AlephQR Privacy Notice

AlephQR was designed to work without knowing who you are. This notice explains exactly what the service processes.

What we do NOT collect

For patients: no accounts, no names, no dates of birth, no health records. The QR code on your bottle contains the medication's public drug code (NDC), the printed directions for taking it (for example, "take one tablet twice a day"), and your pharmacy's prescription number, never your name, your address, your date of birth, or anything else that identifies you. We show those directions back to you on the page so they match your bottle. For a printed QR label we do not keep the directions in our own database, except as described under Fill verification where a pharmacy has turned it on; they are sent to the providers named below to be translated and read aloud, and our hosting provider caches those results as described under Technical processing. The tap labels described below hold the directions by design.

Your prescription number

Your pharmacy's prescription number works like a serial number on the bottle: only your pharmacy can connect it to a person, and your pharmacy is bound by its own privacy obligations. When you open the link, that number passes through our servers and may appear briefly in our hosting provider's standard request logs. The same is true once when your pharmacy prints the label: the label printer asks our server for the QR picture, and that request carries the prescription number. For a printed QR label we do not keep it in our own records, except as a keyed scramble where fill verification is on (described below), and the page itself carries it in the part of a web address that browsers never send to any server. For a tap-to-read label it is held in the VialTap registry as described below.

Chat messages

If you use the chat, your typed messages and the directions from your label are sent to Anthropic (our AI provider) to generate the answer, subject to Anthropic's commercial API terms; we ask you not to include personal details. The directions from your label are also sent to Anthropic to be translated into the language you choose. The translation is cached by the directions text and the language, never by person, so the next patient with the same directions receives the same translation. We do not save conversations in our own database after your session and do not use them to build a profile of you. We record only an anonymous topic category (for example "side-effect question"), the medication code, the language, and the hour, never your words. That topic line is kept by our hosting provider (Vercel) in its standard request logs for its normal retention period, and we keep daily counts of topics, languages and medication codes in our own database for 90 days. If you ask about another medication, its name is looked up by our server in the FDA's public openFDA label database; your device does not contact that service.

Voice and read-aloud

Some pharmacies offer a voice mode. When you tap to start it, the audio from your microphone and the directions from your label are sent to OpenAI (our voice provider) to be understood and answered, subject to OpenAI's API terms; we do not store that audio. That voice connection is made from your device directly to OpenAI, which therefore also receives your IP address. If you dictate a chat message, for most languages your browser's own speech recognition turns your voice into text on the browser maker's servers (for example Google's in Chrome or Apple's in Safari), under that company's terms. For Farsi, Armenian and Egyptian Arabic, and in browsers that have no built-in speech recognition, the audio clip is sent to Microsoft (Azure Speech) to be turned into text. When the page reads aloud in a language our voice service supports (most of the languages we offer), the text being read, including the directions from your label, is sent to Microsoft to be turned into speech; in the other languages, or when that service is unavailable, your device's own built-in voice reads the page on the device. We do not store that audio or text. Audio clips of the directions are cached by the directions text, never by person, as described under Technical processing.

Feedback reports

If you send us feedback (for example, reporting something that looks wrong on a page), we keep what you need us to see and nothing more: your message, the medication's public drug code and page name, your pharmacy's code, the page's language, the page address (reduced to the page name and pharmacy code before anything is stored), and a coarse device type such as "phone" (never a full device fingerprint). We use reports only to find and fix problems with the service. Each report is stored in our database and deleted 365 days after you send it; a copy is also delivered to our staff mailbox so a person sees it promptly; mailbox copies are removed by hand and are not covered by the automatic 365-day deletion. Please do not include your name, date of birth, or other personal details in a report; we automatically redact common identifier patterns, but the safest identifier is the one never typed.

