Privacy Policy
Last updated: July 10, 2026
This Privacy Policy explains how H2H Solutions, Inc. ("H2H", "we", "us") collects, uses, and protects information in connection with the H2H DigitalRx platform, websites, and related services (the "Services").
1. Scope
This policy covers information we process as a data controller for example, account and website data. Protected Health Information (PHI) that we process on behalf of a covered entity is handled under our Business Associate Agreement and applicable law, which control in the event of any conflict with this policy.
2. Information We Collect
- Account & practice information names, titles, work email, phone, NPI, practice name and address, and billing details you provide at sign-up.
- Health information prescription and clinical data processed to deliver the Services, handled as PHI under the BAA.
- Usage & device data log data, IP address, browser and device type, and activity within the Services, including audit logs required for compliance.
3. How We Use Information
We use information to provide, secure, and improve the Services; to authenticate users and prevent fraud; to transmit prescriptions and related transactions; to meet legal, regulatory, and audit obligations; to bill for the Services; and to communicate with you about your account.
4. Protected Health Information & HIPAA
When H2H processes PHI on your behalf, it acts as a Business Associate under HIPAA. Our use and disclosure of PHI is limited to the purposes permitted by the Business Associate Agreement and the minimum necessary standard.
5. How We Share Information
We share information with the Surescripts network, pharmacies, payers, and PDMP data sources as needed to deliver prescribing services; with vetted subprocessors who support hosting, security, and operations under written contracts; and where required by law, regulation, or valid legal process. We do not sell personal information.
6. Data Security
We maintain administrative, physical, and technical safeguards appropriate to the sensitivity of the information, including encryption in transit and at rest, access controls, multi-factor authentication for controlled-substance workflows, and continuous monitoring and audit logging.
7. Data Retention
We retain information for as long as needed to provide the Services and to meet legal, regulatory, and recordkeeping requirements applicable to prescribing and controlled-substance records, after which it is securely deleted or de-identified.
8. Your Rights & Choices
Depending on your role and jurisdiction, you may have rights to access, correct, or delete certain personal information. Requests regarding PHI are directed to the applicable covered entity. To exercise account-data rights, contact us using the details below.
9. Cookies & Tracking
Our websites use cookies and similar technologies for authentication, security, and analytics. You can control cookies through your browser settings; disabling some cookies may affect functionality.
10. Children's Privacy
The Services are intended for healthcare professionals and are not directed to children. We do not knowingly collect personal information directly from children through the Services.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated through the Services or by email, and the "Last updated" date above will be revised.
12. Contact
H2H Solutions, Inc.
49197 Wixom Tech Drive, Suite B, Wixom, MI 48393, USA
+1 (248) 675-1200 · info@h2hsolutions.com
13. Billing Acknowledgment & Consent Logs
When you make a billing choice at checkout or acknowledge a billing notice within the Services, we record an audit entry of that event. Each entry includes the user identifier, the user's role, a timestamp, the originating IP address, and the version of the notice or consent text that was displayed to you. These records support our commitment that no customer is surprised by a charge or a change in access, and are retained for at least seven (7) years.
14. Data Export & Portability
Account administrators may export practice and prescribing data at any time. Exports are provided in commonly used, machine-readable formats (for example, CSV and PDF, and HL7/FHIR where applicable to clinical records). Availability of specific formats may depend on the data type and your configuration.
15. Retention & Destruction Posture
We retain account, billing-consent, and audit records for at least seven (7) years, and prescribing and controlled-substance records for the period required by applicable law. When a retention period ends and there is no legal obligation to retain the information, it is securely deleted or de-identified. Handling of PHI is governed by the Business Associate Agreement, which controls in the event of any conflict.