Privacy Notice

Review status: reviewed by the Reserve Meds compliance team.

1. Who we are and what this notice covers

Reserve Meds is a digital health company. Medicines are supplied through a US-licensed pharmaceutical wholesale partner. We are not a pharmacy, we do not prescribe, and we do not give medical advice. Your treating physician makes every clinical decision.

Reserve Meds, Inc., a Delaware corporation, is responsible for the personal information described in this notice. Privacy requests are handled by our privacy team.

This notice explains what personal information we collect, why, who we share it with, how long we keep it, and the choices you have. It covers our website (reservemeds.com), our inquiry forms, messages with us by WhatsApp or email, and our patient portal. Questions: privacy@reservemeds.com.

2. Information we collect

• When you send an inquiry: the medicine you ask about, your country, your WhatsApp number, your email if you give it, and anything else you choose to write, such as your name or how urgent your need is.
• When we coordinate a case: your name, date of birth, contact and delivery details, health information about your condition and treatment, your prescription, proof of your physician's license, your identity document, our messages with you, your quote, and records of payments you make to us (such as amount, date and reference).
• About physicians: name, license details, place of work and contact details, when a patient's request involves them.
• Electronic signature records: when you sign your consent or accept a quote in the portal, we keep your typed name, the date and time, your IP address, your device and browser type, and a fingerprint (a SHA-256 code) of the exact text you saw. This lets us show later what you agreed to and when.
• Where your inquiry came from: the page you first landed on, the page where you sent the form, the name of the website that sent you to us (only the site name, not the full web address), campaign tags in the link (such as UTM tags or a Google click ID), and your approximate country based on your internet connection.
• Bot check: our forms use Cloudflare Turnstile to tell people from automated spam. Cloudflare processes technical signals from your browser to do this, and we store only the pass or fail result with your inquiry.
• Website use: we use Google Tag Manager and Google Analytics 4 to understand how the site is used, for example which pages are visited and whether someone taps a WhatsApp, email, phone or portal link or sends a form. These events can include the page, the page language, and the medicine and country when known. We never send your name, email or phone number to Google. Analytics cookies are set only if you choose "Accept all" in our cookie banner. If you choose "Reject non-essential", Google may still receive basic signals without cookies. See our Cookie notice.
• Account and security records: your portal username and a one-way hash of your password (we never store the password itself), a log of sign-in attempts (time, IP address and device), and a log of when staff view or export a patient record. If you tick "Remember this device", we store a random token in a cookie on that device for 30 days so you do not have to sign in each time.

3. How we use your information

• To answer your inquiry and coordinate the medicine request you ask us to handle: checking documents, preparing a written quote, arranging supply, shipping and customs, and keeping you updated.
• To send you messages about your inquiry or case. If you send an inquiry with an email address, we may send up to four follow-up emails about it. Every follow-up email has an unsubscribe link, and we stop as soon as you reply, unsubscribe or ask us to stop.
• To keep records that the law requires, to handle payments, and to deal with complaints or legal claims.
• To keep our systems secure and to prevent spam and fraud.
• To understand, in summary form, how people find and use our website, so we can improve it.
• If you report a side effect, to pass that safety report to the manufacturer or a regulator where safety reporting rules require it.

We use your health information only to coordinate your request. We do not use it for advertising, and we do not sell personal information.

Our legal grounds: your explicit consent (for health information and for sending information outside your country), the need to carry out the service you ask for, legal obligations that apply to us, and our legitimate interest in keeping our services secure. You can withdraw consent at any time (see section 9).

4. Emails we send and delivery tracking

We send email through an email delivery provider. It tells us whether each email was sent, delivered, bounced or marked as spam, so we can fix wrong addresses and stop sending to people who do not want our emails. We do not currently track whether you open our emails. If we ever turn on open or link-click tracking, we will update this notice before we do.

Email notifications never include the content of your messages. Sign in to the portal to read them. Emails come in the language you chose (English or Arabic).

5. Who we share information with

We share only what each party needs for your request:

• our US-licensed pharmaceutical wholesale partner, which supplies the medicine;
• shipping and cold-chain carriers, and customs and import agents in your country;
• your treating physician, when there is a question about your prescription;
• health authorities in your country, when an import permit or approval requires it;
• service providers that work for us under confidentiality terms: Cloudflare (website and portal hosting, data storage, security and the bot check), our email delivery provider (Resend), Airtable (records about referral partners and their referral codes), Google (website analytics, which never receives your name, email or phone number), and WhatsApp (Meta) when you choose to message us there;
• professional advisers, and authorities or courts when the law requires it.

Once information is shared with another organisation, that organisation may also be bound by the laws of its own country.

6. Sending information across borders

Our service works across countries by nature. Reserve Meds operates from the United States, and our service providers may store or process information in the United States or other countries. Your information is also shared with parties in your own country and in the countries a shipment passes through. Data protection laws in those places may differ from the laws where you live.

We send information abroad only to carry out the service you ask for, with your explicit consent, and we limit it to what is needed. Some countries, including Saudi Arabia, the United Arab Emirates, Qatar, Bahrain, Kuwait and Oman, have their own rules for personal and health information. Where those rules apply to us, we follow them.

7. How we protect your information

• Information travels over encrypted connections (HTTPS). Our database and document storage are encrypted at rest by our hosting provider.
• Patient records can be opened only by signed-in Reserve Meds staff accounts, and every time staff view or export a patient record, it is logged. Administrators can review this log.
• Every staff account must use two-step verification with an authenticator app.
• We back up our database and uploaded documents every night to a separate private storage area. Daily backups are kept for 35 days and one backup a month is kept for 400 days. After that they are deleted.

No system is perfectly secure. If a security incident affects your information, we will tell you and the authorities where the law requires us to, without unreasonable delay.

8. How long we keep information

We keep case records for as long as we need them for your case and for as long as the laws that apply to us require, for example tax, payment and medicine supply-chain record rules. When we no longer need information, we delete it. Deleted information can stay in our backups until those backups expire, which is at most 400 days.

9. Your rights and choices

Depending on where you live, you can ask to see and get a copy of your information, correct it, delete it (unless we must keep it by law), limit or object to how we use it, receive it in a portable format, and withdraw your consent. Withdrawing consent stops future steps but does not undo what was done before. You can unsubscribe from follow-up emails with the link in any of them.

To use any right, email privacy@reservemeds.com. We reply within 30 days. If we need more time, we will tell you why. You can also complain to the data protection authority in your country, for example the Saudi Data and AI Authority (SDAIA) in Saudi Arabia or the UAE Data Office in the United Arab Emirates.

10. Children

When a patient is a child, we work with the parent or legal guardian, who provides the information and signs for the child.

11. Changes to this notice

We will post any change on this page with a new date.

12. Contact

Privacy questions or requests: privacy@reservemeds.com. If the English and Arabic versions differ, the English version applies. Arabic version: إشعار الخصوصية.