Privacy Policy

1. About this policy

Parm Rx Express (“we,” “us,” or “our”) is a pharmacy registered with the New York State Education Department at 1311 Gravesend Neck Road, Brooklyn, NY 11229. This policy explains what happens to your information on this website.

Your prescription records, and anything you send us on this site that tells us you are a patient, are protected health information under HIPAA. How we use and protect that information, and your rights over it, are described in our Notice of Privacy Practices, which is linked at the bottom of every page. Ask us for a paper copy at the counter or call (718) 627-7070. Where this policy and the Notice cover the same information, the Notice governs.

2. What this website does not do

We built this site to handle as little health information as possible. That is a deliberate choice, and it is the most important thing on this page:

• You cannot upload a prescription here, and we do not ask you to.
• We do not ask for your medication names anywhere on this site. If you are transferring prescriptions, our pharmacist collects those details on the phone or in person.
• We do not sell prescription medication online. The shop is over-the-counter items only.
• There are no accounts or logins on this website.
• We do not use advertising cookies, tracking pixels, or third-party analytics. We do not sell or rent your information to anyone.

3. What we collect

If you ask us to transfer your prescriptions

The form collects your phone number, the pharmacy you are leaving, and your name if you give it. That is all. A pharmacist calls you to take the rest. Today this form cannot send anything: when you press send, the site tells you so and asks you to call us at (718) 627-7070. Nothing is sent silently and nothing is stored. We will not switch the form on until a provider that has signed a HIPAA agreement with us is in place to receive it (see section 4).

If you send us a message

The contact form collects your name, email address, the subject you pick, and whatever you write in the message box. Please keep medication and health details out of it and call us instead. Today this form cannot send anything either: it tells you so and asks you to call. Nothing is stored.

If you shop for over-the-counter items

The shop is a catalog. There is no cart, no account and no checkout on this Site, and looking through it collects nothing about you beyond the ordinary server logs described under “Automatically” below. To order, call us at (718) 627-7070 or come into the pharmacy.

If you join the mailing list

Your email address and your language preference, for occasional pharmacy news and offers. The mailing list is not open yet: the form on this site cannot subscribe anyone today, and it tells you so. When it opens, this section will say where the list is kept and how to leave it.

Automatically

Our hosting provider records standard web server logs, which include your IP address, your browser type, the pages you request and, if you use the shop's search box, the words you searched for. This is ordinary server operation and we do not use it to build a profile of you. The logs are kept for a short period, measured in days, and then deleted.

4. Who else receives information

We use a small number of service providers to run this site. Here is what each one receives.

We do not sell or rent your information. We do not share it with advertisers or data brokers. If we ever wanted to share your information for a reason not listed on this page, we would ask you first, in plain words, and you could say no. We may disclose information where the law requires it, or to protect someone from harm.

5. Health information

The pharmacy is a HIPAA covered entity. Your prescription records, held in the pharmacy, are Protected Health Information and are governed by HIPAA and by our Notice of Privacy Practices.

A transfer request submitted on this site is health information too, even though we do not ask for your medications, because it tells us you are a person seeking pharmacy care. We treat it that way. That is exactly why the form asks for so little, why the medication conversation happens on the phone rather than in a web form, and why the form stays switched off until a provider that has signed a HIPAA agreement with us is in place to receive it.

New York's data security law (the SHIELD Act) also applies to us. Because we follow HIPAA's security rules, we meet its safeguard requirements, and its breach-notice rules apply to any account information we hold (section 8).

We do not use your pharmacy records to send you marketing. If a drug company or anyone else ever paid us to send you a message about a product, we would ask for your written permission first. Refill reminders and messages about your own care are not marketing, and we may send those. Our mailing list is never built from patient records.

6. Cookies and your browser

We do not use advertising cookies, tracking cookies, or third-party analytics cookies. There is no cookie banner on this site because there is nothing to consent to.

This site itself sets no cookies. Two things can keep a small amount of data in your browser's local storage, on your own device: the shop keeps an empty cart placeholder, and if you type a ZIP code into the delivery checker, the site remembers that ZIP code so you do not have to type it again. Neither is used to identify you or to advertise to you, and you can clear both by clearing your browser data.

If you use the Russian toggle, Google's translation service may set its own cookies on Google's domain.

Do Not Track and Global Privacy Control. We do not track you across other websites and we do not sell or share information for advertising, so there is nothing for a Do Not Track or Global Privacy Control signal to switch off; we treat every visitor as if the signal were on. No third party collects information about your activity on this site over time or across other sites.

7. How long we keep things

• Transfer requests and contact messages are not stored by this site today, because the forms cannot send them (section 3). The prescription records the pharmacy holds are kept for the period New York pharmacy law requires, as described in the Notice of Privacy Practices.
• Mailing list entries: none are kept today, because the list is not open yet (section 3).
• Server logs are kept by our hosting provider for a short period, measured in days, and then deleted.

When we no longer need something, we delete it.

8. Security

Traffic to this site is encrypted in transit with HTTPS. We limit what the website collects in the first place, which is the safeguard we trust most: information we never asked for cannot be exposed.

We are not going to tell you that any website is perfectly secure, because no website is. If you would rather not put anything in a web form at all, call us at (718) 627-7070 or come into the store, and we will take care of you exactly the same way.

If something goes wrong. If your information is involved in a security breach that the law requires us to report, we tell you without unreasonable delay: within 30 days of discovering it under New York's SHIELD Act, and within 60 days for information covered by HIPAA. We say what happened and what we are doing about it, by phone, by post or by email, whichever reaches you.

9. Your choices

• Ask what we have. Call us or come in, and we will tell you what information from this website is associated with you. We do not take requests about health information by email, because email is not a safe place for it.
• Ask us to delete. Call us or come in. We confirm who you are, and within 30 days we delete what this website holds about you, except records the law requires us to keep, which no longer carry your name.
• Your HIPAA rights, including the right to see and correct your pharmacy records, to get a copy within 30 days (New York law lets you inspect them within 10 days of asking), and to ask us to limit how we use them, are described in the Notice of Privacy Practices.

10. Children and minors

This website is for adults. It is not directed at children under 13 and we do not knowingly collect their information through it; if we learn that we did, we delete it. If we learn a user is under 18, we use their information only to do what they asked (for example, answer a message) and nothing else, and we honor signals from a device that says its user is a minor. A parent or guardian is of course welcome to manage a child's prescriptions with us, by phone or in the store.

10A. Where we operate

We are a neighborhood pharmacy in Brooklyn. We serve New York residents, we deliver only to the ZIP codes listed in our Terms, and we do not ship to other states or advertise to people outside New York. If you live in another state and used this site anyway, the choices in section 9 are available to you too; just call us.

11. Changes

If we change what this site collects or who receives it, we change this page at the same time and update the date at the top. Each version is dated and we keep every past version; ask us for one. If a change is significant, we say so plainly.

New York is considering a new health-information privacy law. If it takes effect, we will update this page and, where the law requires it, ask your permission before doing anything new with your information.

12. Contact

Questions about this policy, or requests about your information:

Our HIPAA Privacy Officer is reachable at the phone number and address above.