Privacy Policy

Section one

Introduction and Scope

This privacy policy explains how information about the visitors of this website is collected, used, and protected. The website and the services it describes are developed and operated by the developer GFC Pharma on behalf of the company named below. By continuing to use this website you accept the practices described in this document.

The organization that is responsible for the website and for the information that is handled on these pages is GFC Pharma LLC, a company located at 1221 Independence Way, Westminster - 21157-3058, United States (US). Throughout this policy the terms the company, we, and us refer to GFC Pharma LLC. The term the Platform refers to this website together with any of its pages and the tools that are made available through it.

This policy applies to the homepage, the page that describes our compounding and formulation services, the page that allows you to contact the laboratory, and any additional page that appears under the same website address. The policy does not apply to websites that belong to other organizations even when a link to such a website appears on our pages. When you follow a link to an outside destination, the privacy rules of that destination apply from that moment onward and we encourage you to read them.

The purpose of stating these rules clearly is to give you a predictable answer before you supply anything about yourself. Where we refer to personal data or to personal information we mean any detail that can be connected to a natural person who can be identified, either on its own or when combined with other facts that we hold. Where we refer to anonymized or aggregate data we mean information from which individual identifiers have been removed so that it cannot reasonably identify a particular person.

Section two

The Data We Collect

We keep the information that we collect to the minimum that is needed for the operation of this website and for the reply to your questions. The categories are described below so that you can understand what a typical use of the Platform involves.

Information that you provide directly

When you use the contact form, when you send an email to the address that appears on this website, or when you telephone the laboratory, you may choose to give us details such as your name, your email address, your telephone number, the subject of your message, and the body of your communication. The same information may be shared with us when you write about a compounding formula, about a service, or about a question related to an order. We do not force you to give more than the minimum that is necessary for us to answer.

Information that is collected automatically

Like most websites, our server and our analytics tools may read routine technical facts about your device. This can include the type and version of the browser you use, the operating system of your device, the general region that your network identifies, the date and time of your visit, the pages that you open, the length of stay on a page, the address of the site that led you to us, and similar measurement data. Much of this automatically collected detail is aggregate in nature and does not by itself reveal who you are.

Information about health or compounding subject matter

The purpose of this website is to describe compounding and formulation services. As a result, a message sent to us may mention a medicine, a dosage form, or an intended use. We treat any health related detail in a message as sensitive and we limit its handling strictly to the reply and to the performance of the requested service. We do not use health related content that you send to us for any unrelated purpose.

The company receives the details above across each of the pages on the Platform, and this privacy policy should be read as covering the whole set of pages unless a page presents a separate notice of its own.

Section three

How We Collect Information

Information reaches us through a small number of routes. First, information passes to us directly when you type details into the contact form and submit it, or when you send an email from your own mail program to the mailbox shown on the website. Second, information passes to us indirectly through standard technical signals, such as the request that your browser sends to the server whenever a page is opened. Third, information may reach us through the records of a service provider that helps us to operate the Platform, for example a web hosting company or an analytics provider that stores measurement summaries on our behalf.

We do not buy lists of visitors, and we do not obtain personal information about people from data brokers so that we may market to them. The main practical collection points are the contact form and the general mailbox, both of which are offered for the single purpose of letting a visitor reach the laboratory with a question or an order. Nothing on this website requires you to establish a member account, and we do not build a private profile of you beyond what is needed for the answer to a message.

When personal information is provided to us as part of a real compounding request, additional facts may arrive from the prescribing professional or from the documents that accompany the order. Such details are collected for the performance of the compounding relationship and the associated record keeping, and they are described in the general terms under which that service is carried out.

Section four

How We Use the Information

We use the details that you provide for the specific purpose that led you to contact us, and for closely related administrative tasks. The principal uses are listed here so that the limits of our activities are clear to you.

