PRIVACY POLICY

Effective August 24, 2026

This Privacy Policy explains what RxDune, Inc. ("RxDune," "we," "us," or "our") collects when you use rxdune.com (the "Site"), what we do with it, and what choices you have.

Plainly: this is a business website. We collect the business contact information you choose to give us so we can respond to you. We do not sell it, we do not share it for advertising, and we name everyone who touches it.

1. What This Policy Does Not Cover

Health plan data. RxDune provides pharmacy benefit management services to employer health plans. Information we handle in that role — including protected health information, member records, eligibility files, and claims — is not covered by this Policy. It is governed by our contract with the plan, the applicable business associate agreement, HIPAA and its implementing regulations, and the plan's own notice of privacy practices. If you are a plan member with a question about your health information, contact your plan administrator.

This Site is not a channel for health information. Do not submit protected health information, member-level claims data, or member identifiers through any form or link on the Site. See Section 5 of our Terms of Service. If you send it to us anyway, we will delete it or move it to a secure channel.

Consumer health data. If any information we collect through the Site were to constitute "consumer health data" under Washington's My Health My Data Act, Nevada's SB 370, or a comparable state law, that information is addressed in our separate Consumer Health Data Privacy Policy.

2. Information We Collect

Information you give us. When you submit a form on the Site, we collect the fields you complete. On the demo request form those are: name, company, whether you are a consultant or broker, an employer, or other, group size in members, work email, and an optional message. On the consultant repricing form those are: name, firm, work email, group size in members, current PBM (optional), renewal date, and an optional note. If you sign up for our notes, we collect your email address. If you email us at an address published on the Site, we receive whatever you put in the email.

Information collected automatically. When you visit the Site, our hosting provider automatically logs standard technical information, including your IP address, browser type and version, device and operating system, referring page, pages requested, and the date and time of the request. This is generated by the act of loading a web page and is used for security, abuse prevention, and service reliability.

What we do not collect. We do not collect payment card information through the Site. We do not ask for Social Security numbers, government identifiers, or precise geolocation. We do not knowingly collect information from children.

3. How We Use Information

We use the information above to:

respond to your inquiry, schedule a conversation, and follow up with you;
prepare and discuss a preliminary repricing or modeling analysis at your request;
send you the notes you subscribed to, until you unsubscribe;
operate, secure, monitor, and improve the Site;
detect, investigate, and prevent fraud, abuse, unauthorized access, and violations of our Terms; and
comply with law and enforce our agreements.

We do not use your information for automated decision-making that produces legal or similarly significant effects about you, and we do not profile you for advertising.

4. How We Share Information

We share personal information only in these circumstances:

Service providers. Vendors who process information on our behalf, under contract, only for the purposes we specify: website hosting and content delivery, email delivery and our business email system, our customer relationship management system, and scheduling. Each is bound to confidentiality and is prohibited from using your information for its own purposes.

Professional advisors. Our attorneys, accountants, auditors, and insurers, where relevant and under professional or contractual duties of confidentiality.

Legal requirements. Where required by law, subpoena, court order, or other legal process, or where we believe disclosure is reasonably necessary to protect the rights, property, or safety of RxDune, our clients, or others, or to investigate suspected fraud or a violation of our Terms.

Corporate transactions. In connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to confidentiality obligations and to this Policy continuing to apply to information transferred.

With your direction. Where you ask us to share it.

We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act and analogous state laws. We have not done so in the preceding twelve months.

5. Retention

We keep information only as long as we have a reason to.

Form submissions and related correspondence: up to twenty-four months from our last substantive contact with you, unless you become a client or ask us to delete it sooner.
Newsletter subscriptions: until you unsubscribe, plus a suppression record so we do not email you again.
Server logs: up to ninety days, unless retained longer for an active security investigation.
Anything we are required to keep for legal, tax, audit, or litigation-hold reasons: for as long as that obligation lasts.

