Spomr

Spomr Privacy Policy

Last updated November 9, 2026.

Spomr, short for Specialty Pharmacy Operations Management Regulatory (the “Company”) is committed to maintaining robust privacy protections for its users. Our Privacy Policy (“Privacy Policy”) is designed to help you understand how we collect, use and safeguard the information you provide to us and to assist you in making informed decisions when using our Service.

For purposes of this Agreement, “Site” refers to the Company’s website, which can be accessed at spomr.com.

“Service” refers to the Company’s services accessed via the Site, in which users can track accreditation evidence, reconcile DSCSA exceptions against EPCIS files, monitor state licensure and Pharmacist-in-Charge requirements, and qualify cold-chain pack-out configurations.

The terms “we,” “us,” and “our” refer to the Company.

“You” refers to you, as a user of our Site or our Service.

By accessing our Site or our Service, you accept our Privacy Policy and Terms of Use (found here: Terms of Use), and you consent to our collection, storage, use and disclosure of your Personal Information as described in this Privacy Policy.

This Privacy Policy covers the Site and the Service. Section VII explains how we handle Protected Health Information (“PHI”) that pharmacies store in the Service under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). For PHI, Section VII controls over the rest of this Privacy Policy, and any Business Associate Agreement (“BAA”) between us and a pharmacy controls over both.

I. Information We Collect

We collect “Non-Personal Information” and “Personal Information.” Non-Personal Information includes information that cannot be used to personally identify you, such as anonymous usage data, general demographic information we may collect, referring/exit pages and URLs, platform types, preferences you submit and preferences that are generated based on the data you submit and number of clicks. Personal Information includes your email [insert specifically what personal information your website collects, i.e. address, date of birth, marital status, contact information, etc.], which you submit to us through the registration process at the Site.

Protected Health Information. Pharmacies that use the Service may store information about their patients, such as prescription, dispensing, shipment and quality records. Where that information is individually identifiable health information that we create, receive, maintain or transmit on a pharmacy’s behalf, it is Protected Health Information (“PHI”) and is handled as described in Section VII.

1. Information Collected via Technology

To activate the Service you do not need to submit any Personal Information other than your email address. To use the Service thereafter, you [do/do not] need to submit further Personal Information [, which may include: list Personal Information collected]. However, in an effort to improve the quality of the Service, we track information provided to us by your browser or by our software application when you view or use the Service, such as the website you came from (known as the “referring URL”), the type of browser you use, the device from which you connected to the Service, the time and date of access, and other information that does not personally identify you. We track this information using cookies, or small text files which include an anonymous unique identifier. Cookies are sent to a user’s browser from our servers and are stored on the user’s computer hard drive. Sending a cookie to a user’s browser enables us to collect Non-Personal Information about that user and keep a record of the user’s preferences when utilizing our services, both on an individual and aggregate basis. For example, the Company may use cookies to collect the following information:

  • [list typical things you may want to track]

The Company may use both persistent and session cookies. Persistent cookies remain on your computer after you close your session and until you delete them, while session cookies expire when you close your browser. [For example, we store a persistent cookie to track (_____)].

2. Information You Provide Us by Registering for an Account

In addition to the information provided automatically by your browser when you visit the Site, to become a subscriber to the Service you will need to create a personal profile. You can create a profile by registering with the Service and entering your email address. Signing in to the Service requires two-factor authentication. By registering, you are authorizing us to collect, store and use your email address in accordance with this Privacy Policy.

3. Information You Give Us When You Request an Account

When you request an account on the sign-up page, the form is sent to signup.spomr.com. The request includes your first and last name, your work email address, the name of your pharmacy or company, your role (Pharmacist-in-Charge, compliance lead, quality or accreditation lead, operations, or other), and the time you accepted these terms. We store the request in our control database, which is hosted by Cloudflare. Our staff read the request in order to contact you and set up your account. We use it for no other purpose. [Retention: we keep a request for [12] months after our last contact with you, or [12] months after we decline it. Counsel to confirm.]

II. How We Use and Share Information

Personal Information

We share Personal Information with vendors who are performing services for the Company, such as the servers for our email communications who are provided access to user’s email address for purposes of sending emails from us. Those vendors use your Personal Information only at our direction and in accordance with our Privacy Policy.

In general, the Personal Information you provide to us is used to help us communicate with you. For example, we use Personal Information to contact users in response to questions, solicit feedback from users, provide technical support, and inform users about promotional offers.

We may share Personal Information with outside parties if we have a good-faith belief that access, use, preservation or disclosure of the information is reasonably necessary to meet any applicable legal process or enforceable governmental request; to enforce applicable Terms of Service, including investigation of potential violations; address fraud, security or technical concerns; or to protect against harm to the rights, property, or safety of our users or the public as required or permitted by law. Disclosures of PHI in response to legal process are governed by Section VII.