• To respond to an inquiry: to answer a question about our compounding services, to confirm that we are able to accept an order, or to explain a requirement that must be met before a batch begins.
• To carry out a requested service: to prepare, document, test, and deliver a compounded preparation when a valid order exists and the request advances to that stage.
• To operate the website: to keep the pages available, to secure the server, and to correct faults when they arise.
• To respond to lawful requests: to cooperate with a regulator, a court, or another authority when the law requires a disclosure.
• To protect the safety of patients: to act when a message raises a concern about the correct use of a compounded product or about the identity of a substance.
• To analyze general traffic: to understand, in aggregate and without reference to a named person, which pages are useful so that we can make the website clearer.

We do not sell your personal information, we do not rent it, and we do not share it with advertisers for the purpose of behavioral advertising. The company does not use the details that identify you to make automated decisions that would have a legal or similarly significant effect on you. Where further use of information would fall outside the purposes above, we would first seek your agreement unless the law allowed us to proceed without it.

Section five

Lawful Bases for Processing

Where the data protection rules of a region ask us to identify the ground on which we process information, we rely on the bases that follow. The exact base can vary with the situation, and we mention the most common ones below.

The arrangement that you start

When you send a question through the form or the mailbox, we process your details because you have taken an action toward us; the reply is carried out at your request. When a valid compounding order follows, the details are processed to perform the requested service.

Our legitimate interest

We rely on our legitimate interest to operate and secure the website, to read and respond to general correspondence, and to keep records that protect the safety of our services. We weigh each use against your interests and your expectations before we rely on this ground.

A legal obligation

Compounding activity is subject to rules about who may release a product and what records must be kept. Where a retention or a disclosure is required by law, we process that data on the basis of the legal obligation that applies to us.

Consent, where relevant

If we ever wish to use your details for a purpose that needs your clear agreement, we will ask for that agreement separately and we will give you an easy way to withdraw it. We will not treat silence as consent.

Section six

Cookies and Similar Technologies

A cookie is a small file that a website places on your device so that the site can remember something between visits, such as a language choice or a setting. Our pages are designed to work without requiring you to accept cookies, and we do not use advertising cookies on this website.

The technical tools that we may employ include basic cookies or similar local storage that improve how the page is delivered, and analytics measurement that records page visits in a summarized form. Where analytics is used, the figures describe general patterns of use, such as the number of visitors to a page or the region that a group of visitors comes from, rather than the actions of a single person.

You remain in control of cookies. Most browsers give you a setting that lets you block or erase cookies or that alerts you when a site tries to store one. Turning off cookies may change how a feature of a website behaves, but it should not stop you from reading the content of these pages or from using the contact form, because the form does not depend on cookies to operate. Because the exact menu differs from browser to browser, we suggest that you look at the help guide of the browser that you use if you want to change how it treats cookies.

Section seven

Sharing and Disclosure

We disclose personal information only in the narrow situations described in this policy. We do not give your details to third parties so that they can market to you.

• Service providers: we may share selected details with providers that help us operate the website or deliver communications, such as a hosting operator or a secure mail service. These providers act on our behalf and under our instructions.
• The prescribing chain: where a real compounding order exists, relevant details may pass to the prescribing professional or to a party that the prescriber has authorized to receive the product on behalf of a patient.
• Law and regulators: we may disclose information when we are required to do so by a legal rule, by a court order, or by a supervisory authority that oversees compounding or professional activity.
• Advisers and succession: in the unlikely event of a sale, a merger, or a reorganization of the business, information may be transferred to the party that takes over the activity, who will be asked to honor this policy.

Whenever we share data with a service provider, we choose providers that agree to keep the data confidential and to use it only for the work we assign. We review the small circle of outside parties that handle our data so that the list does not grow without reason.

Section eight

Third Party Processors and Platforms

To make the Platform available we rely on the help of a limited number of outside processors. These parties may touch technical data or, depending on the activity, parts of a message that a visitor sends. Where possible, they work on data that is either aggregated or limited to what is strictly necessary.