When a retention period ends we delete the information or de-identify it so it can no longer reasonably be associated with you.

6. Cookies, Analytics, and Tracking

We use Vercel Web Analytics to understand aggregate Site usage — which pages are viewed and how the Site performs. It does not set cookies and does not retain IP addresses, which are used transiently to compute aggregate counts and then discarded. We do not use advertising pixels, and we do not permit any provider to use Site data for its own purposes or to track you across other websites. You can control cookies through your browser settings; blocking non-essential cookies will not affect your ability to use the Site.

Global Privacy Control. We treat a Global Privacy Control or other recognized universal opt-out signal transmitted by your browser as a valid request to opt out of any sale or sharing of personal information, in the states where that is required. Because we do not sell or share personal information, this does not change how we handle your data, but the signal is honored.

Do Not Track. Browsers transmit Do Not Track signals inconsistently and there is no common standard for responding to them, so we do not respond to them differently from the above.

7. Security

We take reasonable and appropriate administrative, technical, and physical measures to protect the information we hold, including encryption in transit, access controls limiting access to personnel who need it, and vendor diligence on the providers we use.

We will be honest about the limit: no method of transmitting or storing information is perfectly secure, and we cannot guarantee absolute security. If you believe your interaction with us is no longer secure, contact us at hello@rxdune.com. If you believe you have found a vulnerability in the Site, please report it to hello@rxdune.com rather than testing it further, and we will work with you in good faith.

8. Your Rights and Choices

Everyone. You can ask us for a copy of the information we hold about you, ask us to correct it, or ask us to delete it, by writing to hello@rxdune.com. You can unsubscribe from our notes using the link in any email or by writing to us. You can decline to provide information, though we may not be able to respond to an inquiry without a way to reach you.

Residents of states with comprehensive privacy laws. Depending on where you live, you may have the right to confirm whether we process personal information about you and access it; obtain a portable copy; correct inaccuracies; delete it; opt out of sale, sharing for targeted advertising, or profiling with legal or similarly significant effects; and appeal a denial of any of these requests.

California. In addition to the above, California residents may request disclosure of the categories of personal information we collected, the sources, our business purposes, and the categories of third parties to whom we disclosed it. The categories we collect are identifiers (name, email address) and professional or employment-related information (company, role, group size). We collect them from you directly and from automatic server logs. We disclose them only to the service providers described in Section 4. We do not sell or share personal information and we do not process sensitive personal information for purposes requiring an opt-out. California residents also have the right not to receive discriminatory treatment for exercising these rights, and we will not discriminate.

How to exercise a right. Email hello@rxdune.com with the request and enough information for us to locate your record and verify that the request is yours. We will verify by responding to the email address in our records or by asking you to confirm details you previously provided. We respond within forty-five days, and may extend once by an additional forty-five days where reasonably necessary, and will tell you if we do. There is no charge for a reasonable request. An authorized agent may submit a request on your behalf with written proof of authority. If we deny a request, our response will explain why and how to appeal; appeals go to hello@rxdune.com with "Appeal" in the subject line, and we will respond within the time your state's law requires. You may also have the right to complain to your state attorney general.

9. Children

The Site is directed to businesses and is not intended for anyone under eighteen. We do not knowingly collect personal information from anyone under thirteen, the standard under the Children's Online Privacy Protection Act, or from anyone under sixteen for purposes of any sale or sharing. If you believe a child has provided us information, write to hello@rxdune.com and we will delete it.

10. Where Information Is Processed

We operate in the United States and process information here. If you access the Site from outside the United States, understand that your information will be transferred to and processed in the United States, where privacy laws may differ from those in your jurisdiction.

11. Changes to This Policy

We may update this Policy. The current version is always posted here with its effective date. If we make a material change to how we handle information already collected, we will provide notice appropriate to the change, which may include email or a notice on the Site.

12. Contact

hello@rxdune.com