Privacy policy
Editor: have this reviewed before launch.
Everything below about what the website collects and where it goes is accurate to how this site is built. The parts marked TO CONFIRM are commitments only your pharmacy can make — how long records are kept, which payment processor you use, and how your state’s pharmacy rules apply. Replace them, then delete this notice.
This policy covers https://zarinapharmacy.tanjilahmed.com/. It explains what the website collects, why, and who else sees it.
Health information you give us as a patient is also covered by our notice of privacy practices, which sets out your rights over it.
What we collect, and when
Nothing is asked for before it is needed. Browsing the catalogue requires no account.
- When you create an account
- Your email address and a password. The password is stored only as a cryptographic hash — we cannot read it, and neither can anyone who obtains the database.
- When you confirm your email
- We email a six-digit code and store only a hash of it, with an expiry. A database read does not yield a working code.
- When you send a prescription
- Patient name and date of birth, a contact phone number, the prescriber’s name, a US delivery address, any notes you choose to add, and the prescription document you upload.
- When you order
- An order record: what was requested, the price, the addresses, and the status history of the pharmacist’s review.
- Automatically, as you use the site
- Your browser sends an IP address and a user-agent string with every request, and our server keeps ordinary access logs. Cookies are covered in the cookie policy.
Payment details
Card numbers never reach this website. Payment happens on a page provided by our payment processor after a pharmacist has approved a prescription, and the card details go to them, not to us. We keep only the fact that an order was paid.
Payment is handled by Stripe. Your card details go to Stripe, not to us — see the Stripe privacy policy. When you submit a prescription Stripe places an authorisation (a hold) on the card and takes nothing; the payment is only completed once a pharmacist approves the prescription, and the hold is released if one is declined.
Where uploaded prescriptions are stored
A prescription you upload is stored outside the public website, in a directory that is not reachable by a web address. It is not placed in the media library and it is not given a public URL. It can be opened only through a route that checks who is asking: you, on your own request, and pharmacy staff reviewing it.
Accepted files are PDFs and images, up to 12 MB. The file is renamed on arrival and its original name kept only as a label.
Why we hold it
- To dispense the prescription — a pharmacist cannot review what they cannot see.
- To verify it with the prescriber’s office where there is a question.
- To keep the records a pharmacy is required to keep by the board of pharmacy that licenses us, and by federal law.
- To contact you about a request you have made — a passcode, a confirmation, an approval with a payment link, or a decline with the reason.
We do not sell your information. We do not use it for advertising, and we do not build profiles for advertisers.
Who else sees it
- Pharmacy staff
- Pharmacists and technicians involved in reviewing and dispensing.
- Your prescriber
- Where we need to verify or query a prescription.
- Our payment processor
- Stripe — card details go to them directly and are never stored on this website.
- Delivery carriers
- The name and address needed to deliver a parcel. [TO CONFIRM: name the carriers you use.]
- Our hosting and email providers
- Who necessarily process what passes through their systems on our behalf. [TO CONFIRM: name your host and transactional email provider.]
- Where the law requires it
- A regulator, a court order, or a lawful request we are obliged to answer.
Third parties the pages call
Some pages load resources from other companies. When that happens your browser contacts them directly and they can see your IP address:
- Google Fonts (
fonts.googleapis.com,fonts.gstatic.com) — the two typefaces the site is set in, on every page. - Google Maps and Google Places — on pages showing our coverage map or our Google reviews.
[TO CONFIRM: if you would rather not disclose visitor IPs to Google at all, the fonts can be self-hosted from this server instead. Ask your developer — it is a small change and it removes the disclosure entirely.]
How long we keep it
Prescription and dispensing records are kept for the period the law requires of a pharmacy, which is longer than we would otherwise keep anything.
[TO CONFIRM: state the retention period your board of pharmacy requires, and how long you keep account records, uploaded documents and website logs after an account closes.]
Your choices
- See what we hold. Ask us and we will tell you.
- Correct it. If a detail is wrong, tell us and we will fix it.
- Close your account. We will close it — but we cannot delete dispensing records we are required to keep.
- Stop marketing email. Any marketing message has an unsubscribe link. Messages about a prescription you have sent are not marketing and continue.
[TO CONFIRM with counsel: which state privacy laws apply to you and what additional rights and disclosures they require.]
Children
This site is not intended for children to use directly. A parent or guardian may of course send a prescription for a child; the account belongs to the adult.
Security
Traffic is encrypted in transit. Passwords and email passcodes are stored hashed. Uploaded prescriptions sit outside the public web root behind an access check. No system is perfectly secure, and we would rather say that than imply otherwise.
Changes
If this policy changes materially we will say so on this page. Last updated: 7 September 2026.
Contact
Questions about this policy, or about information we hold:
- Phone 832-886-4296
- Post 3425 Highway 6 South, Suite 110-B, Sugar Land, TX 77478