The main examples of external support are the hosting and server environment on which the website runs, the analytics service that returns general usage figures, and the email system through which correspondence is delivered and stored. A secure messaging channel that you choose yourself, such as the mail program on your own device, is under your control and not under ours.

Each processor is selected with attention to its security practices. We enter into an agreement that sets out what the processor may do with data, and we expect each one to protect that data and to delete it when the assignment is finished. The list of processors is small and we do not hide a long chain of middle parties behind it; the technical operation of a simple informational website needs only a modest number of outside helpers.

Section nine

Data Retention

We keep personal information only for as long as it continues to serve the purpose for which it was collected, or for as long as the law requires us to keep it. When neither a purpose nor a legal rule any longer supports keeping the data, we delete it or convert it to an anonymized form.

A routine visitor inquiry is typically retained only until the matter is closed and the short follow up window has passed. Compounding records are different: rules that govern the preparation and release of medicines may ask for batch records, source documentation, and related correspondence to be kept for a defined number of years. Where such a rule applies to a category of data, we follow the longer period that the professional standard demands, because the safety value of a correct record outlasts the immediate task for which the record was first written.

Technical logs that are created automatically are kept for a short period and then removed or summarized, so that we do not build an unnecessary archive of routine visits. At the end of each retention period the records that can no longer be justified are disposed of in a careful manner that does not leave working drafts of personal data lying about.

Section ten

Data Security

We apply reasonable technical and organizational measures to reduce the risk of loss, misuse, or unauthorized access to the information in our care. Access to personal data within the organization is limited to the staff who need it to answer a message or to complete an order, and the people who have that access are guided by the same duty of confidentiality that governs the rest of the work.

Our safeguards include reasonable controls on the accounts that reach the systems, the use of secure connections for the parts of the website where it matters, regular attention to software updates on the servers that host the pages, and the careful disposal of records at the end of their useful life. We do not claim that any method of transmission or storage is completely unbreakable, because no organization can make that promise honestly.

If a loss of personal data should occur in a way that presents a real risk to the people affected, we will take steps to contain the matter, to investigate its cause, and, where the law expects it, to notify the appropriate authority and the affected individuals in a timely fashion. The field of compounding also carries a duty to protect patient safety, and any security event that could affect the integrity of a product or a record would be treated with the same seriousness as any other quality concern.

Section eleven

Privacy for Children

This website offers professional compounding and formulation services that are intended for use by licensed prescribers, health care institutions, and adults who are arranging lawful treatment. The pages are not directed toward children, and the services we describe are not intended to be ordered directly by children.

We do not knowingly collect personal information from children through this website. Because compounding is frequently prepared for the treatment of a patient who may be young, it is possible that a message from a prescriber will refer to a minor patient; in that situation the health related data is provided by the responsible professional as part of a lawful care relationship, and we handle it only for the compounding purpose.

If a parent or a guardian who is reviewing the care of a child comes to believe that the website has collected personal information from a child without a lawful basis, we ask that the concern be sent to alert@gfcpharma.mom. We will review the claim and, where we find that information from a child has been collected in error, we will delete it as soon as is reasonable and we will confirm the deletion to the person who raised the matter.

Section twelve

International Visitors

The laboratory of GFC Pharma LLC is located in the United States, and the information that flows through this website is handled in support of that operation. Visitors from outside the United States should understand that details which they send to us are transmitted into the country where our servers and our team are based.

When you contact us from another region, including a place with its own data protection law, your message crosses an international boundary simply by being sent. We ask for only the small amount of information that is needed to answer, and we take the same care with a message from overseas as we take with one that arrives from down the road. Where the law of your region requires a particular safeguard before personal data can be sent abroad, we rely on the ground that applies to your communication with us, most often the steps that are taken at the request of the person who wrote to us.

This policy and the general terms that describe our services together form the complete agreement about how information from visitors of any nation is treated on this website. No region is asked to accept weaker protection than the rules that already apply to everyone else who uses the Platform.