Tap-to-read labels (VialTap)

Some pharmacies use a label with a small chip you tap instead of a QR code. For those labels the directions are not printed inside the code. At fill time the VialTap registry (operated by us for your pharmacy) creates a record against the chip's serial number holding your pharmacy's prescription number, the medication's public drug code, the printed directions exactly as your pharmacy printed them, and the label language. The tap itself is served by vialtap.com, whose hosting provider (Vercel) records your address and the chip serial in its standard request logs for its standard retention. That record exists so a tap shows the directions your pharmacy actually printed. It never contains your name or any other identity, and it is readable only by your pharmacy and by us on your pharmacy's behalf. The record is kept until your pharmacy releases or voids the label, at which point it is deleted; we do not currently delete it on a fixed schedule. The registry holds no lot or batch identifier for the bottle, so a manufacturer or FDA safety notice for a tap label is matched by drug code only, never by lot. Each time you tap, the registry hands our medication page a short-lived reference (valid for 10 minutes) instead of the directions themselves, and our page keeps no copy of the record. The registry also records each tap: the chip serial, whether the label was active at the time, a coarse device type (iPhone, Android or other) and the time; never your address or anything that identifies you. While the record exists, a tap record can be matched to the prescription number through the chip serial. Your pharmacy sees only counts built from those tap records. We have not yet set an automatic deletion period for tap records. After a release or a void, only the chip serial, whether it was a release or a void, the reason given, the pharmacy station identifier, the helper program version and the time are kept for audit.

Serialized tap labels (/t/ addresses)

Some pharmacies print a tap label whose serial number is issued by us; its web address starts with /t/. For those labels we hold the medication code, the lot number and the directions exactly as printed, supplied by the pharmacy's label system, never the prescription number or any identity. The lot number lets the page show a recall notice for that lot the next time the label is tapped. We also record when the label was tapped, which language was chosen, whether the on-page notice was accepted, whether read-aloud, chat or a refill request was used. Your pharmacy can read those records for its own bottles. Those tap records are deleted 400 days after the label was last used. The label record itself (medication code, lot number and directions) is kept so the label keeps working and a recall for that lot can still be shown.

Fill verification (optional, per pharmacy)

Some pharmacies turn on fill verification so a scan can be checked against what the pharmacy actually printed, which protects you from a forged or altered label. When it is on, a small helper program on the pharmacy's own computer sends us, every few minutes, a record for each new fill containing only the prescription number, the medication's public drug code, the printed directions, and the fill time. It never sends your name, date of birth, address, phone number, or prescriber, and we discard those fields if they arrive anyway. The prescription number is stored only as a keyed scramble (an HMAC) that cannot be turned back into the number without a server secret, and the directions are stored as a hash for comparison. During a pharmacy's initial setup the directions may be held readable for the same period so mismatches can be diagnosed. Every fill record is deleted automatically after 30 days.

Technical processing

Your IP address is used to limit how fast the service can be called (rate limiting) and by our hosting provider (Vercel) to deliver the page. A scrambled (hashed) form of the address, not the address itself, is held for up to 2 hours to count requests per hour; this applies to chat, translation, read-aloud, feedback, dictation, voice and medication page views. For medication page views the scrambled address is also held, for the same 2 hours, with a count of the different medication pages it opened in that hour, stored as scrambled codes rather than medication names, so that bulk automated copying can be detected. If bulk copying is detected, an internal alert to our staff includes the first part of the address and a scrambled form of it, the full address is written to our hosting provider's runtime logs, and a record of the alert holding the scrambled form of the address is kept for 3 days. Translations and audio of your directions are cached by our hosting provider for up to 7 days, keyed by the directions text, never by person, and the directions appear in its standard request logs. Page fonts are loaded from Google Fonts, which receives your IP address and browser type on each page load. Your language choice and your choice not to see the entry notice again may be kept in your browser's local storage, on your device only. Medication images and label data are fetched from U.S. government services (DailyMed, openFDA). We use no advertising trackers and no analytics cookies.

Outbound links

Links to FDA MedWatch or a manufacturer's savings program take you to those organizations' sites, which have their own privacy practices.

Questions: call your pharmacy (the number is on your bottle and on the medication page) or write to Info@AlephPS.com. Terms of Use