Draft template for legal review. This document is not counsel-approved and may change before publication.

Privacy Policy

Last updated: September 3, 2026

Scriptive LLC ("Scriptive," "we," "us," or "our") operates Scriptive Health, a platform that helps healthcare organizations coordinate supplement recommendations and related fulfillment with trusted partners. This Privacy Policy explains how we collect, use, disclose, and protect personal data when you visit our website, create an account, or use our services.

Who is responsible for your data

For the purposes of applicable data protection law, Scriptive LLC is the data controller for personal data processed through the Scriptive Health platform, except where we process data solely on behalf of a healthcare organization that uses our service (in which case that organization may be the controller for client/patient data they enter).

Contact: privacy@scriptive.health

What data we collect

Depending on how you use Scriptive Health, we may process:

Account and profile data — name, email address, phone number, and authentication identifiers linked to your user account.
Organization and workspace data — practice or organization name, membership role, and settings you configure in the app.
Client data entered by staff — names, contact details, demographic fields, and addresses that authorized users add for clients or patients they manage.
Recommendation and care-plan data — products recommended, notes, fulfillment status, and related workflow metadata.
Integration data — Shopify store connection tokens, product catalog references, draft orders, and checkout links when a connected store is used.
Technical and security data — IP address, browser type, session cookies, and logs needed to operate, secure, and troubleshoot the service.
Communications — messages we send (such as recommendation notifications or invite emails) and support correspondence.

How we use your data

We use personal data to:

Provide, maintain, and improve the Scriptive Health platform
Authenticate users and enforce access controls within organizations
Deliver recommendations, invites, and transactional notifications
Connect to third-party commerce and fulfillment partners you authorize
Comply with legal obligations and protect against fraud or abuse
Respond to support requests and communicate about the service

We do not sell your personal data. We do not use third-party advertising or analytics trackers on the platform at this time.

Legal bases (EEA / UK)

Where the GDPR applies, we rely on:

Contract — to provide the service you or your organization requested
Legitimate interests — to secure the platform, prevent abuse, and improve reliability, balanced against your rights
Legal obligation — where we must retain or disclose data by law
Consent — where required (for example, optional communications or non-essential cookies if we add them in the future)

Processors and subprocessors

We use trusted service providers to host and operate Scriptive Health. These providers process data on our instructions and under appropriate contractual safeguards:

Supabase — authentication, database hosting, and application infrastructure
Shopify — product catalog, store connection, and order fulfillment when you connect a Shopify store
Amazon Web Services (SES) — transactional email delivery
Google — optional single sign-on when you choose to sign in with Google

Data may be processed in the United States and other countries where these providers operate. We use appropriate transfer mechanisms where required by law.

Retention

We retain personal data for as long as your organization maintains an active workspace or as needed to provide the service, comply with legal obligations, resolve disputes, and enforce agreements. Retention schedules for export and deletion requests will be published as self-service data rights tools are added to the platform.

Your rights

Depending on your location, you may have rights to access, correct, delete, restrict, or object to certain processing of your personal data, and to data portability. Where processing is based on consent, you may withdraw consent at any time.

To exercise your rights, contact privacy@scriptive.health. We will respond within the timeframes required by applicable law. You may also lodge a complaint with your local supervisory authority.

Cookies and similar technologies

We use essential cookies for authentication and secure integrations. We also store some interface preferences in your browser's local storage. For details, see our Cookie Policy.

Children

Scriptive Health is intended for use by healthcare organizations and their authorized staff. It is not directed at children under 16, and we do not knowingly collect personal data from children.

Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised version on this page and update the "Last updated" date. Material changes may be communicated by email or in-app notice where appropriate.

Contact

Scriptive LLC
Email: privacy@scriptive.health
General inquiries: hello@scriptive.health