Non-Personal Information

In general, we use Non-Personal Information to help us improve the Service and customize the user experience. We also aggregate Non-Personal Information in order to track trends and analyze use patterns on the Site. This Privacy Policy does not limit in any way our use or disclosure of Non-Personal Information and we reserve the right to use and disclose such Non-Personal Information to our partners, advertisers and other third parties at our discretion. This does not apply to PHI, which is governed by Section VII.

In the event we undergo a business transaction such as a merger, acquisition by another company, or sale of all or a portion of our assets, your Personal Information may be among the assets transferred. You acknowledge and consent that such transfers may occur and are permitted by this Privacy Policy, and that any acquirer of our assets may continue to process your Personal Information as set forth in this Privacy Policy. Any transfer of PHI is subject to the applicable BAA, as described in Section VII. If our information practices change at any time in the future, we will post the policy changes to the Site so that you may opt out of the new information practices. We suggest that you check the Site periodically if you are concerned about how your information is used.

III. How We Protect Information

We implement security measures designed to protect your information from unauthorized access. Signing in to your account requires two-factor authentication, and we urge you to take steps to keep your personal information safe by protecting your sign-in credentials and second factor and by logging out of your account after each use. We further protect your information from potential security breaches by implementing certain technological security measures including encryption, firewalls and secure socket layer technology. However, these measures do not guarantee that your information will not be accessed, disclosed, altered or destroyed by breach of such firewalls and secure server software. By using our Service, you acknowledge that you understand and agree to assume these risks. Nothing in this Section III limits our obligations under HIPAA or any BAA.

IV. Your Rights Regarding the Use of Your Personal Information

You have the right at any time to prevent us from contacting you for marketing purposes. When we send a promotional communication to a user, the user can opt out of further promotional communications by following the unsubscribe instructions provided in each promotional e-mail. You can also indicate that you do not wish to receive marketing communications from us in the [list location of opt-out page, i.e. “Settings” section] of the Site. Please note that notwithstanding the promotional preferences you indicate by either unsubscribing or opting out in the [location of opt-out page] of the Site, we may continue to send you administrative emails including, for example, periodic updates to our Privacy Policy. These choices apply only to marketing communications. They do not limit how a pharmacy or we use or disclose PHI, which is governed by Section VII, including the individual rights described there.

V. Links to Other Websites

As part of the Service, we may provide links to or compatibility with other websites or applications. However, we are not responsible for the privacy practices employed by those websites or the information or content they contain. This Privacy Policy applies solely to information collected by us through the Site and the Service. Therefore, this Privacy Policy does not apply to your use of a third party website accessed by selecting a link on our Site or via our Service. To the extent that you access or use the Service through or on another website or application, then the privacy policy of that other website or application will apply to your access or use of that site or application. We encourage our users to read the privacy statements of other websites before proceeding to use them.

VI. Changes to Our Privacy Policy

The Company reserves the right to change this policy and our Terms of Service at any time. We will notify you of significant changes to our Privacy Policy by sending a notice to the primary email address specified in your account or by placing a prominent notice on our site. Significant changes will go into effect 30 days following such notification. Non-material changes or clarifications will take effect immediately. You should periodically check the Site and this privacy page for updates. We will not change how we use or disclose PHI in a way that the applicable BAA does not permit; any such change requires a written amendment to that BAA.

VII. Protected Health Information and HIPAA

Reviewer note (delete before publication): Have healthcare counsel review this section. Confirm that every safeguard, subcontractor, and process described here matches the built system and the executed BAA, and fill in the bracketed items.

1. Our Role as a Business Associate

A pharmacy that conducts HIPAA standard electronic transactions, such as billing health plans, is a “covered entity” under HIPAA. In this Section VII, a covered entity that uses the Service is called a “Customer.” When a Customer uses the Service to create, receive, maintain or transmit PHI, Spomr acts as a “business associate” of that Customer, as those terms are defined in 45 C.F.R. § 160.103. The HIPAA Privacy, Security and Breach Notification Rules apply to us in that role, as described below.

2. PHI We Receive

Depending on how a Customer uses the Service, PHI may include:

  • patient names, dates of birth, addresses and contact information;
  • prescription and dispensing records, including prescription numbers and drug identifiers;
  • product-tracking data, such as GS1 serial, lot and expiration numbers, when linked to a patient or a dispensed prescription;
  • shipment, delivery and pack-out records tied to a patient;
  • insurance and payer information;
  • patient satisfaction responses and quality-management records that identify a patient; and
  • temperature and delivery records linked to a patient shipment.

3. How We Use and Disclose PHI

We use and disclose PHI only as the applicable BAA permits or as required by law (45 C.F.R. § 164.502(a)(3)). In particular:

  • We use PHI to provide the Service to the Customer, including storing, organizing and reconciling records, generating audit binders and exports, and running the compliance checks the Customer requests.
  • We disclose PHI to accreditors, state boards, regulators or other third parties when the Customer directs us to, such as audit binder exports for URAC or ACHC reviews or records requested in a regulatory inspection.
  • We use PHI for our own proper management and administration, or to provide data aggregation services relating to the Customer’s health care operations, only where the BAA permits it (45 C.F.R. § 164.504(e)).
  • If the law requires us to disclose PHI, we will, to the extent the law and the BAA allow, notify the Customer before we disclose it.

