID for it, the time, and the tag type, signed by that device. We link these to the pharmacy's account to keep its balance and monthly totals. Reports contain no patient names, patient codes, drug names, directions, Rx numbers, prescriber names, or other label contents.

Reading a tag sends us no tag or patient information. To check tags, the app downloads our full list of approved pharmacy devices, and that request does not say which tag is being read. We do not collect location, contacts, or advertising IDs, and we do not store IP addresses.

If a pharmacy chooses Send error log in the Windows app, the app sends us the reader's commands, status codes, and error messages, with all label data removed first, plus the app version and Windows version. We email it to our support team to fix the problem and do not store it on our servers.

When the Windows app reads a label aloud, it sends that label's text over an encrypted connection directly to Microsoft Azure's speech service, which turns it into speech and sends the audio back. The text does not pass through our servers, and the app does not save the audio.

Translation

Pharmacies write labels in English. If you choose another language, your device translates the directions and warnings using Google ML Kit. Translation happens on the device, and label text is not sent to Google or to us. The app downloads a language pack from Google once, which does not include label information.

Machine translations are not verified by your pharmacy, by us, or by anyone else, and can contain errors. The app reads a warning aloud and shows it on screen before every translated label. Confirm any translated label with your pharmacist.

A pharmacy may also store translations on the tag. Some are certified by a pharmacist who reads the language, and the app says who. Others are AI translations nobody checked, and the app warns you before each one.

If a pharmacy drafts translations with AI, its app sends only the directions, typed warnings, and pill description to the AI provider. It never sends patient names, codes, or Rx numbers, and it uses the pharmacy's own account.

Pharmacy applications and payments

Applicants give us the pharmacy's name, address, phone, NPI, NCPDP ID, and state license number; the pharmacy manager's name, pharmacist license number and state, optional NPI, and mobile number; and a contact name, role, and work email. We compare these with the public NPI registry, email a code, use Twilio to call the pharmacy's registered phone and to text the manager's mobile, and may ask Twilio what kind of line a number is. Pharmacies must not enter patient information in the application.

The pharmacy manager also completes an ID check through Stripe Identity: a photo of a government ID and a selfie. Stripe collects and keeps these under its own privacy policy, and we never receive the images. We receive the result, and the name on the ID only to compare it with the manager's name.

We keep these details, verification results including whether the ID check passed and the name matched, any review notes, the plan chosen, when the pharmacy agreement was accepted, the pharmacy's billing status, and each approved device's public key. A device's private key stays on that device, and we never receive it.

Payments are processed by Stripe. Card details are entered on Stripe's own page and are never sent to us. We receive Stripe's customer and subscription identifiers, payment status, and the tag packs bought.

Apps download the list of pharmacy names and public keys, and the list of caregiver names and public keys, to check tags. Neither contains patient information.

Caregiver accounts

A caregiver account lets an adult write talking tags for up to 10 people they help. Caregiver tags are marked as written by a caregiver, not a pharmacy, and are read aloud with the caregiver's name.

Signing up: caregivers give us their name, email, and state, and accept the caregiver terms. We email a code to confirm the address.
ID check: caregivers complete an ID check through Stripe Identity, with a photo of a government ID and a selfie. Stripe collects and keeps these under its own privacy policy, and we never receive the images. We receive the result, the first and last name on the ID, and the date of birth, which we use only to confirm the caregiver is 18 or older. If the check can't finish automatically, a person at Dhruani may review it, using Stripe's dashboard.
The caregiver's name is public to listeners: the name on the ID is read aloud on every tag the caregiver writes, and is on the list of caregiver devices that apps download to check those tags.
The people a caregiver writes for: their names and patient codes stay on the caregiver's phone, in its secure storage, and are not sent to us. To count the 10 people, the phone sends us a short check made from each person's patient code. Millions of codes share each check value, and it is different for every caregiver account, so it can't identify anyone. For each person, we keep a random ID with that check and the dates they were added and removed.
Tags: what a caregiver writes on a tag is never sent to us. Each tag report carries the same details as a pharmacy's, plus the random ID of the person it was written for.
What we keep: the details above, sign-up and review status, when the caregiver terms were accepted, billing records from Stripe, and each phone's public key.

Service providers and advertising

Our website, databases, security checks, and emails run on Cloudflare, which processes network information such as IP addresses to deliver its service. Twilio receives the pharmacy's registered phone number and the manager's mobile number to place verification calls and texts. Stripe processes payments and runs ID checks for pharmacy managers and caregivers.

The app shows no advertising and contains no advertising identifiers. We do not sell the data described here. We will update this policy and ask for any required consent before that changes.

Your choices and other terms

Permanent tags: a written tag is locked permanently, so nobody can change or erase it, including the pharmacy and us. Destroy the tag before throwing the bottle away.
Phone data: deleting the app removes its data on Android. On iPhone, secure storage may remain after the app is deleted.
Retention: we keep per-tag rows for about three months, tag balances, monthly totals, and billing records for [period to be set], pharmacy and caregiver application records for [period to be set], and caregiver place records for [period to be set].
Requests: contact us with questions about your rights under the law where you live.
Children: the app is not directed at children under 13, and we do not knowingly collect their information. Caregiver accounts are only for adults 18 or older.
Changes: we will post updates here with a new effective date.
Contact: [Company name, address, and email to be added].