Privacy Policy

Last updated: September 11, 2026

Draft — pending legal review

This page is placeholder content structured for Genkō Prescriptions' eventual policy. It has not been reviewed by legal counsel and must not be treated as a binding agreement until reviewed and approved by qualified counsel familiar with HIPAA, COFEPRIS, and NOM-151 requirements.

This Privacy Policy describes, in draft form, how Genkō Prescriptions intends to collect, use, store, and protect information — including protected health information (PHI) — submitted through the platform.

1. Scope

This policy is intended to apply to all users of Genkō Prescriptions, including prescribing providers, clinic staff, and the patients whose information providers enter into the platform, across both the United States and Mexico.

2. Information we collect

Categories to be finalized with counsel, expected to include: account and provider credentials (including NPI, DEA number, Cédula Profesional, CURP, and RFC where applicable); patient demographic and clinical information entered by providers, including prescriptions and medication history; and billing information processed by our payment provider.

3. How we use information

Placeholder: information is intended to be used solely to operate the e-prescribing service, including issuing and verifying prescriptions, managing subscriptions, and complying with applicable recordkeeping obligations under HIPAA and COFEPRIS/NOM-151.

4. HIPAA and COFEPRIS / NOM-151

Genkō Prescriptions is built with technical safeguards intended to support HIPAA (United States) and COFEPRIS / NOM-151 (Mexico) requirements, such as access controls, row-level data isolation, and signed, time-limited access to stored signatures and documents. This section requires review by counsel qualified in health-data law in both jurisdictions before this policy is treated as final, including any Business Associate Agreement or equivalent required by COFEPRIS.

5. Data sharing and subprocessors

Placeholder: to list subprocessors (e.g., hosting, database, payment processing) and the safeguards required of each once finalized.

6. Data retention

Placeholder: retention periods to be set based on applicable recordkeeping requirements for medical and prescription records in each jurisdiction.

7. Your rights

Placeholder: to describe applicable rights to access, correct, or request deletion of personal data, consistent with HIPAA and Mexico's data protection framework (LFPDPPP) once confirmed by counsel.

8. Contact us

Placeholder: privacy contact details to be added before publication.