We do not sell PHI or use it for marketing (45 C.F.R. §§ 164.502(a)(5)(ii) and 164.508(a)(3)). We request, use and disclose only the minimum necessary PHI to accomplish the intended purpose (45 C.F.R. § 164.502(b)).

4. Business Associate Agreements Control

We provide services involving PHI only under a written BAA with each Customer that meets 45 C.F.R. §§ 164.502(e) and 164.504(e). If this Privacy Policy and a BAA conflict as to PHI, the BAA controls. The BAA sets the permitted uses and disclosures, breach notice timing, return and destruction terms, and other provisions HIPAA requires. This Section VII does not apply to information that is not PHI, such as the business contact details of a Customer’s staff.

5. Safeguards for PHI

As a business associate, we comply with the HIPAA Security Rule (45 C.F.R. Part 164, Subpart C) for electronic PHI. Our safeguards include:

  • Customer data isolation. Each Customer’s data is stored in its own separate database and is not shared with other Customers. As a Customer’s records approach the size limit of a database, they are split by date across additional databases that remain dedicated to that Customer.
  • Access control. Sign-in requires two-factor authentication. Administrative access also uses client certificates.
  • Encryption. PHI is encrypted in transit and at rest.
  • Audit controls. Each write to Customer records is appended to a tamper-evident audit ledger, so changes can be traced and verified.
  • Risk management. We perform risk analyses, train our workforce, and maintain written security policies that we review periodically, as 45 C.F.R. § 164.308 requires.
  • Security incident procedures. We identify, respond to, document and report security incidents involving PHI as described in subsection 7 and the BAA.

We describe these safeguards at a high level and do not publish details that would weaken them.

6. Subcontractors

We use subcontractors that create, receive, maintain or transmit PHI on our behalf, including [cloud hosting provider and any email provider that handles PHI]. Before a subcontractor receives PHI, we require it to agree in writing to the same restrictions and conditions that apply to us (45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2)). We will provide a Customer with a list of the subcontractors that handle its PHI on request.

7. Breach Notification

We will notify the affected Customer of any breach of unsecured PHI without unreasonable delay, and in no case later than 60 calendar days after discovery (45 C.F.R. § 164.410). A breach is treated as discovered on the first day it is known to us or, by exercising reasonable diligence, would have been known to us. Our notice will include the information the Customer needs to meet its own obligations under HIPAA and applicable state breach notification laws. The BAA may require shorter notice, and we will follow the shorter period.

8. Individual Rights to PHI

HIPAA gives patients the right to access their PHI, to request amendments, and to receive an accounting of certain disclosures (45 C.F.R. §§ 164.524, 164.526 and 164.528). Because the Customer is the covered entity, patients should direct these requests to their pharmacy. We do not respond to patients directly unless the Customer asks us to. We will help the Customer respond within the time HIPAA and the BAA require, including by providing PHI and records of disclosures we made on the Customer’s behalf, to the extent our systems keep them.

A patient who believes their privacy rights have been violated may file a complaint with the pharmacy or with the U.S. Department of Health and Human Services, Office for Civil Rights.

9. Return, Destruction and Retention

When our agreement with a Customer ends, we will return or destroy the PHI we maintain for that Customer, as the BAA requires (45 C.F.R. § 164.504(e)(2)(ii)(J)). If returning or destroying PHI is not feasible, we will continue to protect it under the BAA for as long as we keep it, and we will limit further uses and disclosures to the purposes that make return or destruction infeasible. Some records, such as audit records and records that state or federal law requires a pharmacy to keep, may need to be retained for a set period. The BAA governs how those records are kept.

10. De-identified Information

We may create de-identified information from PHI only if the BAA permits it and only by a method described in 45 C.F.R. § 164.514(a)–(b). De-identified information is not PHI. The process of de-identifying PHI is itself a use of PHI that the BAA must allow. The aggregate Non-Personal Information described in Section II is not created from PHI unless the BAA permits it.

11. Legal Requests for PHI

If we receive a subpoena, court order or other legal demand for PHI, we will notify the Customer promptly unless the law prohibits notice. We will disclose only the PHI the demand requires.

12. Do Not Send PHI Through the Site

The Site, including our contact and demo request forms, is a public marketing website. Do not send PHI through the Site, by email, or through any channel not designated for PHI in your BAA. When you request a demo, describe your needs without patient identifiers.

VIII. Contact Us

If you have any questions regarding this Privacy Policy or the practices of this Site, please contact us by sending an email to [privacy@spomr.com]. For questions about PHI or HIPAA, contact our designated HIPAA security official at [name, title, and email].

Last Updated: This Privacy Policy was last updated on November 9, 2026.