Section thirteen

Your Rights and Choices

Depending on the law of the place where you live, you may hold a number of rights over the personal information that we keep about you. We honor these rights whether or not your region grants them, within the reasonable limits of the law and of the professional record keeping that compounding requires.

• The right to request a copy of the personal information that we hold about you.
• The right to ask that inaccurate details be corrected without delay.
• The right to request that we delete personal information when there is no longer a legal or professional reason to keep it.
• The right to ask us to restrict processing in certain situations, for example while a question about accuracy is being resolved.
• The right to receive in a structured, commonly used form the details that you gave us, where your region grants that portability right.
• The right to withdraw any consent that you gave us, without affecting the lawfulness of processing that happened before the withdrawal.
• The right to object to processing that is based on a legitimate interest, where your specific situation gives you reason to do so.

To exercise any of these rights, or to raise a question about how your information is handled, please write to alert@gfcpharma.mom with a clear description of your request. We may ask you to confirm your identity so that we do not share your details with someone who is not entitled to receive them. We will respond within a reasonable time, and if a request cannot be met we will explain the reason. Where the law of your region provides for a complaint to a supervisory authority, you may also raise the matter with the authority that covers your place of residence.

Section fourteen

Do Not Track Signals

Some browsers let a visitor send a Do Not Track signal that asks a website not to record browsing across time and across different sites. At present we do not employ technology that builds a behavioral profile of a visitor across many independent websites, so there is no such profile for a Do Not Track preference to switch off.

Because each browser presents the tracking preference in its own way, and because the meaning of the signal is interpreted differently by different websites, we have chosen not to change our behavior solely on the basis of a Do Not Track header. We nonetheless keep the general collection on this Platform modest: we record aggregate traffic for the health of the site, and we collect the content of messages that visitors choose to send. Visitors who prefer a minimum of measurement are welcome to disable cookies and to contact us directly by phone at +19314605100 rather than through a tracked channel.

If the standards around Do Not Track become settled and widely adopted, we will review this position and update the policy to reflect the accepted practice at that time.

Section fifteen

Links to Other Destinations

From time to time the pages of this website may point toward outside destinations, such as the website of a professional body, a regulator, or a reference source. Once you leave this website, the standards that we describe in this policy no longer govern what happens.

We do not control the practices of those outside destinations, and we cannot accept responsibility for how they treat the information of their own visitors. Before you supply any detail to a site that we merely reference, we encourage you to open its own privacy notice and read how it collects and uses data. Nothing in this policy should be read as an endorsement of the content or the security standard of a third party destination merely because a link to it appears on our pages.

The safest habit is simple: treat each website as its own ruler. Authorize the sharing of personal details only where you have read, and are comfortable with, the policy of the site that actually receives them.

Section sixteen

Changes to This Privacy Policy

We may update this policy from time to time to reflect a change in the way the website works, a change in the law, or a change in the practice of the laboratory. When we make a change, we revise the effective date at the top of this page so that you can see how recent the version is.

Material changes that affect how we handle personal information will be announced clearly, either by noting the change on this page or by placing a brief notice on the homepage that points you here. The version that applies to you is the one that is current on the day that you provide your information or on the day that a question about a past contact arises. By continuing to use the website after a revision appears, you accept the updated terms of this policy.

Because compounding touches the safety of patients, we are careful not to make a change that would weaken the protection of health related details. If we ever propose such a step, we would set it out plainly in advance rather than folding it quietly into a routine revision.

Section seventeen

Contact and How to Reach Us

Questions about this privacy policy, requests to exercise a right, and concerns about the handling of personal information should be directed to the operator whose details appear below. Please identify the page concern clearly so that we can route your request to the correct person without delay.

We will read every message that reaches the mailbox and we will respond within a reasonable time after we have confirmed that the request is genuine. In the rare situation where a written answer cannot resolve a matter, we will tell you what the next lawful step is for the complaint pathway in your region. Thank you for taking the time to understand how this website handles the details that you generously choose to share with us.